Two organisations announce a “sovereign AI” programme in the same week. One is a national ministry. The other is a bank. They will spend on different things, for different reasons, and most of what one needs is irrelevant to the other. Yet both are handed the same vendor slide: a GPU cluster, a model, and the word “sovereign” printed across the top.
I’m writing this from the practitioner’s chair. At Mettle we serve RBI and SEBI-regulated clients and are building a self-hosted LLM stack for our own team, so we have had to answer the uncomfortable question ourselves: sovereign from what? The answer turned out to be more useful than any procurement decision that followed. Sovereignty is not a product tier. It is a list of dependencies you decide to keep or cut, and the scoping is where the money is saved or wasted.
Why this is on every agenda now
The term has moved from policy papers to purchase orders. Mistral’s €3 billion Series D this month was framed almost entirely around control: data that stays inside the organisation’s boundary, models that can be modified, compute that is private, and production systems that can be audited. India’s IndiaAI Mission selected Sarvam in April 2025 to build a foundation model from scratch on domestic compute; in March 2026 the company open-sourced Sarvam 30B and 105B under Apache 2.0, both mixture-of-experts models trained entirely in India on mission-provided compute. Switzerland’s Apertus released not just weights but the full data pipeline and training recipe. Singapore’s SEA-LION took the opposite route and adapted existing open models to eleven regional languages. Regulation is pulling in the same direction: the EU AI Act’s transparency obligations have applied since 2 August 2026 and its high-risk regime, deferred by the Digital Omnibus, now lands on 2 December 2027; sector secrecy rules in banking and health and data-residency law in most large jurisdictions were never waiting on Brussels.
One finding should temper the enthusiasm. The CNAS Sovereign AI Index tracks more than 170 national projects and finds that a majority disclose at least one foreign partner, most of them American, and that a single GPU vendor supplies close to half of the infrastructure projects. Nobody, including the United States, controls the whole stack. Sovereignty in practice means managed dependency: choosing which layers you must own and accepting the rest.
Sovereign from what? Four dependencies, not one
Before any engineering, write down what you are trying to be independent of. There are four distinct answers, and they call for different spending.
- Legal jurisdiction. A foreign court or agency can compel your provider. The fix is data residency plus a domestic legal entity that operates the stack.
- Vendor discretion. Your provider can deprecate, reprice, or revoke. The fix is weights on your own disk, no phone-home, and software you can fork.
- Epistemic and cultural dependence. The model’s language competence, legal knowledge, and default values were chosen elsewhere. The fix lives in training data and post-training, not in infrastructure.
- Supply chain. Chips, interconnect, and energy. Almost nobody achieves independence here; the realistic target is diversification and stockpiling.
Underneath these sits a distinction that vendor slides blur: data sovereignty is about where information is stored and processed; operational sovereignty is about who runs the system and whether an outsider could alter or switch it off. Most “sovereign” offerings deliver the first and stay quiet about the second.
The state’s objective: capability and continuity
A government is exposed to all four dependencies at once, which is why national programmes look expensive. The state needs the ability to produce and evolve models, not merely to run one: language coverage for its population, its own statutes and administrative knowledge, alignment to its own constitutional values, and the talent that can repeat the exercise in three years. It also needs continuity of compute and power, because a model you cannot serve during a supply shock is not sovereign.
This is the one case where pretraining from scratch can be justified, and the argument is technical as well as political. The Apertus team excluded documents whose owners had opted out of crawling and trained with an objective that limits memorisation, properties that cannot be retrofitted onto someone else’s weights. Separately, research on filtering dual-use content at pretraining time found that models built this way resist adversarial fine-tuning far better than models patched after the fact. Some sovereignty properties exist only at the pretraining stage.
The regulated business’s objective: control and auditability
A bank, an insurer, or a hospital has a narrower problem. It is exposed to the first two dependencies, jurisdiction and vendor discretion, and rarely to the other two. It does not need to pretrain anything. It needs a stack that runs inside its legal perimeter, makes no external calls during inference, keeps documents and retrieval logs on its own storage, and produces an audit trail a regulator will accept. For most such organisations an open-weight model with careful post-training is sufficient, and the effort belongs in the retrieval, permissions, and observability layers rather than the model.
The overlap with the state is real and worth naming: both need operational sovereignty, both need an evaluation suite in their working languages and domains, and both need a plan to keep operating the system after launch. Everything else diverges.
What you actually build, layer by layer
- Compute. Training and inference are separate procurements with separate lead times. Power and cooling are usually on the critical path before GPUs are. State: owned or nationally pooled capacity. Business: a domestic colocation or sovereign-cloud tenancy is normally enough.
