Sovereignty needs an operating definition

Move from a label to a requirement

For a company procuring AI capacity, “sovereign” should prompt a series of questions. Where is information processed? Who can administer the service? Who controls encryption keys? What happens if a supplier becomes unavailable?

A 2026 research preprint by Justin Stark and Scott Wilkie proposes evaluating sovereignty through governance and operational control, including access, cryptographic trust and recovery. It is a research framework, not a certification or a legal determination.

Define the service boundary

An AI service may involve a data center operator, a cloud provider, a software supplier and remote support teams. The location of the servers is one fact within that chain. It does not answer every question about control.

Map the full service: data storage and processing, privileged administration, key management, software updates, backups and incident response. For each activity, record who performs it, from where and under which contractual arrangements. Legal conclusions require assessment against the actual jurisdictions and agreements involved.

Test continuity as well as access

A procurement team should be able to describe what happens during a supplier outage, contract dispute or loss of a critical service. Can the customer recover its information? Can another team operate the environment? Which dependencies cannot be replaced within the required time?

Those questions create measurable acceptance criteria. Documentation, recovery exercises and evidence of operating controls are more useful than relying on a broad sovereignty statement in marketing material.

Connect governance to the investment case

For investors, the commercial question is which customers need these controls and what delivery obligations follow. A specialised service can carry additional operating requirements. The business plan should reflect the staff, systems and responsibilities needed to deliver them.