Sovereign AI — by Amit Eyal Govrin
I’ve been getting a lot of great feedback lately — from enterprises and readers alike — asking about the importance of sovereignty when it comes to AI, and why we insist on holding the line on the five pillars we prescribe: Territorial, Operational, Technological, Legal, and Financial.
The question underneath most of that feedback is the same one, and it’s a good one. My column today is about exactly this.
Is sovereignty a purity test? Is it binary?
The short answer is no. Sovereignty is a scale. More precisely: sovereignty is a state, not a condition.
A condition is something you are. A state is something you’re in — and something you can fall out of. You can be sovereign on Monday and non-sovereign on Wednesday without changing your mission statement, your marketing, or your intentions. All it takes is one decision in the stack.
Sovereignty is stateful
You can own your data centers, your compute, your intelligence, and your open-weight models — full marks across all five pillars — and forfeit it overnight by wiring in a single component you didn’t read the license on.
Take MG. SAIC’s MG ships cars into Europe running a Linux-based software stack. Open-source software carries obligations, and copyleft licenses like the GPL are explicit about the biggest one: on request, you provide the corresponding source code and the license notices that go with it. In August 2025, German attorney Chan-jo Jun filed suit in Munich (Landgericht München I) against SAIC’s German importer, alleging he’d requested that source code for his MG4 EV for over a year and never received it. His legal theory is the sharp part: a copyleft violation terminates your right to use the software — which, he argues, makes the car legally defective. The case is pending. But the lesson doesn’t need a verdict: the moment a copyleft obligation is breached, the technological pillar you thought you owned is no longer yours to stand on.
Now widen the lens on the same company. In late 2024 the EU imposed definitive anti-subsidy tariffs on Chinese EVs, and SAIC drew the highest rate of the group — an extra 35.3% — in part for not cooperating with the Commission’s investigation. Two entirely separate pressures — a private copyleft suit and a state-level trade action — landing on one manufacturer, from two different pillars (Legal and Financial). Neither caused the other. That’s the point. Sovereignty doesn’t fail in one place at a time; the boundary conditions are everywhere at once, and each pillar has its own tripwire.
For AI specifically, the copyleft trap is sharper still. The AGPL — the Affero variant — was written precisely to close the “we only run it over the network, we never distribute it” loophole that SaaS and hosted-model architectures rely on. If an AGPL component sits in your inference path, “we didn’t ship a binary” is not a defense. That is the exact shape of a modern AI stack. Read your licenses before they read you.
And don’t assume “open” saves you — the trap runs the other way too. Half the “sovereign” stacks I see are built on Llama, on the assumption that open weights means no strings. It doesn’t. Llama isn’t open source — its license isn’t OSI-approved — and it carries terms a sovereign operator should care about: an acceptable-use policy, a ban on using Llama’s outputs to improve any non-Llama model, and a clause that says if your product ever crosses 700 million monthly active users you have to go back to Meta for a license it “may grant in its sole discretion.” Own the weights all you like. If the terms of use route through a US company’s discretion, your Technological and Legal pillars have a landlord. Open weights is not the same as no strings attached.
Editor’s note: On Monday August 10, 2026, Meta released the underlying parameters of Muse Glimmer, its new “open” AI model that devs will be able to download and modify. Meta said it would also release its weights for a version of the more powerful Muse Spark model in the coming weeks. These latest models are released under the much more permissive Apache 2.0 license.
Choosing your own scale
Here’s the other side, and it matters just as much: opting for less-than-total sovereignty can be the right call — when it’s a decision, not an accident.
Look at the Swiss AI Initiative. EPFL, ETH Zurich, and the national supercomputing centre CSCS trained Apertus — a fully open, multilingual model — on over 10 million GPU-hours on “Alps,” Switzerland’s own sovereign supercomputer. Weights, checkpoints, training data, and code, all published openly. That’s about as sovereign a foundation as exists today. And then they made it available where the users are: on Azure Foundry, on AWS SageMaker, on Hugging Face, through Swisscom. Sovereign at the core, open at the edge — by design.
That’s not a contradiction. That’s maturity. They decided that pure territorial and operational sovereignty over every deployment was not the objective; reach and openness were. Because they own the crown jewels — the weights, the data, the training pipeline — the hyperscaler is a distribution choice, not a dependency they can’t survive. (I wrote about the Swiss approach earlier in this series — [https://thecuberesearch.com/switzerland-built-a-sovereign-ai-then-wired-chf-140m-to-microsoft/.)
