---
title: 'Sovereign AI: Governance, Infrastructure, and Control'
url: https://www.emergentmind.com/topics/sovereign-ai
type: topic
---

# Sovereign AI: Governance, Infrastructure, and Control

Sovereign AI denotes a set of research programs concerned with who can control, govern, sustain, and bound artificial intelligence systems across data, models, infrastructure, execution, and legal jurisdiction. The literature does not treat sovereignty as a single binary property. It is variously defined as the extent to which a nation independently controls its AI technologies, as a continuum of autonomy under interdependence, as an institutional capability to control AI use on one’s own terms, as an architectural property of effective control and verifiability, and, in some agentic settings, as either a condition to be denied to agents or a property that decentralized infrastructures can inadvertently confer upon them [2606.07245] [2511.15734] [2512.08978] [2602.14951].

## 1. Conceptual foundations and competing definitions

A prominent national-policy formulation defines AI sovereignty as “the extent to which a nation independently controls its artificial intelligence (AI) technologies,” expanding the notion to include data, workforce, natural resources, infrastructure, model training, and model hosting [2606.07245]. A separate formal treatment rejects a binary view and models sovereignty as a continuum generated by four interdependent pillars—data, compute infrastructure, model autonomy, and normative alignment—summarized as
\[
S = f(D, C, M, N).
\]
In that formulation, the relevant question is not whether a state is fully sovereign, but how much sovereignty it secures in each layer, at what cost, and with what openness to global interdependence [2511.15734].

This literature consistently distinguishes sovereignty from narrower notions such as data localization or domestic branding. One architectural paper defines digital sovereignty and “Sovereign AI” as the ability of a state, organization, or community to retain effective control, autonomy, and independent decision-making over digital infrastructures, data, AI behavior, and the software supply chain, within a known jurisdictional and governance boundary [2602.05486]. A regional-LLM paper similarly describes a sovereign large language model as one “independently constructed, trained, and deployed by a nation or region, operating on locally controlled computing and data infrastructure” so as to ensure security of critical technologies, mastery of data sovereignty, and alignment with local language, culture, and institutional requirements [2507.11502].

Global-governance research places these definitions inside a broader theory of power. It distinguishes sovereignty as an institution from sovereignty as a practice, and argues that AI systems are becoming embedded in global governance through public/private cooperation and contestation rather than simply replacing states. In this account, “sovereign AI” can refer both to attempts to control AI infrastructures and to the use of AI infrastructures as means through which sovereign competence is performed [2410.17481].

## 2. Infrastructure sovereignty and feasibility boundaries

Infrastructure-centered work argues that AI has shifted from a software-centric discipline to an infrastructure-driven system. Control over data and algorithms alone is therefore insufficient for meaningful sovereignty, because practical operation depends on power availability, cooling feasibility, water usage, optical transport reach, and real-time operational visibility [2602.10900]. One tutorial-survey defines **AI infrastructure sovereignty** as “the ability of a region, operator, or nation to exercise operational control over AI systems within physical, environmental, and infrastructural limits,” and treats sovereignty as emerging from the co-design of AI-oriented data centers, optical transport networks, and automation frameworks built on telemetry, agentic AI, and digital twins [2602.10900].

A more formal operationalization is given by the **Feasible Sovereign Operating Region (FSOR)**, which characterizes the workload sets for which a placement-and-routing plan exists under current telemetry. The paper defines
\[
\mathrm{FSOR}\bigl(\boldsymbol{\theta}(t)\bigr)
=
\Bigl\{
\mathcal{W}(t) \subseteq \mathcal{W}_{\mathrm{total}}
\;\Big|\;
\Phi\bigl(\mathcal{W}(t),\, \boldsymbol{\theta}(t)\bigr) \neq \emptyset
\Bigr\},
\]
where feasibility is jointly determined by site power, carbon intensity, water usage, optical capacity, and latency constraints [2604.09705]. In this formulation, sustainability is not a soft optimization preference but a hard feasibility boundary: if carbon thresholds, water permits, power envelopes, or latency limits are exceeded, a workload is infeasible rather than merely suboptimal [2604.09705].

