What “Sovereign AI” Really Means

Two years ago, "sovereign AI" was a phrase used mainly by governments announcing national compute programmes. Today it appears in the marketing of nearly every cloud provider, consultancy and AI start-up selling into Europe. The word has been stretched so far that it now covers everything from a fully air-gapped model running in a bunker to a standard US cloud service with a European data centre and a new logo.

This is not merely a semantic problem. Executives are making procurement decisions on the assumption that "sovereign" means a specific set of guarantees, and those guarantees are frequently not in the contract. The fix is to stop treating sovereignty as a label and start treating it as a set of questions, one for each layer of the stack.

The five layers

Any AI system you use rests on five layers. Sovereignty is the degree to which you, or parties subject to the legal order you choose, control each of them.

1. Jurisdiction. Which courts and governments can compel the operator of the system to act, including to disclose data, suspend service or change behaviour? This is determined by where the operating company and its parent are incorporated, not by where the hardware sits.

2. Infrastructure. Who owns and runs the data centres, the GPUs and the network? Can the service continue if a foreign supplier withdraws, or if export rules change?

3. The model. Who controls the weights? Can they be inspected, pinned to a version, fine-tuned and run indefinitely without the original developer's permission? Or is the model a remote service that can change, be repriced or be withdrawn at someone else's discretion?

4. Data. Where do prompts, outputs, logs, fine-tuning sets and retrieval indexes live? Who holds the encryption keys? What is retained, and for how long?

5. Operations. Who has administrative access to the running system? Who patches it, monitors it, and can see what it is doing? A sovereign deployment administered by a foreign support team through remote access is sovereign in name only.

A product can score well on one of these layers and poorly on the other four. A European region of a US hyperscaler addresses part of the infrastructure layer and some of the data layer, but leaves jurisdiction, model control and often operations where they were. A European start-up reselling access to a US model API is European at the contract layer and nowhere else. Neither is dishonest, but neither is sovereign in the sense most buyers assume.

Why jurisdiction is the layer that decides

Of the five, jurisdiction is the one that most often gets glossed over and the one that matters most in a crisis.

The clearest public illustration came in June 2025, when Microsoft France's legal director told a French Senate inquiry, under oath, that he could not guarantee French customer data would never be passed to US authorities. The cause is the US CLOUD Act, which can oblige US-headquartered providers to produce data under their control wherever it is stored. Microsoft emphasised that it would contest unjustified requests and that no such disclosure of European data had occurred. Both points are reasonable, and neither changes the structure: the safeguard is a legal fight the provider may or may not win, not a technical impossibility.

The same logic applies beyond data access. A provider subject to foreign law can be required to restrict service to certain customers, comply with sanctions or export controls, or alter a product. For most organisations, most of the time, none of this happens. Sovereignty is not about the probable case. It is about whether you retain options in the improbable one.

Why the model layer used to be impossible, and now is not

Until recently, full-stack sovereignty for AI had a hole in the middle. You could own your data centre, your network and your data, but the most capable models existed only as APIs operated by a handful of companies, almost all of them in the United States. Using frontier AI meant accepting dependence at the model layer, and therefore at the jurisdiction and data layers too.

Open-weight models change this. When the weights can be downloaded, the model becomes an asset you can host on infrastructure of your choosing, operated by people under your legal order, with versions you control. The capability gap has narrowed enough to make this a real option rather than a sacrifice: Epoch AI estimated in May 2026 that the best open-weight models had trailed the closed frontier by an average of about four months since the start of the year.

The supply of open models is also no longer confined to one region. Chinese labs have led the open-weight rankings for much of 2026, which for some regulated buyers is itself a sovereignty concern. But the field has widened. France's Mistral released the weights of its trillion-parameter Large 4 at the end of October. In the United States, Reflection published a 501-billion-parameter model under the permissive Apache 2.0 licence in October, explicitly targeting on-premises and air-gapped deployment through hardware partners, and Nvidia has committed very large sums to building open-weight models. In Switzerland, the public Apertus project offers something rarer still: a model whose weights, training data and training recipes are all published.

An important nuance: open weights deliver custody, not transparency. You can run and control a model whose training data you know nothing about. Whether that matters depends on your use case, and it is worth writing down explicitly which of the two your requirement actually needs.

The questions to put to any "sovereign" vendor

When a vendor uses the word, ask these and insist on written answers:

1. Where is the operating company incorporated, and where is its ultimate parent?
2. Can any foreign authority compel you to disclose our data or suspend our service? What is your process if one tries?
3. Which model are we using, who controls its weights, and can we pin a version for as long as we need it?
4. Who has administrative access to the systems processing our data, from where, and under which law are they employed?
5. Who holds the encryption keys, and can you access our data without them?
6. What is retained, for how long, and is any of it used for training?
7. If you disappeared tomorrow, could we run the same system ourselves?

The last question is the most revealing. A truly sovereign arrangement is one you could walk away from without losing the capability. That is only possible when the model itself is something you can carry with you.

Sovereignty as strategy, not defence

It is easy to frame sovereign AI as a defensive compliance exercise. That undersells it. Organisations that control their AI stack can fine-tune models on proprietary knowledge without sharing it, keep systems stable when a vendor changes pricing or deprecates a model, and offer clients guarantees that competitors relying on foreign APIs cannot match. In regulated industries in particular, the ability to say "your data never leaves our legal perimeter, and here is how we prove it" is becoming a commercial differentiator.

The word "sovereign" will keep being overused. The underlying idea is sound, and now, for the first time, technically achievable. The task is to be precise about which layers you need to control, and to buy exactly that.