- Model. Base, instruct, embedding, and speech models, with weights and training recipes held on your side of the boundary. State: reproducible checkpoints. Business: a pinned open-weight model you can re-host tomorrow.
- Serving. A local inference engine behind an OpenAI-compatible gateway, so applications never bind to one model. Egress blocked at the network layer.
- Retrieval. The layer where leakage actually happens. Contracts, case files, and clinical notes carry more risk than the prompt text. Embeddings, indexes, and retrieval logs stay local with enforced retention.
- Workspace. Identity, role-based access, per-document permissions, and log policy. This is where “sovereign” becomes an operating habit rather than an installation.
- Evaluation. Benchmarks in your languages and domains, plus red-team harnesses. Without this you cannot tell whether any adaptation helped or hurt.
Open weights, continued pretraining, or from scratch
Three tiers, in ascending cost, and the choice follows directly from the scoping above.
Tier A: adopt open weights and post-train. Frontier-adjacent capability immediately, at the cost of inheriting the tokenizer, data mix, values, and licence of the originating lab. Adequate for most regulated businesses; thin for a state.
Tier B: continued pretraining on an open base. The dominant national pattern. SEA-LION’s third generation continued pretraining Gemma and Llama bases on roughly 200 billion tokens of regional-language text; its fourth generation scaled that to a few hundred billion tokens on newer bases. Japan’s Swallow expanded the vocabulary of Llama 2 and continued pretraining on Japanese corpora. The known limit is architectural: you are bound to the base model’s design and tokenizer, which may fit your scripts poorly. The cost is tractable. As one datapoint, the Mangosteen Thai-corpus paper reports a continued-pretraining run of around 47 billion tokens on an 8B model taking 64 H100s for about a day and a half; larger corpora and models scale roughly with token count, but treat this as illustrative rather than a budget line.
Tier C: pretrain from scratch. The only route to full provenance. Apertus trained on 15 trillion tokens and published everything. Sarvam pretrained its 30B model on 16 trillion tokens and its 105B model on 12 trillion, with 2.4 billion and 10.3 billion active parameters respectively, and built the tokenizer, data pipelines, and inference kernels in-house; the company’s own framing is that owning every stage is a core requirement of a sovereign stack. This is expensive, slow, and only worth it when epistemic and supply-chain independence are genuinely in scope.
The pragmatic sequence is Tier B first, while building the corpus, evaluation suite, and team that Tier C demands. Tier A is where most enterprises should stop.
The delta you add, and what you must remove
What gets added on top of a base is what makes a model yours: a tokenizer extended for local scripts, a language corpus (parallel data is unusually effective), domain knowledge such as statutes and regulatory codes, a values layer, and the modalities your population actually uses. Switzerland made the values step explicit, scoring responses against a written charter of constitutional principles and adjusting the model toward it. Sarvam reports building its safety fine-tuning set around India-specific risk scenarios alongside the standard ones, and evaluating each of the 22 scheduled languages in both native and romanised script because that is how people actually type. Voice-first design in India exists for the same reason: a large share of intended users will never type a prompt at all.
What must be removed or audited is less discussed. Licence clauses that cap use or allow revocation are a legal dependency, not a technical one. The originating lab’s refusal policy may conflict with local law and needs re-alignment, with evidence that it held. Memorised personal or copyrighted data is close to impossible to excise after the fact, which is the strongest argument for compliant pretraining. Weights of uncertain provenance carry backdoor risk, mitigated by verification rather than removal; this is why fully-open projects publish intermediate checkpoints. Finally, telemetry in the surrounding tooling, from serving engines to model hubs, is the quiet leak most audits miss.
The part nobody budgets
The recipe lives in people, not files; talent retention is the layer no procurement covers. Energy is a first-class dependency, not a facilities line. Sustainment, meaning update testing, backup encryption, and log policy, decides whether the system is still sovereign in year three. And every programme eventually faces the “how open?” decision: publishing data and recipes buys trust and verifiability at the cost of strategic ambiguity.
Scope first, spend second
Before signing anything, answer four questions in writing:
- Which of the four dependencies are we actually exposed to?
- Do we need operational sovereignty, or only data sovereignty?
- Which stack layers must we own, and which will we rent?
- What evaluation will tell us, in twelve months, whether it worked?
Here is the claim I am willing to be wrong about: programmes that fund inference, retrieval, and evaluation before pretraining will show measurable results within a year. Programmes that invert that order mostly will not, and the GPUs will be the least of what they have to explain.