Is your AI sovereign, or just a subscription?

Disclosure: I run Katonic AI, which sells a sovereign AI platform to regulated buyers, including in the Gulf.

In January AWS opened its European Sovereign Cloud in Brandenburg: EU-resident staff, an EU-citizen advisory board, its own certificate authority and security operations. It is the most serious sovereign cloud a hyperscaler has ever shipped. It passes on operations. On law, it rests on a corporate structure no court has tested.

A European bank's CISO asked us the same question from the other side: "We store all our data in Frankfurt. We're sovereign, right?"

Both got location right. Neither had settled control. That gap is what this newsletter is about.

September handed us three fresh examples of it. A French lab raised three billion euros, helped by not being American. Four chief executives lined up behind one view of how fast the frontier should move. The European Parliament named the people who will write the rules for how public bodies buy cloud.

Here is the test. Six statements, one to five each, added up out of 30. Score your organisation before you read on.

1. We know exactly where all our AI training data is physically stored.
2. We could operate our critical AI systems if our primary cloud provider terminated access.
3. We own, not license, the weights of the models used for sensitive applications.
4. Our AI applications can function offline or with an alternative model provider.
5. We have documented AI governance policies that are actively enforced.
6. We regularly test our AI systems against adversarial threats and supply chain disruption.

6 to 12 is fully dependent. 13 to 18 is compliance-driven. 19 to 24 is strategically sovereign. 25 to 30 is fully autonomous. A worked example we use, a bank that had done everything its regulator asked, scores 14.

A question in Frankfurt

The story. Every box was ticked. Data held in Frankfurt, the platform deployed on the bank's own infrastructure, open-source models. Then we asked who controlled what. Operations ran under a non-EU support contract with standing access. The orchestration layer depended on a cloud service. There was no path to model updates if the open-source project changed direction.

Under the test. Three of the four dimensions of control, operational, technical and strategic, sat with someone else. Nobody in the room had a name for the fourth.

Verdict: location solved, control not started.

The definition

Sovereign AI is a phrase used to sell cloud regions, chips and compliance programmes. Here is the definition we work to, one you can act on:

Sovereign AI is artificial intelligence developed, deployed and governed under the legal, operational and technical control of a defined jurisdiction, whether a nation, a region or an organisation, such that no external actor can unilaterally access, modify or terminate the AI system or the data it processes.

We call it the Control Test. It covers the whole lifecycle, and it is relative to a jurisdiction: what is sovereign for the European Union may not be for the UAE, where the regulator already expects in-country operations as well as in-country data. The test never asks where the software runs. It asks who can switch it off.

Four things that are not sovereign AI

Data localisation. On-premises deployment. Open-source models. Total independence. Each is necessary. None is sufficient.

Data localisation. Brandenburg is the strongest operational answer any hyperscaler has shipped: EU staff, an EU board, an EU certificate authority, encryption keys held in-region, including keys the customer holds. It deserves the credit.

The legal question is different. The German entity that operates it is owned by Amazon, a US company. The CLOUD Act, a 2018 US law, lets US authorities compel a US provider to produce data in its possession, custody or control, wherever the data sits.

Whether a separately operated EU subsidiary's data counts as the parent's "control" has never been tested in court. AWS says it does not, and has committed to challenge requests that conflict with EU law.

Verdict: holds on operations, unresolved on law. Ask for the legal opinion, and ask whether the operator will challenge an order.

On-premises deployment. The building is yours. The update channel, the support contract and the licence server usually are not. Verdict: where the software runs is not who can switch it off.

Open-source models. A licence you can read is not a roadmap you control. If the project changes direction, your path to the next version goes with it. Verdict: open weights buy you options, not control, until someone in your organisation can run them without the vendor.

Total independence. Luca Belli's Carnegie paper (3 September) says from the policy side what the bank learned in a meeting room: sovereignty is agency, the capacity to choose and to switch. Single-supplier lock-in sold as sovereign is what he calls sovereignty-washing.

Self-sufficiency is neither achievable nor desirable; the goal is managing dependencies, not eliminating them. Verdict: independence is not the test either. Choice is.

The four dimensions

Control has four dimensions: legal, operational, technical and strategic. A system passes only if it passes on all four. The fourth, who decides what the system becomes next and who can switch it off, is the one almost nobody has written down.

A founder in Hong Kong said it better than we do. Pak-Sun Ting of Votee AI told Fortune in September: "You don't want to be tethered to anybody else who can turn it off." The Control Test's final clause, said plainly.

Verdict: a board should hear one number and one sentence: the score out of 30, and which of the four controls sits outside the country, and with whom.

Outside the perimeter: September through the test

What happened. Mistral raised three billion euros (8 September). Samsung, EQT and PSG led a round valuing the French lab at 21 billion euros. TechCrunch's headline called sovereign AI big business.

