Insight series · Part 4 · 14 September 2026 · Part 1 · Part 2 · Part 3

Sovereign AI — what does it actually mean?

“Sovereign AI” is one of the most important phrases in technology — and one of the most loosely used. This article explains what it means for an ordinary business, why data residency is not the same as sovereignty, and why the same phrase means rather different things in Washington, Beijing, Brussels and London.

Sometimes sovereign AI means “the data is stored in Europe.” Sometimes “the AI runs in our own data centre.” Sometimes “the model was developed in our country.” Governments increasingly use it to describe a country's ability to maintain meaningful control over the computing infrastructure, technology, data and capabilities on which its economy depends.

For a business, the simplest place to start is:

Sovereignty is about retaining meaningful control over the things that matter. It does not necessarily mean building everything yourself. And it does not necessarily mean disconnecting from global technology.

Start with a simple example

Imagine a British company using an AI assistant to help employees analyse internal documents. An employee asks:

“Summarise the risks in this customer contract.”

That looks like a simple AI request. Underneath it are many questions: where does the contract go; where is it processed and stored; who operates the infrastructure; which country's laws apply; can another jurisdiction compel access; is information retained; could it train another model; which model processes it; can you change models; what if the supplier changes terms or price; can you demonstrate what happened to an auditor?

Suddenly, “Where is my data?” is only one part of the question.

Data residency is not the same as sovereignty

Data residency tells you where data is physically stored or processed — for example, “Our customer data stays in Switzerland.” That is useful. It does not answer every sovereignty question.

A server can sit in Switzerland while the company controlling the service is subject to another country's laws. The application may depend on external services elsewhere. Or you may technically own data while being unable to move your AI workload without rebuilding everything.

Residency asks: Where is it?

Sovereignty asks: Who ultimately controls it, under what rules, and how dependent are we?

Residency can be an important component of sovereignty. It isn't the whole thing.

Sovereignty doesn't mean isolation

A sovereign AI system does not necessarily mean everything must be built locally with local chips and no foreign technology. For most businesses, that would be unrealistic.

Chips → Data centres → Cloud → Models → Platforms → Applications

Different companies and countries control different layers. The practical question becomes: at which layers do we need control, choice or independence — and how much? A hospital, a marketing agency and a defence organisation will answer differently. Sovereignty is a posture, not a binary label.

Seven layers of control

1. Data sovereignty

Who controls my information? Where is it stored and processed; who can access it; how long is it retained; can it be used for another purpose or to train models; can I delete or retrieve it?

2. Jurisdictional sovereignty

Whose laws ultimately apply? Physical location and legal jurisdiction of the operator are not necessarily the same.

3. Infrastructure sovereignty

Whose infrastructure am I dependent upon — cloud, data centre, compute — and what happens if it becomes unavailable, unaffordable or inaccessible?

4. Model sovereignty

How dependent am I on one AI model provider if price, capability, terms or availability change? A more sovereign architecture retains choice of approved models for different jobs.

5. Operational sovereignty

Can I control how AI behaves inside my business — knowledge, tools, actions, human approval, permissions, audit?

6. Technology sovereignty

How difficult would it be to move — export information, change infrastructure, replace a model, keep workflows portable?

7. Governance sovereignty

Who makes the important decisions — what AI may do, what information it may use, when humans intervene, which models are approved, what gets recorded? For most businesses, this is the most practical form:

The organisation remains in control of the AI, rather than accepting supplier defaults.

Why is sovereign AI suddenly becoming important?

AI is moving deeper into organisations. When AI mostly helped you “write a better paragraph,” sovereignty questions were relatively limited. Now businesses consider AI for customer service, finance, legal work, healthcare, operations, HR, critical infrastructure and government — and increasingly agents that take actions across other systems (part 2, part 3).

The more consequential the job, the more important it becomes to understand where intelligence comes from, where information goes, who controls infrastructure and what authority the AI has.

There is another reason: governments have realised AI is not simply another app. It potentially affects competitiveness, national security, defence, energy, critical infrastructure, science, information — and the ability to make important decisions without being completely dependent on technology controlled elsewhere. Different parts of the world approach that problem differently.

The United States: sovereignty through leadership

Many leading AI companies, frontier models, semiconductor technologies and cloud platforms are American. The US question is often not “How do we protect ourselves from foreign AI?” but closer to “How do we maintain American leadership over the technologies on which others will depend?”

America's AI Action Plan frames AI as competition for technological, economic and national-security leadership — accelerating domestic development, building compute and energy infrastructure, strengthening semiconductor manufacturing and promoting American AI internationally. The US has described exporting the full American AI technology stack — chips, data systems, models, cybersecurity, applications, standards — while using export controls to restrict advanced compute where security concerns apply. See the US AI Action Plan and White House summary.

US posture (simplified): Lead the stack. Build the strongest AI ecosystem at home — and make American technology the ecosystem much of the world builds upon.

China: sovereignty through self-reliance and national control

China approaches from almost the opposite starting point: dependence on foreign semiconductors, compute and platforms is a strategic vulnerability. Emphasis falls on domestic capability, self-reliance, control over critical infrastructure, national data governance and a domestic AI ecosystem.

Internationally, China's AI governance proposals explicitly discuss national sovereignty — equal rights to develop and use AI, respect for host-country laws, and opposition to technological monopolisation and restrictions that block access. See the Global AI Governance Initiative.

China posture (simplified): Own the capability. Reduce strategic dependence on foreign technology while asserting national control over data, infrastructure and AI development — and argue internationally for fair access and national choice.