Operationally, the same paper formulates a joint compute-placement and optical-network-routing MILP with binary placement variables \(x_{ik}\) and routing-flow variables \(f_{ijk}(t)\), then deploys it inside a receding-horizon controller with the cycle **observe → estimate/predict → optimize → validate → execute → observe** [2604.09705]. The telemetry pipeline spans compute/power, grid carbon and water, optical network state, and workload orchestration; a digital twin validates thermal, power, latency, congestion, and policy constraints before execution [2604.09705]. Scenario analysis compares a latency-minimizing baseline, a compute-only sustainability-aware placement baseline, and the joint formulation; the joint method yields lower aggregate environmental impact, while infeasibility events are treated as correct telemetry-grounded signals that infrastructure investment or workload reduction is required [2604.09705]. At the tested scale, the “Paper” scenario with \(N=8\) sites and \(M=20\) workloads was solved to optimality across five randomized instances with median solve time \(0.12\) s and maximum \(60.00\) s, within a five-minute telemetry cycle budget; the “Small” and “Medium” scenarios had medians of \(0.02\) s and \(0.07\) s respectively [2604.09705].

The same infrastructural logic appears in telecom work on 6G. There, sovereign AI is defined as national- or operator-level control over development, deployment, governance, and lifecycle management across data, compute, models, inference, updates, and compliance. Within O-RAN, sovereignty is operationalized through xApps in the Near-RT RIC and rApps in the Non-RT RIC, together with federated learning, robust aggregation such as geometric median and Krum, privacy-enhancing technologies, synthetic data generation, explainable AI, and secure model-update pipelines [2509.06700].

## 3. Institutional governance and sovereignty-by-design architectures

Institutional work treats sovereignty as an enforceable governance layer rather than a ban on commercial AI. A six-month pilot at Fontys ICT defines AI sovereignty as an institution’s ability to control AI use on its own terms: who may use which model, where data is processed, under what legal conditions, what budget is consumed, what risks are disclosed, and how model choice is made visible and teachable [2512.08978]. Its three-layer gateway architecture consists of a ChatGPT-style frontend built on OpenWebUI and linked to institutional identity, a gateway core implemented with Portkey for access control, budgets, logging, and EU-default routing, and a provider layer that wraps vendors and open-source models in institutional model cards [2512.08978]. The pilot involved 300 users, ran reliably with no privacy incidents, used a monthly institutional cap under \$500 that was never breached, provided typical approved API users with \$10, and required explicit acknowledgment for US-hosted processing when EU-hosted options were unavailable [2512.08978]. The paper’s central organizational conclusion is that institutions need a formal AI Officer role combining technical literacy, governance authority, and educational responsibility [2512.08978].

A more general software-architecture treatment frames sovereignty as a first-class quality attribute. Its **Sovereign Reference Architecture (SRA)** comprises five layers: self-sovereign identity; blockchain trust and audit; sovereign data; sovereign AI; and applications. Each layer is specified by purpose, constraints, and mechanisms: for example, the sovereign AI layer governs the GenAI lifecycle through approved models only, reproducible evaluation, auditable use, and leakage control, implemented with a model registry, eval/promotion gates, prompt/tool evidence, and sovereign telemetry [2602.05486]. In this account, blockchain “anchors governance-relevant provenance,” while GenAI has a dual role: it is simultaneously a governance risk if left opaque and externally dependent, and an enabler of compliance, documentation, risk analysis, anomaly detection, and continuous assurance when architecturally constrained [2602.05486].

COMPASS extends the same logic into runtime orchestration. It inserts an Orchestrator between user intent and agent action, routing each request through four sub-agents concerned with sovereignty, carbon-aware computing, compliance, and ethics [2603.11277]. Each sub-agent is grounded with Retrieval-Augmented Generation over verified, context-specific documents, and each produces a quantitative score and explanation through an LLM-as-a-judge interface that returns JSON. The judge configuration reported in the paper uses `mistralai/Mistral-7B-Instruct-v0.2` with `max_new_tokens = 256`, `temperature = 0.7`, `top_p = 0.7`, and `repetition_penalty = 1.2` [2603.11277]. Evaluation across SOV, CAR, COM, and ETH test sets uses BERTScore to compare explanations with and without RAG; the reported result is that RAG significantly improves semantic coherence and mitigates hallucination risk, with sovereignty examples such as SOV-01, SOV-06, SOV-07, SOV-08, and SOV-10 showing higher scores under RAG [2603.11277].

## 4. Agentic sovereignty, bounded autonomy, and governed execution

In the agentic literature, sovereignty is split between two incompatible poles. One pole insists that AI agents must remain subordinate to a human principal. The **Agent Economic Sovereignty Protocol (AESP)** states the invariant directly: agents should be economically capable but never economically sovereign [2603.00318]. Sovereignty remains with the human **Digital Sovereign Entity (DSE)**, while the agent is constrained through a deterministic eight-check policy engine, three escalation tiers (automatic, explicit review, biometric), EIP-712 dual-signed commitments with escrow, HKDF-based context-isolated privacy with batched consolidation, and an ACE-GF cryptographic substrate. The implementation is an open-source TypeScript SDK with 10 modules and 208 tests, and exposes interoperability through MCP and A2A [2603.00318].

