"Digital sovereignty" is easy to invoke but hard to operationalize, especially once AI enters the stack. This talk walks through how iMio turned sovereignty from a political talking point into a set of concrete, auditable decisions: which EU regulations actually constrain a municipal IT cooperative (GDPR, the AI Act's obligations for public-sector deployers, public procurement law), and how those constraints shaped real choices — where AI models run, what data leaves iMio's control and under what jurisdiction, how vendor lock-in risk was weighed against delivery speed, and where iMio chose to build rather than buy.