Sovereign AI is a question of control

“Sovereign” has become one of the words attached to AI products, and it rarely means the same thing twice. Said of a country, it means national capability: infrastructure, data and expertise built at home. Said of a product, it usually means a hosting option: information held in your country, sometimes operated by local staff, sometimes with encryption keys you hold yourself.

The second is the version that arrives in a proposal, and it is usually described as a place. Place matters. It is also the easiest part to buy, and on its own it settles less than it appears to. For an organisation, sovereignty is better understood as control: over where the work happens, over whose law can reach it, and over whether the system keeps doing tomorrow what it did today.

Residency is not sovereignty

Data residency is a promise about location. It says where information is stored, and sometimes where it is processed, and those are not always the same place. A service can keep what you send at rest in one country while the model that reads it runs in another. Good documentation describes the two separately, and it is worth reading for exactly that distinction.

Location also does not settle which law applies. A provider based in the United States is subject to a US law requiring it, when lawfully ordered, to produce data in its “possession, custody, or control”, whether that data is held inside the United States or outside it. A local region run by that provider is still that provider’s.

Asked under oath by a French Senate committee in 2025 whether he could guarantee that French citizens’ data entrusted to his company under public contracts would never be handed to the US government without the explicit agreement of the French authorities, the director of public and legal affairs at the French arm of one of the largest cloud providers said that he could not, adding that it had never happened.

That second half matters too. Disclosures of this kind are rare. One provider reports that none of the enterprise or government customer content it stores outside the United States has been disclosed to the US government since it began publishing the figure; another reports handing over content belonging to three enterprise customers, whose data was held outside the United States, in the second half of 2025. The point is not that these requests are common. It is that a promise about geography is not a promise about jurisdiction.

Three kinds of control

It helps to pull the question apart, because a product can answer one part well and say nothing about the others:

• Where it runs: where information is stored, where the model processes it, and whether those are the same country
• Whose law reaches it: the jurisdiction the provider answers to, which is not necessarily that of the building
• Who can change it: who decides which model answers, on what terms, and for how long

The first is the one on the brochure. The second depends on who the provider is rather than where it operates, which is why choosing a different region does not change the answer. The third is the one least often asked, because nothing prompts the question until something changes.

The model can change under you

A hosted model is a product on somebody else’s roadmap. Providers retire models on published schedules, with notice that ranges from a couple of weeks for preview releases to several months for established ones, and at least one large provider states plainly that retirement dates cannot be extended. A process tuned to one model’s behaviour has to be tested again against its replacement, on a timetable somebody else set.

The provider does not always control that timetable either. In June 2026 a US government directive led one provider to switch off two of its models for all of its customers. The more widely used of the two returned within three weeks; the other, only ever offered to a small group of organisations, was restored first to some of them in the United States.

None of this is a reason to avoid hosted models. It is a reason to know, for each thing built on one, what happens on the day that model is no longer there.

Not all work needs it

Much of what an organisation might use AI for needs none of this. Drafting, summarising published material, working through figures that are already public: there, the ordinary questions about terms and settings are the right ones, and sovereignty buys very little.

Nor, in general, does the law ask for it. New Zealand’s Privacy Act does not require information to stay in the country. It governs disclosure overseas, and it leaves an organisation responsible for information a provider holds on its behalf. Australia’s privacy principles take a similar line: reasonable steps before information goes offshore, and accountability that stays with the organisation.

Some work does need it. Material under a contract that says where it may be held. Information a client has been told will not leave the country. A public-sector engagement with its own rules about hosting. A process that has to keep running whatever a provider decides.

In Aotearoa there is a further consideration, and it is not a setting. Te Mana Raraunga, the Māori Data Sovereignty Network, describes Māori data sovereignty as the inherent rights and interests Māori have in the collection, ownership and application of Māori data, and holds that Māori data shall be stored in Aotearoa New Zealand whenever possible. Where Māori data is involved, where it is held is not the holding organisation’s decision alone.

What sovereignty costs

Control has costs that are easy to leave out of a comparison. A local region may not offer the model that was evaluated, or may offer it later. A model run on infrastructure you control is yours to update, secure and monitor. Open-weight models make that route possible, but open weight does not mean free of terms: some licences carry conditions of their own.

The better trade is often narrower than a whole platform. A small model trained for a single task, run where you control it, can do that task well and cheaply, while work that does not need the same protection goes wherever it is best served. Sovereignty applied to everything is expensive. Applied to the work that needs it, it can be modest.

Decide per workload, and write it down

Sovereignty is not a property of an organisation. It is a decision about a particular piece of work, and it is easier to make one piece at a time:

• What is the material, and has anyone been promised where it will be held?
• Where is it stored, and where is it processed?
• Which country’s law applies to the provider, and to the company that owns it?
• What happens if the model it depends on is retired, or withdrawn, next month?
• Could the work move to another provider, or in-house, without being rebuilt?

The answers will differ from one workload to the next, and that is the point. Written down, they become a short position on which work stays under your control, and why.

Location is a fact about a building. Control is a decision, and it belongs to the organisation doing the work.