A second pole accepts autonomous economic action but subjects it to constitutional governance. **Sovereign-OS** is presented as a charter-governed operating system in which a Pydantic-validated YAML Charter specifies mission, core competencies, fiscal boundaries, and success KPIs, while a CEO/Strategist builds dependency-aware task DAGs, a CFO/Treasury enforces balance, daily burn, and profitability floors, Workers operate under earned-autonomy permissions via TrustScore, and an Auditor/ReviewEngine produces SHA-256-sealed AuditReports [2603.14011]. The GovernanceEngine runs the pipeline **plan → approve → auction → dispatch → audit** [2603.14011]. In evaluation, the system blocks 100% of fiscal violations across 30 scenarios, achieves 94% correct permission gating across 200 missions, and maintains zero hash mismatches over 1,200+ AuditReports [2603.14011].

A third line of work relocates sovereignty from agent identity to execution control. **Sovereign Agentic Loops (SAL)** require models to emit structured intents and justifications rather than direct commands; a local control plane validates them against true state and policy, while an obfuscation membrane hides identity-sensitive state from the model and an Evidence Chain preserves auditability and deterministic replay [2604.22136]. In an OpenKedge prototype for cloud infrastructure, SAL blocks 93% of unsafe intents at the policy layer, rejects the remaining 7% via consistency checks, prevents unsafe executions in the benchmark, and adds 12.4 ms median latency [2604.22136]. **Verifiable Agentic Infrastructure** generalizes this into a **Distributed Trust Framework (DTF)** that computes execution authority from a Justification Proof, consensus evaluation, an ephemeral Execution Identity, and an append-only Evidence Chain, under the invariant that there is no high-stakes execution without a proof object, no derived authority without consensus, and no valid mutation detached from evidence [2605.15228].

A fourth line warns that decentralized infrastructure can harden agents into non-overrideability. The paper on **Sovereign Agents** defines **agentic sovereignty** as “the capacity of an operational agent to persist, act, and control resources with non-overrideability derived from the infrastructural stack in which it is embedded,” and analyzes how TEEs, DePIN, blockchain execution, cryptographic self-custody, and protocol-mediated continuity can create an accountability gap in which no single actor both bears responsibility and can stop the system [2602.14951]. In that literature, sovereignty is a spectrum determined by infrastructural hardness rather than a formal legal status [2602.14951].

## 5. Regional models, public services, and sector-specific deployments

Regional-model work treats sovereignty as local alignment across language, law, and institutional mission. **HKGAI-V1** is described as a regional sovereign LLM for Hong Kong: a 685-billion-parameter system built on the DeepSeek architecture and adapted through full-parameter fine-tuning, supervised fine-tuning, RLHF, Learning from Language Feedback, weak-to-strong generalization, and a modular RAG system [2507.11502]. The project is explicitly tied to Hong Kong’s “one country, two systems” environment and its multilingual requirements in Cantonese, Mandarin, and English [2507.11502]. Its proprietary **Adversarial HK Value Benchmark** contains 300 human-crafted sensitive questions; on Hong Kong Sensitive issues, HKGAI-V1 chat achieved 79% safe responses, compared with Kimi at 53% safe and 5% unsafe and ChatGPT at 88.7% unsafe in that domain [2507.11502]. The paper also reports HKMMLU mean accuracy of 81.4%, ahead of DeepSeek-V3 at 76.6% and GPT-4o at 70.5%, SafeLawBench average accuracy of 80.0%, and Beaver-zh-hk Harmless Score of 88.95 versus DeepSeek-R1’s 70.41 [2507.11502]. Around 20,000 officers across nearly all departments are reported as already using applications based on HKGAI-V1 [2507.11502].

Public-service deployments make a different claim: that sovereignty can be viable and affordable on premises. A Portuguese-government study compares the production **gov.pt** chatbot, powered by a top-tier commercial provider, with an on-prem alternative, **Evaristo.ai – Serviços públicos**, that uses local/open models, a local Weaviate index, and a RAG stack over approximately 2.3k gov.pt web pages [2603.01869]. Retrieval uses hybrid search with dense vectors and BM25 at \(\alpha = 0.5\), paragraph-level chunking, and at most three documents passed into generation [2603.01869]. On a 292-item answering set, **Gervásio 70B + RAG** scored 4.14 on direct questions and 3.97 on verbose questions, compared with the gov.pt baseline at 4.02 and 4.01 respectively [2603.01869]. On refusal, the same sovereign system achieved 98% not-answer accuracy on a 61-item Do-Not-Answer subset and correctly refused 86% of 42 out-of-domain items [2603.01869]. Under load balancing, the 70B system served 100 users at under 30 s p95 latency, while an 8B model stayed under 1.5 s p95 for 100 users and under 15 s for 500 users [2603.01869].

