Spotlight on AI sovereignty | What is AI sovereignty?

Since 2024, AI sovereignty has become a headline policy objective for the governments of all the major economies. This article, the first in our “Spotlight on AI sovereignty” series, explores what AI sovereignty is, why it has become a priority, and what it means for businesses.

Why is everyone talking about AI sovereignty?

The United States and China dominate the AI race. Between them, OpenAI, Anthropic, Google and Microsoft, all US-headquartered, represent almost 80% of global spend on AI models. Most leaderboards for LLMs are dominated by US and Chinese models, whether measured in terms of raw capability, speed or efficiency. When a business in the UK and EU looks to procure AI services, it is very likely that it will buy from a US AI vendor, or from a vendor who in turn depends on a US AI vendor in its technology supply chain.

This concentration on a small number of vendors in a few countries presents a risk if – as now seems very likely – AI becomes a foundational technology which is essential to every area of the economy and broader society. If your economy, or your business, depends on a technology that you don’t control, then whoever does control it has enormous leverage over you. At its core, AI sovereignty is about minimising and mitigating that exposure.

The best way to understand AI sovereignty is to see what can happen if you don’t have it. In June 2026, Anthropic was forced to disable access to its two most advanced models, Mythos 5 and Fable 5, just days after launch. The move followed a US export control directive on the models which affected customers worldwide, giving them no notice or say in the decision. Access was restored on 1 July once the controls were lifted, but the episode showed that at least some governments will not hesitate to restrict foreign users from accessing AI services where they consider it is in their strategic interests to do so.

It isn’t hard to see why AI sovereignty is now a headline policy for the government of almost every major economy. It is also a rising priority for C-suites and enterprise IT departments, albeit with different drivers and objectives.

What does AI sovereignty mean for nation states?

For governments, AI sovereignty is the policy of encouraging greater domestic control of the AI technology that a nation and its businesses will come to depend on.

In part, this is an attempt to reduce dependence on foreign powers and preserve access to frontier models. The latest models show continual advances in cyber security capability and can be deployed both defensively and offensively. In this sense, frontier models are dual use items and can be (and almost certainly are being) used by states to conduct cyber warfare operations. In a world where hybrid and information warfare has become the norm, it is critical to have access to the most powerful cyber capabilities, and to ensure that those capabilities will remain available regardless of policy changes by foreign governments.

National security justifications aside, AI sovereignty is frequently a form of good old-fashioned industrial policy: an effort to maximise the economic benefits that a nation captures from AI development and operation. Many estimates place the value of the global AI market at around $500bn and still trending upward: as with any industry, governments are keen to encourage (or even subsidise and protect) domestic production and increase exports where possible. More broadly, a sovereign AI capability can help shape the development of technology to reflect a nation’s society, languages and culture. India’s sovereign AI programme is a great example of this.

At the national level, AI sovereignty policies usually involve some combination of:

• Encouraging domestic design and production of hardware, such as silicon used for AI training and inference;
• Building national infrastructure capacity, including data centres and the grid capacity needed to run them;
• Facilitating domestic model development to ensure a resilient source of frontier AI capability not subject to the rules of foreign governments;
• Supporting the growth of service providers who can bring the hardware, infrastructure and models together to provide an integrated service that businesses can consume; and
• Stimulating demand for all of the above, using both the carrot (industrial policy and subsidies) and the stick (public procurement and national security rules).

In April 2026, the UK launched its sovereign AI fund with £500m of capital to invest in British AI start-ups. The October 2026 budget added a further £140 million to the pot, showing that this continues to be a priority for the new government. The government is also taking steps on physical infrastructure: the Data Centre Covenant, published on 28 October, sets an ambitious policy for domestic data centre building, aiming for 6 GW of AI data centre capacity by 2030 by reducing planning friction and accelerating grid connections.

The EU is taking an even broader approach. The proposed Cloud and AI Development Act (CADA, published June 2026), aims to build EU cloud and AI infrastructure and fund AI research, particularly in cyber security. It diverges from that UK approach in that it also contains demand-side measures: public-sector buyers, and potentially private-sector ones too, will be steered towards EU-based providers. On hardware, the EU has passed the Chips Act and proposed the Chips Act 2.0, which provide both supply-side and demand-side support to grow semiconductor manufacturing in the EU.

What does AI sovereignty mean for businesses?

