two-letter TLDs are reserved for country codes and not available for private use.

Not available for private use isn't exactly true...

which 2 letter TLDs are not controlled by states?

	▲	shishcat 3 minutes ago \| parent \| next [-]
		.eu :troll:
	▲	fragmede 24 minutes ago \| parent \| prev [-]
		Supposedly none because they're only given to states, but there're a few that have some murky administrative situations.