.IA is a European sovereignty petition, not a new internet district

THE SIGNAL IN ONE SENTENCE

Europe has not created a new internet neighborhood for trustworthy artificial intelligence. It has registered a request to discuss one. On October 6, the European Commission registered a European citizens' initiative titled Creation of a European Digital Space (.IA) for Sovereign AI Governance. The organizers want the Commission to propose a framework for high-trust digital spaces and begin European-level negotiations with the International Organization for Standardization and the internet governance bodies ICANN and IANA over a proposed .IA namespace. The proposal has an appealing visual logic. Today, an AI service can have a polished website, a privacy page and a small shield icon while leaving basic questions unanswered. Who operates it? Where is the data processed? Which model is running? Has anyone audited the system? Which authority can investigate a complaint? What happens when the operator changes the product next Thursday? A dedicated namespace could, in theory, create a recognizable doorway for services that meet shared European conditions. That is the theory. The current reality is much earlier. Commission registration means the initiative met the formal conditions for legal admissibility. The Commission's own notice says it has not examined the substance of the proposal. It has not endorsed the design, promised legislation, secured the namespace or announced an operating registry. The organizers have six months to open signature collection. Once collection begins, a European citizens' initiative has at most twelve months to gather at least one million valid statements of support, including minimum thresholds in at least seven EU countries. If it clears that bar and verification, the Commission must examine the request and publish a response. It is not required to propose a law. If the Commission does propose legislation, the European Parliament and Council would still have to consider and adopt it through the normal process. So .IA is not a product launch. It is a civic route into a policy argument. That distinction is the first useful thing to understand. The second is that a domain label cannot carry trust by itself. The organizers describe three goals. First, they want an EU framework for high-trust digital spaces and regulatory sandboxes for ethical AI. Second, they want negotiations with ISO and ICANN or IANA to reserve, protect and assign the .IA namespace as a European digital-sovereignty resource. Third, they want registration and domain resolution connected to European digital identity, transparent algorithm-audit procedures, the AI Act and the General Data Protection Regulation. Those goals combine several different systems. The Domain Name System helps a browser find the infrastructure associated with a name. A registry decides which names exist under a top-level domain. Registrars sell or allocate names to applicants. Identity systems establish something about the person or organization applying. Auditors examine claims or controls. Regulators interpret and enforce laws. Putting those systems near one another does not automatically make them one trustworthy machine. Imagine a company registers a name inside a future .IA space. What exactly has been verified? Perhaps the applicant proved its legal identity. That does not prove its model is accurate. Perhaps the company passed an audit in March. That does not prove the service running in October is unchanged. Perhaps its servers are in Europe. That does not reveal where every subcontractor, model provider or logging system sends data. Trust needs a claim map. Every protected label should state what it means, who tested the claim, when the evidence expires and which authority can remove the name or sanction the operator when the claim becomes false. Without that map, .IA risks becoming a premium sticker for ordinary services. The identity proposal deserves special care. Linking registration to the European digital identity framework could reduce anonymous abuse and make ownership easier to trace. It could also create a narrow gate that excludes small developers, open-source communities, researchers or public-interest projects that cannot navigate an expensive certification process. Identity can establish who is responsible. It should not become a reason to collect more personal data than the task requires. A sensible design would separate several layers. The registry needs verified organizational ownership, current contact information and a transparent chain of responsibility. Users do not need the private identity documents behind that verification. Auditors need access to technical evidence. They do not need permanent access to every customer record. Regulators need a path to investigate. They do not need a single central database containing the activity of every person who visits a participating service. The audit proposal has a similar problem. Algorithm audit can mean almost anything, from checking a policy document to testing a deployed system with real-world data. A future high-trust namespace would need minimum audit scopes tied to the service's risk. A low-stakes writing assistant might publish its model providers, data practices, security controls and evaluation summary. A hiring system should face stronger tests for discrimination, notice, human review and appeal. A medical system needs clinical validation, change control and incident reporting. A government service needs public-law accountability and a route for a person to challenge an outcome. One badge cannot flatten those differences. The namespace would also need change control. AI services can change models, prompts, data sources, retrieval systems, safety filters and tool permissions without changing their address. If a domain's trust status survives every major product change automatically, the audit quickly becomes stale. Operators should have to report material changes. High-risk services should trigger a new review. The public record should show the current model or system version, audit date, declared uses, prohibited uses, responsible operator and any unresolved enforcement action. Then comes infrastructure. A sovereign label can point to a service hosted almost anywhere unless the policy defines location, control and supply-chain requirements. Does .IA require EU data residency? EU ownership? European control of encryption keys? Freedom from third-country legal demands? An exit plan from a non-European cloud provider? Open interfaces that let customers move? Different public services may need different levels of assurance. The European Commission's broader sovereignty work already distinguishes among levels of location, independence, ownership and supply-chain control for cloud and AI services. A proposed namespace should not invent a second, incompatible definition merely because the address looks tidy. Interoperability is where the initiative could become genuinely useful. A domain could point not only to a homepage but also to machine-readable records. A browser, procurement system or regulator could retrieve the operator identity, declared purpose, relevant legal category, audit status, data-processing region, incident contact and version history. That would turn the name into an index for evidence. It would still need security. Domain hijacking, fraudulent applications, compromised registrar accounts and misleading subdomains are not theoretical annoyances when people are expected to treat the address as trustworthy. A serious design needs strong authentication, signed records, rapid suspension, transparent appeals, abuse reporting and recovery after a mistake. Enforcement must also be visible. Who can suspend a domain? On what evidence? Can a company appeal? Does suspension remove the service from the internet or only the high-trust label? How quickly must a serious vulnerability or ownership change be reported? Are enforcement decisions public? Can national authorities act, or only a European body? These questions sound dull until somebody's business, benefit, diagnosis or reputation depends on the answer. The organizers are right about one broad point. People need better signals for the provenance and accountability of AI services. App stores, search rankings and marketing claims are poor substitutes for a verified public record. Europe has identity, privacy and AI laws that could support a more legible trust layer. The difficult part is making the layer useful without pretending that naming is governing. The next milestone is not technical deployment. It is the signature campaign. The organizers must choose a start date within six months of registration, build support across at least seven countries and explain the proposal well enough for one million people to sign. That campaign should publish the draft operating model alongside the slogan. Citizens deserve to know who would run the registry, which services could apply, what compliance would cost, how audits would work, how open-source projects would participate, which claims a domain would certify and how bad actors would be removed. They also deserve candor about the international part. The reviewed Commission materials call for negotiations with ISO and ICANN or IANA. They do not establish that .IA is available, that those bodies have accepted the concept or which technical and legal path could create or reserve it. That uncertainty is not a reason to dismiss the initiative. It is a reason to keep the nouns honest. Registration is not endorsement. A petition is not a policy. A namespace is not an audit. A domain is not a regulator. A label is not trust. The plain signal is simple. .IA could become a useful address for evidence-backed European AI services. First, its supporters have to prove that the evidence behind the address would be stronger than the branding in front of it.