For businesses, many of these objectives and concerns are not directly relevant or are beyond the organisation’s power to control. Sovereignty, in the public law sense, is not something that companies are able to possess (at least, not since the era of the East India Company).¹

Instead, at the enterprise level, AI sovereignty is often used as an analogy for the degree of effective control an organisation has over its AI systems and the dependencies supporting them. This can be measured across a range of dimensions:

• Visibility, governance and supply chain transparency: does the business know which AI systems it uses and what sits beneath them, and have a plan for using them safely? Most AI products depend on third-party models, cloud platforms and hardware (usually from the same narrow group of vendors), so one supplier relationship often involves several layers of dependency.
• Data: how much control does the business have over where its data is stored and processed, who can access it, and is the provider permitted to use it for model training?
• Location and jurisdiction: where are the data and compute physically located, and whose law can reach them? A provider headquartered abroad may be subject to foreign legal demands for data even where the servers are local. In this sense, cloud sovereignty is closely related to (and some would argue a necessary condition of) AI sovereignty.
• Strategic control: does the business have meaningful influence over the direction of the AI it depends on, or is it exposed to its suppliers’ roadmaps, pricing and priorities?
• Vendor lock-in: how hard would it be to switch? Are workflows, prompts and applications built on an open architecture the business controls, or are they specific to a vendor’s platform? Businesses commonly come up against technical barriers like migrating data and replacing fine-tuned models, as well as contractual barriers like long minimum terms, early exit fees and the absence of termination assistance obligations.
• Operational resilience: can the business keep operating if an AI provider suffers an outage, deprecates a model, is hit by sanctions or export controls, or fails commercially? Do your contracts require the vendor to give notice or implement mitigating measures where they are legally permitted to do so?
• Internal capability: does the business have the skills to evaluate, configure, run and, if necessary, replace its AI systems, or does it rely wholly on suppliers to understand them?
• Legal compliance: can the business demonstrate compliance with the laws that apply to it (including data protection, AI-specific, and sector-specific regulation), and can it obtain the information it needs from suppliers to do so?

In many ways, these are the same concerns about technological dependency that businesses have had for decades in relation to critical software, cloud and services vendors. What is different about AI is the geopolitical context, the speed of change, and the prospect of the technology becoming integrated into almost every business process.

Sovereignty is a spectrum

Very few businesses or AI vendors can honestly say that they are “sovereign” in all these dimensions. And in practice, many businesses might prefer not to be. There is usually a trade-off between AI sovereignty, on the one hand, and cost, convenience and capability on the other.

For example, a business could choose to host its own models, on hardware that it owns and manages, in a server room in its own building. This “bare metal” approach would certainly deliver a high degree of sovereignty by most metrics, but it would require substantial investment in capital, time and staff, and likely deliver a less capable product than what the mainstream vendors can offer. It might be a good trade-off for some businesses for specialised use cases involving the most sensitive data or where no level of vendor lock-in is acceptable, but it wouldn’t be an attractive strategy for most businesses most of the time.

Equally, moves to reduce sovereignty risks in some areas may introduce new risks in others. For example, what if moving from a US hyperscaler to a domestic AI provider means accepting a higher risk of downtime or less availability of skilled resource to manage the platform? In that scenario, it isn’t obvious that the benefit of mitigating geopolitical risk outweighs the more mundane risk of accepting lower service levels. 

However, an organisation’s AI sovereignty strategy does not have to deliver absolute sovereignty in every dimension to be worthwhile. The key is to ensure that the business possesses the right level of sovereignty, measured on the dimensions that matter to it – and the optimal balance may well vary depending on the particular use case. 

The potential role of open-weights models

Many see open-weights models as a promising solution to AI sovereignty concerns. A business using open-weights models has greater control over the availability of its models (for better or for worse), where they are run, and how they can be changed. Even if the original developer is subject to changes in law or changes its commercial strategy, the business is free to keep using its current version for as long as it likes.

But open weights are not the same as absolute independence. In the first instance, not all open-weights models are equally open. Many of the most popular and most powerful open-weights models are offered on bespoke licences that impose revenue restrictions or require commercial licences beyond certain usage thresholds. See, for example, the Kimi K3 Licence or the Muse Model Licence.

The licences for open-weights models also frequently require compliance with acceptable use policies, or include comparable usage restrictions in the licence grant (as with the many OpenRAIL-style licences that were drafted around 2022-23). These restrictions are often far-reaching and may cut across an organisation’s legitimate use cases, which is a significant departure from the permissive nature of the true open-source licences used in the software world.

Even where the licence is sufficient, taking responsibility for operating the model layer is not a complete answer to AI sovereignty concerns. Models become outdated reasonably quickly, so staying current depends on the model provider (or an alternative) continuing to make new models available on the same terms. Further down the stack, running a model at scale needs hardware, which must be sourced from the same concentrated pool of cloud or chip vendors.

In practice, open-weights models are best seen as one tool among several to mitigate sovereignty risks. The demands of running a frontier-standard model are so high that sophisticated customers often adopt a hybrid approach: a smaller, self-hosted open-weights model to provide economical inference for routine use cases and protect the most sensitive data, with a fall-back to a frontier API for applications that need it. As well as improving resilience, having a credible self-hosted option available improves a customer’s negotiating position with third party vendors.

What next?

An organisation seeking greater AI sovereignty should start by identifying in which areas (if any) it would like more control, why, and what it can realistically do to obtain it. AI sovereignty touches most parts of a business, including its core operations, IT and Legal teams. Any strategy needs to address the potential trade-offs head on, so that the business can decide whether they are outweighed by the benefits. In some cases, they may not be. In others, AI sovereignty may become an important strategic objective.