The assessment behind the Sovereignty Test · from Own Your AI, chapters 2 and 10
The Sovereignty Maturity Index
The Sovereignty Maturity Index scores how sovereign an organisation's AI is across six weighted dimensions, data, compute, model, application, governance and security, each from 0 to 100, into one composite score.
Before charting a course you need coordinates. The Sovereignty Test asks whether a system passes on four controls; the index says how far along the organisation is on each dimension that decides them, and a six-statement quick self-assessment out of 30 gives the first reading in ten minutes. Defined by Prem Naraindas and Vinod Bijlani, Own Your AI (2026).
01Six dimensions
Six dimensions, weighted by how much they decide.
Each dimension is scored from 0 to 100 against five level descriptors, from no formal control at all to automated enforcement with real-time monitoring. The weights say where sovereignty is won or lost: data and the two layers that run on it carry 65 percent between them.
- Data, 25%
Control over data residency, flows and governance. Where does the training data physically reside, who has legal access under which jurisdiction, and what share of it crosses a border?
- Compute, 20%
Control over the training and inference infrastructure. Who owns the hardware the AI runs on, what is the GPU supply-chain dependency, and can critical workloads run disconnected from foreign providers?
- Model, 20%
Control over model selection, training and deployment. Are the weights owned or licensed, can the models be inspected and modified, and how deep is the dependency on proprietary providers?
- Application, 15%
Control over how AI is deployed. Do the applications keep working if model API access is terminated, who controls the orchestration layer, and are agentic systems sandboxed?
- Governance and compliance, 10%
Regulatory alignment and governance frameworks. Are there documented, enforced AI governance policies, compliance with the EU AI Act and sector rules, and auditability?
- Security and resilience, 10%
AI-specific security and operational resilience. What is the recovery time if a provider terminates access, is there adversarial testing, and are supply-chain risks monitored?
02The score
One weighted number, read in four zones.
SMI = data × 0.25 + compute × 0.20 + model × 0.20 + application × 0.15 + governance × 0.10 + security × 0.10
| Composite | Zone | What it says |
|---|---|---|
| Below 30 | Dependent | The AI runs at someone else's discretion on most dimensions. Any of access, modify or terminate can happen without you. |
| 30 to 50 | Emerging | Residency and basic compliance are in place; hardware, weights and the exit are not. Most organisations sit here. |
| 50 to 70 | Developing | Hybrid architecture, some owned weights, documented governance. The gaps are known and scheduled. |
| Above 70 | Advanced | Domestic stack, owned models, tested failover. The target for most regulated organisations is the top of this zone, not self-sufficiency. |
Where do most organisations sit? Below 50. The 88 percent without a dedicated AI governance framework score at level one or two on the governance dimension alone, which drags the composite down whatever the technical capability. Governance is only 10 percent of the weight and still the commonest reason a score disappoints.
03Quick self-assessment
Six statements. A number out of 30. Ten minutes.
Before the full assessment, score six statements from 1 (strongly disagree) to 5 (strongly agree). Each stands in for one dimension of the index.
- 1. Data
We know exactly where all our AI training data is physically stored.
- 2. Compute
We could operate our critical AI systems if our primary cloud provider terminated access.
- 3. Model
We own, not license, the weights of the models used for sensitive applications.
- 4. Application
Our AI applications can function offline or with an alternative model provider.
- 5. Governance
We have documented AI governance policies that are actively enforced.
- 6. Security
We regularly test our AI systems against adversarial threats and supply-chain disruption.
| Total | Level | Reading |
|---|---|---|
| 6 to 12 | Fully dependent | Significant sovereignty gaps across all dimensions. |
| 13 to 18 | Compliance-driven | Basic controls in place; strategic gaps remain. The regulator's boxes are ticked, control has not started. |
| 19 to 24 | Strategically sovereign | Meaningful sovereignty with room to improve. The target for most organisations. |
| 25 to 30 | Fully autonomous | Comprehensive sovereignty across all dimensions. Rare, and not always the goal. |
Statement 3 decides the level: a 1 or 2 on owning the weights means there is no tested path to a different model, whatever the other five say. A European bank that had done everything its regulator asked, data in Frankfurt, every box ticked, scored 14. The scorer on the Sovereignty Test page does the arithmetic and names the level.
04How to use it
Assess before you build.
The index is the first deliverable of the book's 90-day roadmap: weeks two and three are the gap analysis, scoring each dimension against the level descriptors and setting a target, usually level three or four, per dimension. The radar chart puts the current score and the target on one page a board can read. Re-score at day 90 and after every change of provider, model or contract.
The assessment tool, a spreadsheet with the six dimensions, the weights, the level descriptors for each and a gap-analysis sheet for the first 90 days, is available on request: hello@premnaraindas.com.
05Not the same as
Accenture's Sovereign Maturity Index is the benchmark this builds on.
Two indexes share most of a name, and the relationship is stated in the book. Accenture's Sovereign Maturity Index (November 2025) benchmarks organisations' digital and AI sovereignty from a global survey, by sector and by geography; its findings, that aerospace and defence, government and health lead, that Europe and Canada score above average, that most organisations sit below 50, are quoted in Own Your AI. The Sovereignty Maturity Index on this page takes that research methodology and turns it into something an organisation runs on itself: six weighted dimensions with level descriptors, a composite score, the quick six-statement form, and the 90-day roadmap that follows the score. One tells you where the market is; the other tells you where you are and what to do in the next quarter.
06Cite
Naraindas, P. and Bijlani, V. (2026). Own Your AI: The Sovereign Stack Playbook for Nations and Enterprises. Chapter 2, "Assessing your position: the Sovereignty Maturity Index", and chapter 10, "Calculating your Sovereignty Maturity Index". Amazon Kindle Direct Publishing. Canonical page: premnaraindas.com/sovereignty-maturity-index.
Short form: "the Sovereignty Maturity Index (Naraindas and Bijlani, Own Your AI, 2026)".