BSA's submission to the European Commission's consultation on safeguarding the EU's data sovereignty calls for the EU to secure enforceable commitments from trading partners against data localisation, forced data transfers, and forced disclosure of source code and security architecture. It highlights barriers specific to global enterprise software, cloud, cybersecurity, and AI providers — including sovereign-cloud accreditation regimes, conditional transfer-approval processes, and the emerging localisation of AI training data — while cautioning that EU instruments such as the Cloud and AI Development Act and national schemes like SecNumCloud risk replicating the same origin-based criteria the Commission is asking trading partners to abandon. The contribution stresses that sovereignty is best secured through governance, not geography, and warns against reciprocal EU localisation as a response to foreign discrimination, which would harm European businesses and public bodies before it affects its intended target.