I keep asking audiences “sovereignty of what.” Zuckerberg just answered a different question I should have been asking — sovereignty for whom — and his answer is not your institution.
On August 10th, Mark Zuckerberg published The Future is for Everyone. Most of the commentary since has been about whether he means it. Zuck is an easy media target but they’re focusing on the wrong argument. For the sake of discussion, let’s assume he means every word. It’s more interesting that way, and considerably more threatening.
Why do we say that? Because this is not a product announcement dressed as philosophy. It is a sovereignty argument, made explicitly, with a named beneficiary:
“The key to a positive future for everyone is achieving a balance of power that favors individuals.”
Balance of power. That is sovereignty vocabulary. He is not talking about features — he is talking about where authority should sit. And he answers it without ambiguity: with the individual.
I work with a different unit. My clients are enterprises and, increasingly, states. And here is the thing nobody has said out loud in the two weeks of takes since publication:
Individual sovereignty and institutional sovereignty are not the same axis. They are frequently in opposition. And this essay proposes to strengthen one by routing around the other.
Three sovereigns, and they are not nested
There are three units that can hold sovereignty over an AI stack: the individual, the enterprise, the nation.
It is tempting to assume they nest — empower the citizen, you empower the state; empower the employee, you empower the firm. They don’t nest. They compete for the same scarce thing, which is decision rights over the crown jewels.
Every capability an individual gains independently of their institution is a decision that institution no longer makes. That isn’t a side effect of Zuckerberg’s proposal. That is the proposal. He is explicit that concentrated control is the danger and dispersed capability is the remedy. Dispersing capability away from concentrations means dispersing it away from institutions, because institutions are what concentrations of people are called.
He is right that concentration is dangerous. He is describing a different concentration than the one my clients are trying to survive.
A billion tenants who feel sovereign
Now the load-bearing detail.
The individual in this essay does not get sovereignty. They get capability, delivered as a service, on infrastructure owned by a third party, for free.
Run that forward. A billion people each holding a personal superintelligence they cannot host, cannot fork, cannot audit and cannot take with them does not produce a billion sovereigns. It produces a billion tenants and one landlord — and it dissolves the institutional layer that used to sit between them and negotiate on their behalf.
The enterprise loses decision rights. The individual gains capability but no control. The infrastructure owner gains both.
That is not a balance of power favoring individuals. That is disintermediation with a civic vocabulary.
And here is why it works where every previous attempt failed: it feels like empowerment to the person experiencing it. It has no adversary. Nobody resists a free tool that makes them better at their job. The institution isn’t defeated — it is simply never consulted.
Procurement is the sovereignty instrument, and it never fires
This is the mechanical part, and it’s the part procurement people need to sit with.
How does an enterprise actually exercise sovereignty? Not through principles. Through procurement. The vendor review, the DPA, the security questionnaire, the residency addendum, the exit clause. That machinery is the institution’s sovereignty, operationalized. It is the control point where all five pillars get decided.
Every piece of it is triggered by one thing: a transaction.
Personal superintelligence arrives below the transaction line. Free, on a personal device, adopted individually, no contract, no PO, no vendor onboarding, no review. The sovereignty apparatus doesn’t fail — it never fires, because from its perspective nothing happened.
This is the bypass. Not an attack on the control point. A route that doesn’t pass through it.
The litmus test, applied correctly
Normally I score a vendor against the 5 Pillars. That’s the wrong exercise here, because the answer is boring — a hosted frontier agent fails Territorial, Operational, Technological, Legal and Financial, and it fails them the same way for every frontier lab. Meta isn’t special.
Score the institution’s position instead. Not “does this pass,” but who now holds the pen on each pillar.
- Territorial — where data and compute physically reside. Decided by an employee’s choice of phone and region. Your residency posture is now an aggregate of consumer defaults.
- Operational — who runs and secures the environment, holds keys, sees logs. Decided by a consumer terms-of-service acceptance. Nobody in your organization has read it.
- Technological — can you audit, fork, self-host. Answered “no,” permanently, by someone with no architectural mandate.
- Legal — which jurisdiction governs access. A US consumer agreement, accepted individually, in a country that is probably not yours.
- Financial — freedom from lock-in. Accumulating daily. No PO was ever raised, so no budget owner is tracking the dependency that is forming.
The pillars are not failing. They are being answered — correctly, completely, and by someone else. Every one of these is a legitimate sovereignty decision. Every one is now being made by a person with no mandate to make it, in a context where they don’t know they’re making it.
That’s the difference between a breach and a bypass. A breach is something you remediate. This is a transfer of decision rights, and you can’t patch it.
