Pope Leo XIV’s AI encyclical and what it means for European cloud governance

An unexpected voice in the AI governance debate

When Pope Leo XIV released his encyclical on artificial intelligence earlier this year, the technology press treated it as a curiosity. A theological document weighing in on machine learning felt like category error. Read it carefully, though, and it is a precise intervention in a debate that European enterprises are already having: who controls AI infrastructure, and what accountability structures prevent that control from being abused?

The encyclical’s central concern is concentration of power. It argues that AI systems, when developed and operated by a small number of entities without adequate oversight, create structural dependencies that undermine human dignity and self-determination. That framing maps directly onto the EU AI Act compliance landscape, where regulators have spent three years trying to codify exactly the same anxiety into enforceable rules.

This is not a coincidence. The encyclical draws on the same body of European social thought that shaped the AI Act’s risk-based framework, the GDPR’s data minimisation principles, and the Digital Markets Act’s structural remedies. The theological language is different; the underlying diagnosis is identical.

What the encyclical actually says about AI governance

Leo XIV’s document identifies three structural risks in current AI development: opacity in decision-making, asymmetric access to AI capabilities, and the erosion of meaningful human oversight when AI systems operate at scale. Each of these has a direct regulatory counterpart in European AI oversight frameworks.

Opacity maps to the AI Act’s transparency and explainability requirements for high-risk systems. If a model cannot explain its outputs to the humans it affects, it cannot be audited, challenged, or corrected. The encyclical frames this as a question of moral accountability; the AI Act frames it as a compliance obligation. The practical requirement is the same: interpretable systems running on infrastructure that preserves audit trails.

Accountability cannot be outsourced to a vendor’s terms of service. If you cannot inspect the infrastructure your AI runs on, you cannot answer for what it does.

Asymmetric access is where the encyclical’s argument lands hardest for enterprise IT teams. When AI capabilities are concentrated in two or three hyperscaler platforms governed by non-European law, European organisations become structurally dependent on entities that answer to different jurisdictions, different courts, and different political pressures. The encyclical calls this a threat to the common good. The AI Act, NIS2, and DORA call it a systemic risk. Both conclusions point toward the same architectural response: AI governance Europe cannot be built on infrastructure that sits outside European legal reach.

EU AI Act compliance and the infrastructure layer

Most AI Act compliance discussions focus on the model layer: risk classification, conformity assessments, technical documentation, post-market monitoring. That work is necessary and substantial. But the infrastructure layer is where many compliance obligations actually become enforceable or fail.

Consider the requirements for high-risk AI systems under Annex III. Operators must maintain logs sufficient for retrospective audit, ensure human oversight mechanisms are technically implemented, and demonstrate that data governance meets the regulation’s quality and provenance standards. None of those obligations can be met if the underlying compute, storage, and network infrastructure is governed by a contract under US law with a unilateral right to modify terms or comply with foreign government requests.

Schrems II made this concrete for personal data. The same logic applies to AI workloads. Training data, inference logs, model weights, and output records all carry compliance significance. Running them on infrastructure subject to the CLOUD Act or equivalent foreign surveillance frameworks creates a structural conflict with responsible AI deployment under European law, regardless of what the vendor’s data processing addendum says.

The three infrastructure questions every AI governance team should answer

• Where is the compute? Physical location matters less than legal jurisdiction. Infrastructure physically located in Europe but owned by a US parent company remains subject to US law. Sovereignty requires European ownership, not just European geography.
• Who can compel disclosure? Foreign government access to AI infrastructure, training data, or inference logs is a compliance event under GDPR and potentially under the AI Act’s data governance requirements. Understand which courts have jurisdiction over your infrastructure provider before you sign.
• Can you audit end to end? AI Act compliance for high-risk systems requires audit trails that you control. If your infrastructure provider can modify, delete, or withhold logs, your compliance posture depends on their cooperation rather than your own governance.

AI ethics regulation and the question of dependency

The encyclical’s most practically useful contribution to the AI ethics regulation debate is its insistence that structural dependency is itself an ethical problem, independent of whether the dominant party behaves well. This is a harder argument than the usual one, which focuses on specific harms. Leo XIV is saying that a governance architecture which requires trust in a single powerful actor is defective even when that actor is trustworthy, because it eliminates the conditions under which trust can be verified and accountability can be enforced.

European AI oversight frameworks are moving in the same direction. The AI Act’s conformity assessment requirements, the proposed AI Liability Directive, and the European AI Office’s supervisory mandate all assume that accountability must be structural, not relational. You cannot govern AI by trusting your vendor. You govern it by controlling the infrastructure, retaining the audit data, and ensuring that your oversight mechanisms are technically independent of the systems being overseen.

Practical implications for enterprise AI architecture

The governance architecture that satisfies both the encyclical’s ethical framework and the AI Act’s compliance requirements looks like this: AI workloads run on infrastructure governed by European law, operated by a provider with no foreign parent company exposure, with contractual guarantees that log data and model artefacts remain within European legal jurisdiction. Human oversight mechanisms are implemented at the infrastructure layer, not delegated to the model vendor. Audit trails are retained under the operator’s control, not the platform provider’s.

This is not a theoretical architecture. It is what European cloud sovereignty means when applied to AI workloads specifically. The encyclical and the AI Act arrive at the same place from different directions: AI systems that concentrate power without accountability are dangerous, and the remedy is structural, not rhetorical.

What changes when a pope and a regulation agree

The convergence between Leo XIV’s encyclical and the EU AI Act compliance framework is significant because it signals that AI governance concerns have moved well beyond the technical community. When the same structural critique appears in a papal document, a European regulation, and the output of academic AI ethics research, it is no longer a niche concern. It is a settled conclusion that responsible AI deployment requires accountable infrastructure.

For IT decision-makers, the practical question is not whether to take AI governance seriously. That question is closed. The question is whether your current infrastructure choices give you the technical means to honour the governance obligations you are already acquiring, and whether the provider you depend on will still be answerable to European law when those obligations are tested.