Now hold that against Mistral — Europe’s designated sovereign champion. Mistral raised billions on the promise of frontier AI “built outside Washington’s reach,” and it’s backed by genuinely European capital; ASML led a €1.3B slice of its 2025 round. But look at the plumbing. Its models ship on Azure and inside Copilot, roughly two-thirds of its customers are already on Azure, and Microsoft is funding its data-center build-out as compute spend. As one analyst put it bluntly: sovereignty here means control over where the model runs — not independence from Microsoft’s and Nvidia’s stack. That may be a perfectly rational trade. But “sovereign” stamped on infrastructure you don’t control is a claim that has to survive the litmus test, not just the press release.
So put all three on the scale. Switzerland chose its state and can name exactly which pillar it trades, and why. Mistral sits in the murky middle, where the honest question is whether its sovereignty is control or merely optionality with a flag on it. MG fell out of a state it never checked it was in. Same word — “sovereign” — three completely different places on the scale.
The line you don’t get to cross: whitewashing
There is one boundary condition that is never a legitimate trade-off, and it’s the one I’ll keep hammering: claiming sovereignty you don’t deliver.
That’s not a scale. That’s sovereign whitewashing — and right now the security industry is the worst offender. Confidential computing gets rebranded as “sovereign AI.” A SASE tunnel becomes “sovereign.” A vendor ships a product literally named Sovereign AI and unveils it at Black Hat, while a frontier model on someone else’s per-token meter sits squarely in the request path. Cap your spend all you like — renting intelligence you can’t audit, fork, or self-host is not the financial pillar, and no amount of naming makes it so. (I unpacked the vendors doing this in my Black Hat piece.)
Whitewashing is the one move that fails the test on contact, because the test isn’t about how sovereign you are. It’s about whether the claim matches the reality.
Action item
Conduct a rigorous, pillar-by-pillar audit of your organization’s entire AI technology stack—evaluating Territorial, Operational, Technological, Legal, and Financial dependencies—to map your precise position on the sovereignty scale and eliminate hidden operational tripwires. This requires scrutinizing every layer of your inference path to verify open-source and open-weight license terms (such as AGPL copyleft obligations or restrictive Llama provisions), auditing third-party infrastructure dependencies, and ensuring that any tradeoffs between full control and strategic reach are intentional, transparent, and accurate rather than accidental or misrepresented.
Run every decision through this litmus test, pillar by pillar. Where does the data and compute physically live? Who holds the keys and reads the audit logs? Who owns the stack and can you fork it? Which jurisdiction governs access? Are you free of forced migration? Your answer will be different for each pillar, and it will change over time. That’s fine. That’s what a state means.
You don’t have to be maximally sovereign to be sovereign. You have to know which pillars you own, which you’re renting, and why — and say so out loud.
Everyone can be master of their own narrative — as long as they’re honest with themselves.
This is the work we do at Agentcy Labs. We run the sovereignty litmus test thoroughly — pillar by pillar, hard enough to separate who’s actually delivering it from who’s only claiming it. If you want an honest measure of where your stack really sits on the scale, that’s the conversation to have.
— Amit
References
- MG / SAIC open-source (GPL) source-code lawsuit — Munich, filed Aug 2025: JUN Legal press release
- EU anti-subsidy tariffs on Chinese EVs (SAIC +35.3%) — Oct 2024: Cleary Gottlieb Trade Watch
- Llama — “open weights” ≠ open source; 700M-MAU clause; acceptable-use terms: Meta Llama Community License · WCR Legal analysis of the 700M-MAU limit
- Swiss AI Initiative / Apertus — trained on the sovereign “Alps” supercomputer (CSCS), fully open weights: ETH Zurich announcement · available on Microsoft Foundry and AWS SageMaker
- Mistral & Microsoft — Azure/Copilot distribution, compute-spend funding, and the ASML-led round: Mistral sovereignty analysis · CNBC on ASML’s stake ($14B valuation)
- Armor’s “Sovereign AI” at Black Hat USA 2026 (the sovereign-washing punchline): PR Newswire