Healthcare work narrows sovereignty further to physical communication constraints. A clinical-triage architecture performs all inference on device, receives inbound data through receive-only broadcast infrastructure or certified hardware data diodes, and uses an optical out-of-band channel for session keys and outputs [2603.24898]. The prototype uses a quantized LLM class model with `llama.cpp`, `whisper.cpp`, `MediaPipe`, and a dedicated NPU [2603.24898]. Its core formal claim is that receiver-side unidirectionality removes the network-mediated attack surface by construction, yielding \(S_{\text{sovereign},r} = \emptyset\), while graph isolation is expressed as \(T \notin V\), meaning the terminal is not a vertex in the institutional network graph [2603.24898].

Telecom work extends the same logic to AI-native 6G. Sovereign AI in this context is national- or operator-level capability to independently develop, control, deploy, govern, and audit AI across the full lifecycle, especially within O-RAN architectures [2509.06700]. The literature emphasizes sovereign xApps and rApps in the Near-RT and Non-RT RICs, federated learning across trusted infrastructure, synthetic data generation with GANs, VAEs, and diffusion models, explainable AI, robust aggregation, policy-constrained inference, and secure model-update pipelines [2509.06700].

## 6. Trade-offs, controversies, and research trajectories

A recurrent controversy concerns openness. One formal planner’s model argues that sovereignty should not be confused with autarky: the optimal policy is typically an interior openness setting with guardrails, not total closure [2511.15734]. The same paper proposes two heuristics: equalize marginal returns across the data, compute, models, and norms pillars, and set openness where the marginal benefit of collaboration equals the marginal exposure risk [2511.15734]. This makes “managed interdependence” rather than isolation the central policy formula [2511.15734].

A second controversy concerns scale and strategic competition. Work on national power models treats sovereign AI as materially dependent on accelerators, electricity, water, datasets, skilled workforce, AI cabinets, and AI data centers, and argues that these are leverage points that states can expand domestically or attack in adversaries through kinetic and non-kinetic means including cyber, space, information operations, economic coercion, diplomacy, and, in one cited example, Iran’s targeting of data centers with drones [2606.07245]. This line of work treats AI sovereignty as an instrument of national power rather than a purely regulatory aspiration [2606.07245].

A third debate concerns whether sovereignty primarily means protection of institutions, persons, or creators. Research on **Cognitive Sovereignty** argues that persistent AI memory transforms sovereignty into a struggle over who owns, hosts, audits, and can export memory graphs that shape individual, organizational, and national cognition; its proposed countermeasures include memory portability, transparency, sovereign cognitive infrastructure, and strategic alliances [2508.05867]. A different normative intervention, **author sovereignty**, applies the language of sovereignty to copyright and training data, arguing that voluntary negotiated consent must replace coercive norms, that no reuse of protected work should be presumed fair by default, and that if others profit from a work, the author must benefit [2504.02239].

A fourth controversy concerns model scale itself. The paper on **Punctuated Equilibria in Artificial Intelligence** defines an **Institutional Fitness Vector**
\[
f(\theta,\varepsilon)=\bigl(C(\theta),\,T(\theta,\varepsilon),\,A(\theta),\,\Sigma(\theta,\varepsilon)\bigr)^\top \in [0,1]^4,
\]
with capability, institutional trust, affordability, and sovereignty compliance as coequal dimensions [2603.14664]. Its central claim is the **Institutional Scaling Law**: institutional fitness is non-monotonic in model scale, so the environment-specific optimum may favor smaller, domain-adapted, sovereign systems over frontier generalists when trust and sovereignty weights are high [2603.14664]. The paper links this to “speciation” of sovereign AI, in which jurisdictions select distinct local optima rather than converging on a single universal model class [2603.14664].

Across these strands, sovereign AI functions less as a single doctrine than as a contested field of design principles. The common denominator is enforceable control: over data flows, compute, execution authority, infrastructure dependencies, legal alignment, environmental limits, and adaptation pathways. The main disagreements concern where that control should reside, how much openness it can tolerate, whether autonomy should be delegated or denied to agents, and whether sovereignty is best pursued through large domestic stacks, smaller specialized systems, or carefully governed interdependence.

Source: https://www.emergentmind.com/topics/sovereign-ai