Europe: sovereignty through rules, choice and reduced dependency

Europe has world-class research and industry, but much of the frontier stack — hyperscale cloud, advanced compute, frontier models — is dominated by US companies, with China as another major power. Europe's concern is increasingly: benefit from global AI without becoming strategically dependent on technology controlled elsewhere.

That helps explain emphasis on data protection, regulation, competition, interoperability, cloud sovereignty, domestic compute and technological sovereignty. Emerging frameworks look beyond hosting to jurisdiction, operational control, supply chains, security and reducing critical dependencies.

EU posture (simplified): Control the dependency. Use global technology where appropriate while maintaining regulatory authority, choice, interoperability and sufficient domestic capability.

The United Kingdom: sovereignty through capability and optionality

The UK has a strong research base and close ties to the US ecosystem, while maintaining its own regulatory, security and economic interests. Emerging policy distinguishes sovereignty from complete self-sufficiency — retaining enough domestic capability to act independently where it matters while participating in international ecosystems (sovereign compute, domestic AI capability without reproducing every layer of the global supply chain).

UK posture (simplified): Preserve the option. Sovereignty does not require independence from everyone. It requires avoiding dependence on anyone where that dependence would become unacceptable.

Four approaches to the same problem

These are syntheses for business readers — not official slogans — but they reflect different policy starting points:

• United States — Lead the stack. Build the strongest ecosystem; allies and markets build on American technology.
• China — Own the capability. Reduce foreign dependence; assert national control over data and infrastructure.
• European Union — Control the dependency. Global technology where appropriate; retain authority, choice and capability.
• United Kingdom — Preserve the option. Strategic capability to act independently where necessary without full self-sufficiency.

All four invest in infrastructure, care about security, want competitive AI industries and regulate differently. But their starting points explain why sovereign AI means different things in different conversations.

What does any of this have to do with an SME?

The same strategic question facing countries eventually reaches businesses:

• Government: “Are we excessively dependent on another country for critical AI infrastructure?” → Company: “Are we excessively dependent on one supplier for a critical process?”
• Government: “Where does strategically important national data reside?” → Company: “Where does our confidential customer information go?”
• Government: “Can we retain capability if foreign access changes?” → Company: “Can we change model or cloud if terms change?”

Understand your dependencies before they become constraints.

From “Where is my data?” to “Where is my dependency?”

Hosting questions remain. AI adds: one cloud, one model provider, one jurisdiction, one orchestration layer, one identity system, several APIs — none automatically bad, but management should know they exist.

Sovereignty as optionality

Sovereignty gives you options: change models or infrastructure; decide where sensitive information is processed; restrict access; require human approval; retrieve information; understand what happened; and say no to a supplier without losing control of the business process.

How Aadi approaches the question

Aadi is not based on owning every component of AI. The design principle is:

Use the best appropriate capabilities while retaining control over the business process, information, permissions and evidence.

That implies:

• Tenant isolation — environments separated so one organisation's knowledge and context are not mixed with another's.
• Controlled knowledge — the worker knows which information it is authorised to use; access is by design, not an unlimited pool.
• Model choice — the model is important, not the product; separating process from model reduces unnecessary single-provider dependence.
• Bounded tools and permissions — tools reflect the job (read order, create task — not issue a £5,000 refund without authority). Critical as AI moves from Answer to Advise to Do.
• Human control where it matters — appropriate autonomy, not maximum autonomy.
• Auditability — what happened, what information was used, what was decided, what action was taken, whether a human was involved.
• Swiss-hosted infrastructure — one layer where residency and jurisdiction matter; not the whole sovereignty claim. See Swiss sovereign hosting.

Aadi does not ask enterprises to choose between American, Chinese or European models of national sovereignty. At enterprise level, the posture is controlled dependency — know what you depend on, decide what you control, preserve the ability to change. That is more credible than stamping “Sovereign AI” on hosting alone.

Sovereignty doesn't require rejecting frontier models

Frontier models from global providers can deliver extraordinary capability. The better question: Can we use those capabilities without unnecessarily surrendering control of our business process? Sometimes yes; sometimes more local control is appropriate; sometimes both in the same organisation — architecture should follow the risk and purpose of the job.

Not every workload needs the same sovereignty

• “Suggest five titles for our Christmas newsletter” — modest sovereignty requirement.
• “Analyse our confidential acquisition documents” — very different.
• “Monitor transactions and prepare regulatory reporting” — different again.

Sovereignty should be proportionate to consequence. Not “Is our company sovereign?” but “What level does this particular AI workload require?”

A simple sovereignty test

1. Where does our information go?
2. Which organisations and jurisdictions can potentially control or access it?
3. Which providers are we critically dependent upon?
4. Can we change models or providers without rebuilding the business process?
5. Can we control what the AI knows and what it is allowed to do?
6. Can humans intervene where necessary?
7. Can we demonstrate afterwards what happened?

If those questions cannot be answered, you probably do not yet understand your AI sovereignty posture.

The bigger picture

At national level, the US wants to lead the stack; China to control strategic capability; Europe to reduce dependency while retaining choice; the UK to retain strategic capability and optionality. Underneath sits one question: Who remains in control when AI becomes important enough that you cannot simply switch it off?

For every organisation adopting AI, the quieter version is the ability to say: this is our information; these are our rules; these are the systems AI may use; these decisions remain human; these are the providers we depend upon — and if they change, we still retain meaningful control.

Sovereign AI is not simply where the server sits. It is who remains in control.

Series recap: how AI answers · how it acts · agent vs digital worker · part 4 (this page).