Sovereign AI addresses the wrong dependency

We’ve been hearing the word ‘sovereign’ attached to artificial intelligence more and more in recent months. Yet there’s still a gap between what the concept of sovereign AI promises and what it can actually deliver.

A couple of weeks ago, several things became concrete. In the UK, Cosine announced a coalition of institutions — BAE Systems, HSBC, Lloyds, NatWest, BT, LSEG among them — to co-design Lumen Sovereign, described as Britain's first fully sovereign frontier AI model, backed by £500 million in government funding and trained entirely on Isambard-AI, one of Europe's most powerful supercomputers. NVIDIA published an account of how the UK is deploying that sovereign compute through startups across biology, inference optimization and agentic coding. Korea and Japan are making similar moves. 

The CEO of Upstage, speaking to Bloomberg, pointed at Anthropic's recent usage restrictions as the proximate demonstration of the risk: a foreign AI provider made a policy decision that affected customers' operational capacity. That, he argued, is what sovereign AI is designed to prevent.

Dependency anxiety

The argument is sound.   The dominant frontier models in enterprise deployment today are US-headquartered — with the partial exceptions of Mistral in France and DeepSeek in China, neither of which has achieved the same breadth of enterprise adoption. The concentration isn’t a conspiracy; it’s the result of where capital, infrastructure investment and talent happened to converge first. 

But the practical implication is that organizations running critical workflows on those systems are exposed to conditions they don’t set. Pricing decisions, usage policies, export controls, infrastructure availability and political risk moves with US foreign policy rather than specific regulatory environments. The June Claude outage may have been a relatively minor incident, but it did highlight to many organizations their dependency on Anthropic already runs deep. They’ve transmitted dependency to these systems faster than they’d developed the architectural resilience to treat them as infrastructure requires being treated.

The Fable block

The week of June 13 produced a harder version of the same lesson. The Trump administration issued an export control directive requiring Anthropic to block access to Fable 5 and Mythos 5 for all non-US nationals — Anthropic's only compliance path was to shut both models globally. The dependency didn't degrade; it disappeared overnight. Dan Shipper, whose team had been near-entirely reliant on Fable for coding work, described switching to Codex within hours. Resilience architecture that hadn't been built couldn't be improvised at that moment.

Building a domestically trained, domestically hosted frontier model does address the geopolitical dependency. An institution operating on Lumen Sovereign in an air-gapped UK data center isn’t exposed to Anthropic's policy decisions or US export controls. That’s a real and valuable guarantee — particularly for defence, financial services and public sector institutions where data residency and governance assurance are essential. The Cosine coalition reads like a who's-who of exactly those institutions for exactly that reason.

The Cosine coalition is explicit about what it’s solving: vendor lock-in, data residency, air-gapped deployment, alignment with UK regulatory requirements. Those are real operational guarantees. The European Commission's Cloud and AI Development Act, proposed on June 3, is attempting something similar at legislative scale — a four-tier sovereignty framework for public-sector cloud procurement, ranging from baseline cybersecurity requirements to full EU ownership, EU-cleared personnel and zero data transfer outside the EU. 

The ambition is unambiguous. However, what neither the coalition framing nor the CADA proposal addresses directly is the problem the June outage named from a different angle: a domestically trained, domestically hosted model can still go down. Sovereignty and resilience look identical from the outside — both are responses to dependency — but they require structurally different architectures. CADA's four tiers define who owns and controls the infrastructure. None of them specify what happens when that infrastructure fails. You can satisfy every assurance level and still have a single point of failure.

Tackling the resilience problem

Fugu, from Japan's Sakana AI, attempts to tackle resilience problem rather than the sovereignty one. It's an orchestration layer that dynamically coordinates across a pool of specialized models, routing each task to the most appropriate combination. Its architecture is built explicitly around the premise that no single provider should be a point of failure, and that enterprises should be able to exclude specific models from the pool to meet data, privacy and compliance requirements. 

This isn’t sovereignty in the political sense; it doesn’t address the geopolitical concentration of frontier AI development. But it does address the operational dependency that the June outage made visible, and it does so through an architectural principle rather than a political one. The Fugu benchmark numbers, showing competitive performance with frontier models through coordination of smaller specialized systems, suggest the architectural thesis is credible. Whether it holds at enterprise scale, across regulated data environments and latency requirements, still needs to be tested.

Cognitive sovereignty

There is a third version of the problem that neither approach fully addresses, and it’s the one this publication has been circling for months. In an earlier piece on cognitive debt, the argument was that organizations may be transmitting cognitive capacity to AI systems faster than they are building the scaffolding to retrieve it. In the governance piece, the question was whether the category of problem may have changed in kind — whether the thing being governed might be reshaping the terms of the question itself before the governance framework arrives.

Sovereign AI is a response to the first observation: if we’re transmitting cognitive capacity to external systems, at least let those systems be systems we control. That’s a reasonable response. But it’s important to be precise about what ‘control’ means in this context. The sovereignty argument addresses jurisdictional control, such as questions around who owns the infrastructure, who governs the training data and which regulatory framework applies. 

It doesn’t, though, address epistemic control: whether the model's encoded understanding of the world, what it treats as settled fact, what categories it applies to novel situations, whose experience shaped its outputs and whether it actually reflects the interests of the population on whose behalf the sovereign institution is acting. 

This is a practical issue as much as it’s a political one. A bank deploying a domestically sovereign model for credit decisions is still exposed to the question of whether that model's risk categories were shaped by training data that underrepresented certain populations. A government using a sovereign model for benefits assessment still needs to ask whether its outputs can be audited and challenged by the people they affect. Ownership of the infrastructure doesn’t answer those questions. Yes, we need it, but it isn’t enough on its own.

A French-trained model isn’t automatically representative of French values any more than a US-trained one is representative of American values. The relationship between the institution that controls the infrastructure and the population whose interests that institution is supposed to serve has never been a simple one. Sovereignty as a concept has always contained this tension: self-determination for whom, decided by whom and through what process of deliberation.

A reasonable bet under significant uncertainty

Organizations investing in sovereign AI are making a reasonable bet under real uncertainty. The geopolitical dependency risk is genuine and the regulatory assurance problem in regulated industries is real. The resilience argument is valid, even if it all too often gets conflated with the sovereignty argument. 

What’s worth holding alongside all of that is the question that the concept of sovereignty has always carried and never fully resolved: whether the entity that controls the infrastructure actually represents the interests of the people whose reasoning now runs through it.  

Building sovereign AI is not the same as building AI that’s accountable to the people it serves. The word ‘sovereign’ makes that obligation harder to ignore than it previously was for the vendors who built the systems everyone is now trying to replace. A private company deploying a frontier model isn’t claiming to represent anyone; it’s selling a capability.

A sovereign AI initiative is making a different claim: that this infrastructure exists in the national interest, on behalf of a population. That claim imports a standard the infrastructure layer alone cannot satisfy. Sovereignty in its modern democratic sense doesn’t mean the state controls the technology, but instead makes the technology accountable to the people.

The question the sovereignty movement may not yet seriously be asking is what that accountability looks like in practice — who can challenge the model's outputs, through what process, with what standing. That’s not an argument against building sovereign AI, but is rather an argument that the word chosen to describe it comes with obligations the current architectural conversation may have not yet picked up. 

Clarifying the stakes

The most honest thing the sovereign AI movement has produced isn't a model or a coalition. It's a clarification of stakes. We're deciding, through these architectural choices, where the intelligence layer lives, who controls its conditions, and whose decisions govern its evolution.

This isn't, though, a substitute for the harder question of what we want the intelligence layer to do and who gets to answer that question.