Sovereign AI requires extending governance to AI layer
Under new data sovereignty regulations, deploying AI systems presents an urgent challenge: Endpoints within the U.S. are not enough to meet compliance requirements for cloud data.
The EU AI Act's high-risk obligations took effect on Aug. 2, 2026, adding new sovereignty considerations for cloud data management. The challenges associated with these changes are exacerbated by the many nuances of what sovereign AI means for regulatory and operational purposes.
When deploying regulated AI systems, cloud data management teams are now tasked with determining where data resides, where inference executes and where model weights are stored.
Digital sovereignty was once purely about tracking where data resides. If the data was kept in a specific country or a region, IT teams could tick the compliance box and move on, said Erica Langhi, technology strategist for the U.K. public sector at Red Hat. AI has disrupted this.
An AI model can exist in one jurisdiction, run inference in another, and be trained on parameters that neither the clients nor cloud providers can inspect or change. Data residency answers where information sits at rest, but it says nothing about where it is processed, who controls the model doing the processing or who holds the keys to both.
Cathal McCarthy, chief strategy officer at enterprise AI agent platform Kore.ai, observed that teams now need to consider at least five separate control points: Where the data rests, where inference runs, where the model weights are, who holds the encryption keys, and who operates the orchestration and identity layers.
Each of these points can be managed by a different party in a different jurisdiction.
"'Where does the data reside?' is still a valid question. It's one of five, and it's the easy one," McCarthy said.
Three planes of control
Knowing where data physically resides is no longer enough to guarantee control, said Alistair Macrae, OT security principal at e2e-assure, a managed security services provider. In the pre-AI cloud era, it was enough to keep databases in a specific region. AI breaks this model because data is no longer static. It is dynamically routed, processed through external models and continuously logged.
Actual AI sovereignty means controlling the entire execution chain across three planes, Macrae said: territorial, technological and operational.
On the territorial plane, modern AI architectures rely on gateways that orchestrate requests, handle retries and invoke external tools. This creates compliance gaps. A team might ensure its primary inference runs locally, but if the gateway fails over to a different region during peak load, it instantly violates residency.
If prompts, responses and debugging traces flow back to a foreign-hosted observability pipeline, the data has effectively leaked. The mistake, Macrae said, is assuming geography alone provides legal protection. Infrastructure owned by a foreign entity remains subject to that entity's extraterritorial laws, such as the U.S. CLOUD Act.
"A foreign government can issue a lawful order to the cloud provider, and the data can be accessed regardless of the physical server's location," he said.
On the technological plane, using a proprietary model through an external API means the enterprise is merely licensing intelligence. True control requires that the model weights reside on hardware owned or operated by the organization. If a vendor can update the model, change the guardrails or revoke access, the enterprise does not have sovereignty over its AI capabilities.
On the operational plane, a sovereign deployment requires knowing who holds the encryption keys, who manages the infrastructure and who gets paged during an incident. A local server administered from another country remains subject to foreign laws.
AI also raises the value of what organizations need to protect, said John Michaelides, senior principal at consulting firm Slalom. The processing demands of AI workloads make organizations far more sensitive to where workloads run, including the risk of interference through performance or resource throttling.
Enterprises must now worry about the exposure of models as well as data, since models can carry at least as much value. The burden depends on context, Michaelides said, because many organizations use models and weights supplied by partners.
Location is not control
The mistake McCarthy sees almost everywhere is treating location as a proxy for control. But AI has decoupled the two. Some organizations interpret local hosting as sovereignty. This might not satisfy emerging AI regulations if the organization runs orchestration and identity layers opaquely, or from a jurisdiction with different rules from where the enterprise operates.
Sovereignty is a statement about control, not geography.
Cathal McCarthyChief strategy officer, Kore.ai
Another common mistake organizations make is approaching sovereignty as a retreat by walling workloads off. A better approach, particularly for international organizations, is planning for local control with global access. In this model, the enterprise controls the levers that matter within its jurisdiction, such as the data, model and encryption keys, in a way that supports operating at the scale the business needs.
"Sovereignty is a statement about control, not geography," McCarthy said.
When control, constraints and the audit trail live in the orchestration tier, the model underneath becomes a component the enterprise can choose, swap or run in-region, rather than a dependency it is locked into. Being deliberately agnostic about the model ensures that governance does not have to change when new models are chosen.
Sovereign AI in a contract
In a commercial context, the meaning of sovereign AI is open to interpretation and somewhat in the eye of the beholder, Michaelides said, and vendors will pitch their packages while concealing, or at least not drawing attention to, the shortcomings.
"As careful buyers, we should be asking if what we are being pitched is just 'reheated' data sovereignty or if it reliably answers the extended questions for AI," he said.
The biggest gap lies in diverging regulatory frameworks. Even data in European data centers might sit with U.S.-owned providers, leaving it subject to the CLOUD Act. A sovereign region endpoint is only the foundation, Michaelides said. Enterprises must still wrap their own assurance controls around what the vendor provides, with ongoing monitoring and continuous risk assessment to catch gaps that surface after implementation.
Legal contracts are in the early stages of including sovereign AI clauses that go beyond data residency. McCarthy said procurement teams unfamiliar with some of the other nuances might stop when they see data residency clauses in a contract. He advises teams to also consider other increasingly important aspects. For example, a regional endpoint says where a request is served, but not who has jurisdiction.
Also, almost no one owns the foundation models, which can confound efforts to show how a decision was reached. As a result, model shifts can add new headaches when they introduce bias no one had previously thought to look for.
"The real test is not 'is it sovereign,' but whether you can stand in front of a regulator and demonstrate governance, accountability and control while still running the business globally, not from inside a walled-off region," McCarthy said. A sovereign label on a model the enterprise cannot govern is not a shield, and in an Annex III high-risk context, a system that cannot explain itself is a liability.
Open weights, keys and hygiene
To maintain genuine control, organizations need the flexibility to run inference across hybrid, multi-cloud and edge environments.
"True digital sovereignty means a lot more than just having local data centers; it also means having the absolute right to modify, retrain and port your model without relying on a third-party gatekeeper," Langhi said.
Proprietary models operate as black boxes. If an enterprise cannot inspect or audit the underlying weights and algorithms, it cannot ethically or legally defend automated decisions, identify algorithmic bias or guarantee compliance. Open source models put the architecture and decision-making processes in the open. This enables enterprises to audit decisions, trace and correct bias, and retrain models when needs or regulations change, rather than relying solely on vendor claims.
Autonomous AI agents can also raise the stakes because the risks of escaping sovereign control now include serious operational disruption, Michaelides said. Enterprises must back strong sovereign control of platforms and infrastructure with good data hygiene. This includes encrypting models and data separately with different, rotated keys, and separating who can access which parts of the architecture to limit the blast radius of a single compromise. Implementing that hygiene is where most enterprises have their weak spot, he said. AI increases the attack surface, so more discipline is required.
George Lawton is a journalist based in London. Over the last 30 years, he has written more than 3,000 stories about computers, communications, knowledge management, business, health and other areas that interest him.
