Sovereign AI: Retaining control as intelligence becomes operational
Article | 2026-9-25
10 minute read
Executive Summary
The first generation of enterprise AI focused on possibility: how generative AI could improve productivity, accelerate knowledge work and create new digital experiences. The second generation focused on deployment: how to integrate models, tools and AI services into enterprise environments. The next generation will focus on control.
That is where Sovereign AI becomes strategic. Sovereign AI is an approach that enables organizations to retain meaningful control over the data, knowledge, software, operations and decisions that matter most, while still benefiting from AI innovation.
As AI moves into organizational knowledge, software, operations and decision-making, sovereignty can no longer be defined only by where data is stored or where AI runs. It is becoming a business capability that determines how organizations retain control over the knowledge, systems and decisions that increasingly define their future.
For leaders, this creates a more fundamental question than where AI is hosted: what would the organization most regret losing control of? The answer may be proprietary knowledge, engineering expertise, software, customer intelligence, operational processes or decision logic built over decades.
So why are many organizations still defining sovereignty primarily through infrastructure and data residency? In this article, we explore why the future of Sovereign AI is not about where AI runs, but who controls what AI knows, builds and does.
Sovereign AI: More than AI in a sovereign environment
Most AI sovereignty conversations begin with familiar questions: where is the data stored, where does compute sit, which cloud is being used, and whether infrastructure is located within a national boundary. These questions matter, particularly in regulated sectors, public services and critical infrastructure. But they are only the starting point.
Sovereign AI refers to an organization’s ability to retain meaningful control over the knowledge, software, operations and decisions that matter most, together with the data, models and infrastructure that support them, while still participating in the wider AI ecosystem.
Hosting an AI system inside a national boundary does not automatically create control over how data is used, how models are governed, how agents behave or how decisions are made. Similarly, owning infrastructure does not automatically create sovereignty over knowledge, code, business rules or operational expertise.
The stronger leadership question is who remains in control when AI becomes embedded into enterprise knowledge, software development, operations and decision-making.
For many organizations, competitive advantage is tied to expertise, processes and experience accumulated over years or decades. As AI begins to interpret and act on these assets, sovereignty expands beyond infrastructure and data location to include control over how organizational knowledge and expertise are applied.
Sovereignty is architecture, not a label
Sovereignty cannot be reduced to a vendor claim, procurement label or cloud category. It is achieved through intentional design choices across architecture, governance, operations, legal exposure, supply chain, and technology dependencies.
Organizations cannot assume that legal, regulatory, geopolitical or technology conditions will remain static. Sovereignty must therefore provide continuity and control even as providers, policies and technology ecosystems change.
This makes sovereignty a question of the structure of control: which external dependencies exist, how models and data flows are governed, whether operations can be audited, and whether excessive dependency on a single vendor or platform can be avoided.
A Sovereign AI architecture should therefore be defined by verifiable controls across legal and jurisdictional sovereignty, operational sovereignty, technology sovereignty, data and AI sovereignty, supply-chain sovereignty and regulatory sovereignty. The appropriate level of control should reflect workload, risk, regulatory obligations, resilience requirements and business objectives.
Sovereignty is better understood as a design property than a binary state. The goal is not to maximize control everywhere, but to make deliberate decisions about where control matters most. Too much control can increase cost and constrain innovation; too little can create dependency and long-term risk.
Assembling the right level of control
Many organizations search for a single Sovereign AI platform. In practice, no universal platform can satisfy every sovereignty requirement. Different workloads require different balances of risk, resilience, autonomy and innovation.
Public information, internal productivity tools and mission-critical operational systems have different risk profiles. The objective is not universal control, but proportionate control over the assets that create strategic value.
Organizations should therefore be able to assemble the sovereignty they need rather than inherit the level of sovereignty a single vendor, model or platform provides. This requires composable building blocks. Some workloads may require air-gapped or on-premises deployment. Others may require sovereign hybrid patterns, model neutrality, controlled retrieval, private LLM serving, strict observability or human-in-the-loop supervision.
Such approaches combine controls across LLM serving, knowledge and retrieval, agents and tools, identity and access, guardrails, observability and infrastructure to create the level of control required for each workload.
The value of modularity is not simply technical flexibility. It preserves choice as models, regulations, providers and business requirements evolve.
In regulated and business-critical environments, sovereignty may therefore be differentiated by workload rather than applied uniformly across the enterprise. General-purpose productivity use cases may draw on global AI platforms, while proprietary knowledge, engineering assets or mission-critical operations require tighter controls.
From control to dynamic transformation
The next phase of AI transformation will be defined by the ability to embed AI into knowledge systems, software engineering, infrastructure operations and decision-making while preserving trust, accountability and control. This is where Sovereign AI becomes more than a risk-control requirement. It becomes an enabler of trusted and resilient transformation.
The significance of sovereignty increases as AI becomes more operational. When AI summarizes documents, errors can usually be reviewed by people. When AI modifies software, invokes enterprise tools or contributes directly to operational decisions, unclear control has greater consequences.
Through our work with organizations pursuing AI transformation, we increasingly see that the hardest sovereignty decisions are not purely technical. They involve determining which capabilities are strategically important, how much external dependency is acceptable, and how those choices translate into architecture and governance.
