The setup
Sovereign AI is the phrase of the year, and most of what flies under that banner turns out to be a subsidy with someone else’s model running quietly underneath. So Switzerland is worth a real look: a small, neutral country that actually built its own.
The backstory is the good part. In December 2023, while much of the field was still arguing about whether open models were even safe to release, Switzerland stood up the Swiss AI Initiative: 800+ researchers across a dozen institutions, 20 million GPU hours a year, and a mandate to train a national model rather than fine-tune somebody else’s.
The machine they used sits in Lugano. It’s called Alps, built from roughly 10,000 Nvidia GH200 chips, 270 petaflops, eighth-fastest in the world, cooled with water drawn straight from the lake. Carbon-neutral supercomputing under the mountains, training a model that speaks a thousand languages.
The motivation runs deeper than policy fashion. This is a country where a national e-ID vote nearly failed because voters didn’t trust who would hold their data, and where the chief of the armed forces put his concerns about Microsoft dependence in writing to the government. The sovereignty anxiety here is real, and earned.
On 2 September 2025, Switzerland shipped Apertus, and for a moment the ambition and the artifact lined up.
Then the procurement ledger showed up.
The turn
In the same stretch, it was showing off a homegrown sovereign model; the Swiss federal government renewed its Microsoft licenses for CHF 140 million, on the reasoning that walking away from Big Tech had become too risky and too costly.
Somewhere, Satya Nadella smiled. Picture the Swiss delegation hiking up to some imagined chalet, sovereign model under one arm, independence finally in reach, and deciding that staying on Microsoft’s good side for one more winter was the easier call. Why climb off the platform when you can re-sign and call it a strategy?
Hold both of those together, and the contradiction is hard to miss. This isn’t sovereignty. It’s the costume, with a Redmond invoice pinned to the back.
Let me slice it up.
First, credit where it’s due
Apertus is real, and it’s good. Two sizes, 8B and 70B, Apache 2.0, 15 trillion tokens, 1,000+ languages. And it’s open the way the word is supposed to mean: the weights, the training recipe, and the data are all published, not just a checkpoint you can download. Plenty of “sovereign AI” launches never make it past the logo. This one you can actually run.
Which is exactly why the rest deserves scrutiny.
The Microsoft problem, dissected
The contradiction comes apart in four cuts.
Cut 1 — The state won’t buy its own sovereignty. Switzerland funded a sovereign model and kept running the actual government on Microsoft. The flagship doesn’t replace the incumbent; it sits beside it while Microsoft keeps handling the email, the documents, and everything that matters on a Tuesday morning.
Cut 2 — “Too risky to switch” is the diagnosis, not the excuse. If nine figures of lock-in has become too risky and costly to unwind, that dependency is the problem — not a reason to postpone dealing with it. Renewing for another two years doesn’t retire the risk. It books it as a recurring line item.
Cut 3 — Even the army noticed. When the chief of the armed forces is putting his Microsoft concerns to the government in writing, the dependency has stopped being a panel-discussion abstraction and turned into a defense question.
Cut 4 — The model runs on the same foreign stack anyway. Apertus was trained on Nvidia silicon and HPE hardware, and it’s distributed through Amazon’s SageMaker. The “sovereign” model leans on U.S. chips, U.S. iron, and a U.S. cloud, while the government desktop stays on Microsoft. The sovereign layer collects the headlines. The dependent layers keep the lights on.
Four cuts, and the same name keeps surfacing. He didn’t have to do a thing to come out ahead.
The Scorecard (five pillars)
Territorial — 8/10. Built on Swiss soil, Swiss compute, and Swiss power, under Swiss institutions. About as clean as it gets, right until inference walks out onto AWS.
Legal — 9/10. The genuine moat. Data transparency, EU AI Act alignment, and real respect for Swiss copyright and privacy law. Closed labs sit one lawsuit away from a training-data reckoning; Switzerland cleared the room in advance.
Technological — 6/10. Open, but not at the frontier. 70B is a credible model rather than a dominant one, and every chip under it is foreign. A single export-control decision reaches the whole thing.
Operational — 3/10. Closer to a research artifact than a running system. Real-world use today is thin: one canton translating documents. No serving infrastructure, no operational track record, nothing an enterprise would yet build on.
Financial — 4/10. Publicly funded research with no revenue engine, running alongside CHF 140M flowing out to Microsoft. The state built a sovereignty it won’t buy from itself.
Two scores, because one is a lie
As open research: 9/10. Top-tier work, and it should be treated that way.
As a sovereignty strategy: 4/10. The model is the easy flag to plant, and the worst place to stop climbing.
You could average those into a comfortable 6.5. I’d rather you sit with the distance between them.
Sovereignty of what, exactly?
That’s the question worth putting to every one of these announcements.
Switzerland won sovereignty at the model and data layer — the part that earns you transparency and legal defensibility. A real achievement, and I won’t pretend otherwise.
But if the threat you actually face is hyperscaler lock-in or a chip embargo, sovereignty at the model layer does nothing for you. The leverage sits underneath it, in the compute, the inference, the supply chain, and the machines on civil servants’ desks. All of it still owned abroad. You can publish the weights and remain a tenant everywhere the rent actually comes due.
The verdict
Switzerland did the unglamorous work most governments skip, and it earned the legal and territorial marks honestly. Most countries manage a keynote and not much else. But it planted its flag on the most photogenic peak and left the supply chain, the runtime, and its own civil service in foreign hands. Then it paid Microsoft CHF 140M to keep them there.
The point was supposed to be a model and the stack beneath it. Switzerland got the model and rented the rest. That isn’t a sovereign stack; it’s an impressive proof of concept with a recurring invoice.
The way out
None of this is an argument against what Switzerland built. It’s an argument for finishing the job. The raw material for real sovereignty already exists, and Apertus is part of it. Open weights are the unlock: a model you can inspect, fine-tune, and redeploy is a model you can run on infrastructure you control, instead of renting it back through someone else’s API.
So the strategy isn’t complicated, even if the execution is. The stack has more layers than this, but three of them decide whether “sovereign” means anything. Own these, at a minimum.
Intelligence. Start from open-weight models rather than a vendor’s black box. You see the weights, you fine-tune on your own data, and the whole thing stays inside your jurisdiction.
Compute. Run it on infrastructure you govern — sovereign cloud, national HPC, or on-prem — so a pricing change or an export ruling made in another country can’t reach into your operations.
Inference. The layer everyone underestimates. Serving fabric, fine-tuning pipelines, orchestration, guardrails, and the integration into real workflows. Sovereignty gets decided in production, not on the model-download page.
The honest problem is that almost no one can stand up these layers alone. Researchers can train a model but have never had to keep one running under an enterprise SLA. Internal IT is usually buried in the same incumbent stack it’s trying to escape. This is where forward-deployed engineering earns its keep, and it’s why we built Agentcy Labs: a partner that embeds with your team, architects the stack across compute, intelligence, and inference, and hands it back with you owning it, not leasing it.
Own the stack. Don’t rent the outcome.
Satya is still smiling, and he’s betting that “too risky to switch” stays true forever. Owning your own stack is how you make that sentence false.
Switzerland built the model. The next move is to build everything underneath it.
— Amit
Amit Eyal Govrin · Agentcy Labs