Now do it at national scale
Everything above scales to the state, and gets worse.
Enumerate the instruments a nation actually has: procurement rules, data residency law, licensing regimes, export controls, sectoral regulation, national cloud programs. Every single one attaches to an institution — a company, a ministry, a contracting entity, a licensed operator.
Not one of them attaches to a citizen downloading a free application.
So “deliver personal superintelligence to billions of people” is, functionally, a route around every sovereignty instrument a state possesses. Not by breaking them. By operating at a layer they were never written to reach.
A country can run a flawless sovereign cloud program, mandate residency, fund a national champion, certify the whole stack — and still wake up to find that the way work actually gets done nationwide runs through infrastructure in another jurisdiction, adopted one citizen at a time, with no procurement event to regulate and no counterparty to summon.
There is no treaty for this. There is no vendor to call in.
The one door that goes the other way
Same essay: “we will resume releasing some open source models soon.”
Two hedges in nine words, and I’ll believe the release when I can download it. But if it ships, this is the genuinely sovereignty-positive half of the announcement, and it deserves credit on exactly the terms it earns.
Open weights matter here not because self-hosting is more secure. They matter because they are the only mechanism in this essay that returns the decision to the institution. Weights you hold recreate a procurement moment. They give the enterprise or the state something it can actually own, govern, and be accountable for. They restore the institution as a party to its own future.
That is a different and larger claim than “it’s a better deployment model.”
Score it honestly, though:
- Territorial, Operational, Technological — PASS. Your silicon, your keys, your fork, your version pin, your refusal.
- Legal — PARTIAL. The Llama Community License is not open source. A 700M-MAU ceiling requiring Meta’s explicit permission, naming restrictions, an acceptable-use policy Meta writes and revises. Muse Spark licenses are actually more restrictive than the legacy Llama license. Meta offers “contributor discounts” if you’re willing to share your prompts. Remember, your remedy is governed by the counterparty’s contract.
- Financial — PARTIAL. No per-token meter, which is the single biggest win available. But you hold sovereignty over the instance, not the roadmap. Freezing forever is a real option and it is a decay strategy.
Three and a half out of five. A good score.
And one correction to the consensus, because nobody else will print it: on the Legal pillar Meta is the weakest of the open-weight options, not the standard-bearer. DeepSeek ships MIT. Mistral ships MIT. The Thinking Machines license is Apache 2.0. Qwen ships Apache 2.0 on smaller variants. Those are unconditional grants. Llama is a conditional one.
If your sovereignty plan is “we’ll run the open weights,” the real question is whose — and the highest-scoring answer is not the company that just published the manifesto about it.
What the two halves add up to
The bypass is default, free and universal. The remedy requires an institutional decision, a budget line and a team.
The essay removes the institution from the loop, and then offers a remedy only the institution can execute.
Door one needs no decision from anyone — it arrives whether or not a single person in your organization ever reads this. Door two needs GPUs, MLOps headcount, an inference platform and a security review. It is available to organizations that can afford to be sovereign.
Both are real. That is not a balanced outcome. It is a transfer: risk distributed to everyone, sovereignty distributed to the few. Strange result for a document whose thesis is that dispersing superintelligence produces a balance of power favoring individuals.
Distributing capability is not distributing control. It never was.
What this changes for buyers
I’ve been drafting a buyer’s guide to sovereign AI vendors. This essay exposed a hole in it, and I’d rather say so than quietly patch it.
Every buyer’s guide ever written evaluates things you are about to buy. Your sovereignty posture is no longer primarily determined by what you buy. It is determined by what gets adopted — below the transaction line, by people acting individually and reasonably.
Action Item:
- Audit adoption, not just procurement. Your real AI vendor list and your contracted AI vendor list have diverged. The gap between them is your actual sovereignty position.
- Find where the pillars are being answered without you. For each of the five, name the human currently holding the pen. If it’s an employee with a phone, that’s your finding.
- Don’t accept an enterprise tier as the resolution. It repairs Operational and possibly Legal. It repairs nothing on Territorial or Financial while the model stays hosted. Converting an ungoverned dependency into a governed one is progress, not sovereignty.
- Treat open weights as a governance instrument, not an infrastructure choice. Its value is that it puts the decision back in your building. Read the license before the benchmark — model quality is a quarterly question, licensing is a five-year one.
- Name what you’re accepting. Sovereignty is not binary. It’s control with an acceptable risk side car. Every organization will carry some of this exposure. That’s fine. Not knowing you carry it is not.
Zuckerberg asked who should have access to superintelligence and answered: everyone.
The question underneath it — who decides — he also answered. Just not in a sentence, and not in your favor.
Amit