Three transformation domains are especially important because they represent the assets organizations increasingly need to retain control over as AI becomes operational:
①Sovereign knowledge
Organizations are turning institutional knowledge into a machine-accessible strategic asset. The sovereignty question becomes who controls how that knowledge is accessed, interpreted, combined, updated and used by AI.
②Sovereign development
As AI becomes embedded in software engineering, sovereignty extends to source code, development knowledge, models, tools and the software supply chain.
③Sovereign operations
As agentic systems begin coordinating workflows, invoking tools and contributing to decisions, sovereignty must encompass permissions, agent behavior, observability, escalation and the boundaries of autonomous action.
Together, these domains represent a broader shift: from controlling where AI runs to controlling what AI knows, what it can build and what it is allowed to do.
In this sense, Sovereign AI is not a constraint on innovation. It is increasingly becoming the condition that allows innovation to scale sustainably and safely.
The journey to sovereign operations
The journey toward Sovereign AI is ultimately a journey toward understanding what an organization must control to remain resilient, trusted and differentiated. It begins not with technology procurement, but with identifying the assets and capabilities whose loss of control would create strategic, operational or regulatory consequences.
Sovereignty then expands as AI becomes more deeply embedded in the organization: from governing data, to governing knowledge and software assets, to governing AI-enabled operations and decisions.
Wave 1: Control data
AI Experimentation, Governed AI, Sovereign Controls
Move from pilots and policy to initial architectural control
What data, platforms and use cases require control?
Wave 2: Control knowledge
Sovereign Knowledge Enterprise, Sovereign Development
Protect the knowledge and code that differentiate the organization
Which knowledge, software and expertise define our future advantage, and who controls them?
Wave 3: Control operations
Sovereign Agentic Operations, Autonomous Sovereign Enterprise
Enable trusted autonomy across operations and decision environments
What decisions can AI make, what actions can agents take, and where must organizational authority remain?
This is not necessarily a linear journey. The model is better understood as an expansion of the sovereignty boundary as AI becomes more deeply embedded in the enterprise.
Leadership imperatives for the age of sovereign AI
The challenge facing leaders is no longer whether AI should be adopted. The challenge is ensuring that AI can scale without eroding trust, resilience or accountability. This requires leadership alignment before technology implementation.
1. Identify what creates competitive advantage
Determine which knowledge, expertise, processes, software assets and decision frameworks differentiate the organization. This establishes which capabilities are strategically important before decisions are made about how they should be governed and protected.
2. Decide what must remain under organizational control
Map the assets that matter most and determine the appropriate level of sovereignty for each. This helps focus investment where loss of control would create the greatest strategic, operational or regulatory consequences.
3. Define sovereignty in business terms
Connect sovereignty to resilience, competitiveness, trust, risk and operational continuity. This helps prevent the discussion from being reduced to infrastructure or compliance and makes it relevant to enterprise strategy.
4. Architect for choice and verifiable control
Build in the controls the organization needs while avoiding unnecessary dependency on a single architecture or provider. This preserves flexibility as technologies, providers and requirements change, while making control demonstrable rather than assumed.
5. Establish governance before autonomy scales
Define accountability, approvals, monitoring, human oversight and auditability before AI becomes more autonomous. Greater autonomy should not weaken organizational accountability or oversight.
6. Define the boundaries of agentic action
Be clear about what AI agents may know, which tools they may use, what actions they may take, and when human intervention is required. This turns governance into practical operational boundaries before agents begin acting across critical systems and decisions.
These decisions cannot sit solely with technology or risk teams. Business leaders must understand where competitive advantage resides, technology leaders must understand dependencies and architecture, and governance leaders must define the boundaries within which autonomy can scale.
Conclusion
Sovereign AI is not about isolation. It is about confidence, choice and control. It enables organizations to participate in global innovation while retaining authority over the knowledge, decisions, operations and governance that matter most.
The starting point is strategic value: understanding which capabilities make the organization distinctive, what level of control they require, and what would happen if that control were weakened or lost.
As intelligence becomes embedded into enterprise knowledge, development and operations, the sovereignty question will shift from “Where does our AI run?” to “Who controls what our AI knows, builds and does?”
In the age of agentic systems, the organizations that lead will combine global AI innovation with intentional control over the capabilities that define their future: open where openness creates value, sovereign where sovereignty matters.
Liza Allen
Partner, Uvance Wayfinders, Oceania
Liza Allen is a technology transformation leader focused on helping organizations realize value through AI, innovation and change. With a passion for digital sovereignty, she helps customers strengthen resilience, retain strategic control and build trusted foundations for future growth.
Neeraj Arora
GTM Lead for Fujitsu Platform Business Solutions
Neeraj Arora is a global technology strategist with 34+ years' experience, leading cloud, platform engineering and digital transformation. He drives Fujitsu's platform strategy and sovereign technology initiatives across Europe, the UK and Australia.
Uvance Wayfinders
Consulting by Fujitsu
Uvance Wayfinders combines AI-native consulting, deep industry expertise, and Fujitsu's technology capabilities to help organisations turn strategy into measurable business outcomes.
Related Information
Can your AI navigate the trade routes of the Age of Exploration?
Data sovereignty in the AI era: from risk management to strategic advantage
Contact us