Which control. Technical and strategic: a second source at frontier scale now exists outside the United States. Mistral expanded its Microsoft partnership in July, so read the fine print.

Verdict: the flag on the model is not the test. The contract is.

What happened. Four chief executives backed a call to pace the frontier (12 September). Dario Amodei published an essay asking the leading labs to slow the frontier together. Sam Altman and Elon Musk backed it the same day, and Google DeepMind's chief was reported to have joined them.

A week later four subscribers filed a class action in California calling it an antitrust breach. The companies had not responded when this was written.

Which control. Strategic, on the far side of your contract. I take no position on the safety merits. Notice who was in the room: the pace of the models your applications run on was discussed by four companies in one weekend, and no customer was asked.

Verdict: this is what a 1 on statement 3 looks like from the outside.

What happened. The European Parliament named the MEPs who will write the Cloud and AI Development Act (September). The proposal would grade the cloud that public bodies buy on a four-level sovereignty scale: level one self-assessed, levels two to four audited. A first vote is targeted for the middle of 2027.

Which control. Legal. "How sovereign is this cloud" is becoming a procurement field rather than a marketing claim. Sell to an EU public body and your level will be audited; buy for one and you will write down why.

Verdict: tender templates travel. Expect the question outside the EU within two years.

One to watch. The AI Act's high-risk deadline moved to December 2027 under the Digital Omnibus. The deadline moved. The six statements did not.

Back to the six statements

Statement 1, where the data sits, is the half of legal control a regulator can make you solve, and most organisations have. The other half, who can compel disclosure, is the Brandenburg question.

Statement 3, owning rather than licensing the weights, is strategic control, and it decides the band. Read it as a tested ability to substitute the model behind each sensitive application within a defined period. A 1 means there is no path. The worked example scores a 1 there, and it is the statement that separates 14 from 19.

In Europe, DORA already asks banks for an exit strategy. The test asks whether it has ever been rehearsed for the AI stack.

Verdict: 14 out of 30 is not a failing grade. It is a set of coordinates: location done, control not started.

This is not an argument against the cloud

A tenancy you control, with your keys, your choice of model, your update schedule and a tested path to leave, can pass the Control Test inside a hyperscaler, and Brandenburg makes that easier this year than last. A subscription you cannot leave fails it in your own data centre.

Verdict: the test is indifferent to where the software runs. The harder test is the proprietary services you would have to rebuild to leave.

Before Friday

Take your lowest-scoring statement and write four sentences:

1. who holds the keys
2. who could compel disclosure
3. who could terminate access
4. what you would do the morning after

If any sentence ends in a vendor's name, that is your gap. Then put the four questions into your next RFP as mandatory written responses, each with a named contractual owner, and score the answers against the six statements. Tell me in the comments which statement you scored lowest. That number is the real conversation.

Next issue, Thursday 8 October: the Sovereignty Maturity Index, how an organisation gets from a 14 to a 19 without rebuilding everything; the test run on a national sovereign cloud built on a foreign stack, no vendor named; and our own platform scored on the same six statements.

About this newsletter

Own Your AI comes out every second Thursday: one idea about who controls your AI, drawn from regulated deployments, procurement rooms and the occasional court ruling, then the fortnight outside, run through the same test. Subscribe if it is useful, and tell me where you disagree, starting with anyone who thinks the Frankfurt CISO was right the first time.

The six statements and the Control Test come from Own Your AI, the book I wrote with Vinod Bijlani: amazon.com/dp/B0GS7C6DN4

The free toolkit, with the Sovereignty Maturity Index, the 90-day roadmap and the Sovereignty Certificate checklist: ownaistack.com

Prem

References

1. AWS, "AWS launches AWS European Sovereign Cloud and announces expansion across Europe", 15 January 2026.
2. Luca Belli, Carnegie Endowment, "Operationalizing AI Sovereignty Through Agency, Interoperability, and Openness", 3 September 2026.
3. Fortune, "Sovereign AI is about choice", Pak-Sun Ting of Votee AI, 4 September 2026.
4. TechCrunch, Anna Heim, "Mistral raises EUR 3B as sovereign AI becomes big business", 8 September 2026.
5. SiliconANGLE, "Sam Altman and Elon Musk back Dario Amodei's call to slow down the frontier of AI development", 13 September 2026.
6. CBS News, "AI slowdown lawsuit: OpenAI, Anthropic, Google", 19 September 2026.
7. European Parliament Legislative Train, "Cloud and AI Development Act", 2026/0138(COD), updated 1 August 2026.
8. TechTimes, "Cloud AI Development Act gets lead drafter via party vote, not public process", 5 September 2026.
9. Cloud Security Alliance, "EU AI Act high-risk deadline and the Digital Omnibus", Regulation (EU) 2026/1744, 1 August 2026.