Helena Vasquez is the chief information officer of a federal agency that handles immigration case files. A team brought her an exciting proposal: use a powerful commercial AI model to summarize case histories and cut a multi-week backlog. The demo was stunning. Then Helena asked five questions that ended the meeting. Where does the data physically go when the model processes it? Who, in what country, could be compelled to hand it over? If the vendor is acquired by a foreign firm next year, what happens to two million case files? Can a foreign government see what queries we run? And if the cloud region goes dark in a crisis, can we still operate?

Nobody had answers. The backlog was real, but so was the risk of routing sensitive national data through infrastructure Helena did not control. Her five questions are the practical form of what policy documents call sovereign AI: the principle that a nation, and the agencies serving it, must keep meaningful control over the data, the models, and the infrastructure behind AI systems that touch national interests. For agency technology leaders, sovereignty is not abstract. It is a set of architecture and procurement decisions that determine whether your most sensitive information stays under your control or quietly becomes someone else's leverage.

What Sovereign AI Actually Means

The phrase is used loosely, usually to mean that data stays in the country or that the vendor is domestic. For government purposes a more rigorous definition is required. Sovereign AI means the controlling authority retains effective control over the full stack: the physical location of compute and who can access it, the software supply chain including whether the model is open-weight or closed-weight, the training and fine-tuning data, the model weights and anything derived from them, the human operators and their clearances, and the legal regime under which any provider could be compelled to disclose or hand over any of the above.

Pure data residency addresses only one of those dimensions. A residency guarantee can be undermined by foreign-controlled compute, by a foreign-developed model, by foreign-government legal process such as demands under the CLOUD Act, or by supply-chain dependencies nobody in the procurement traced. This is the single most important discrimination a program manager makes when reading vendor proposals: a data-residency claim and a sovereignty claim are not the same claim, and vendors have every commercial incentive to let you hear the second when they have only made the first.

The concept became prominent after the 2013 Snowden disclosures raised general awareness of extraterritorial legal demands on providers, and it accelerated through the technology decoupling between the United States and China that began around 2018. What was once a specialist concern in intelligence circles is now a routine procurement question in civilian agencies, largely because AI concentrated so much sensitive processing into a handful of very large providers. Helena's five questions would have been unusual a decade ago. Today they belong on every AI acquisition touching sensitive data.

Three Layers of Control

Sovereignty is not one switch. It is control across three distinct layers, and an agency can hold it at one layer while losing it at another. Helena's job is to know exactly where she stands on each and to record the answer rather than remember it. The three layers below are ordered by how often procurement checks them, from the one almost every evaluation asks about to the one almost none do, which is roughly the reverse of how often each one turns out to be the thing that actually failed.

Data residency: where the bytes physically live

Data residency means knowing the physical location where your data is stored and, crucially, where it is processed. Storing case files in a domestic data center while sending them to a model that processes them overseas breaks residency at the moment that matters most. Many commercial AI services route requests to whichever data center is cheapest or fastest, which can mean another continent, and that routing behavior is often invisible from the customer side. Helena's first requirement is that every byte of case data is stored and processed within national borders, contractually guaranteed and technically verifiable.

Jurisdictional control: whose laws can reach your data

This is the layer most leaders miss. Data can sit in a domestic data center and still be subject to foreign legal reach if the company operating it is headquartered abroad. A foreign-owned provider may be legally compelled by its home government to disclose data regardless of where the servers sit. Residency answers the question of where the data is; jurisdiction answers the question of who can lawfully demand it. For national-security-relevant data both must point home, which is why agencies increasingly require providers to be domestically owned and operated rather than merely domestically hosted.

Operational control: can you run without the vendor

The third layer is whether you can keep operating if the vendor changes terms, is acquired, raises prices sharply, or simply fails. If an entire capability depends on one foreign-controlled service with no exit, a sovereign function has been outsourced. Helena's version of the question is blunt: if this vendor disappeared tomorrow, could we still process cases? If the honest answer is no, the dependency itself is a national security exposure, independent of whether any data ever leaves the country. Residency asks where your data sits, jurisdiction asks who can lawfully seize it, and operational control asks whether you survive without the vendor. Most procurement checks only the first.

Model Control: The New Dimension

AI adds a layer that traditional data security never had to consider, which is control over the model itself. A foundation model is the large, general-purpose system that powers tools like commercial chat assistants, and your control over it depends entirely on how you consume it. The three consumption patterns below sit on a ladder, and each rung trades capability against control in a direction you should choose deliberately rather than inherit from whatever the vendor demonstrated.

• Public API, lowest control. You send data over the internet to the vendor's model. You have little visibility into where it runs, whether your data trains future models, or who can see your queries. Rarely acceptable for sensitive government data.
• Dedicated or government cloud instance, medium control. The model runs in an isolated environment accredited for government use, typically inside a domestic government cloud region. This is where the federal authorization programs described below become the baseline screen.
• Self-hosted open-weight model, highest control. You run a model whose weights are published on infrastructure you operate. You own the data path. You also own the cost, the maintenance, the safety work, and a capability gap against the largest commercial models.

Open-weight models are the route to genuine sovereignty for the most sensitive work, and it is worth being precise about why. They allow deployment into environments with no external connectivity at all, fine-tuning without exposing your data or your derived model to a vendor, independence from that vendor's survival and pricing, and a level of behavioral verifiability that a remote API cannot offer. Closed-weight commercial models generally cannot be deployed this way, which is a real capability limitation rather than a preference, and it is the constraint that most often decides the architecture.

The disadvantages are equally real. Open-weight capability typically trails the leading closed models, the operational burden of hosting, patching, and updating falls entirely on you, and responsibility for safety and alignment work comes with it. Licensing is not automatic either: several widely used open-weight releases carry acceptable-use terms or license conditions that constrain government deployment, and models of foreign origin raise the same country-of-origin questions the rest of this lesson applies to vendors. Read the license before the architecture depends on it.

The Authorization Landscape

Sovereignty in the United States federal context is expressed through a stack of authorization regimes, and knowing which one governs your data is the first procurement question rather than the last. The Federal Risk and Authorization Management Program, FedRAMP, was established in 2011 by OMB memorandum and modernized by the FedRAMP Authorization Act enacted in 2022 as part of that year's National Defense Authorization Act. It provides a standardized approach to security assessment and continuous monitoring for cloud products used by federal agencies, with Low, Moderate, and High baselines and a Tailored baseline that has since been sunset.

The source for this lesson states the following, and each statement errs toward the strict reading. FedRAMP High is required for systems whose compromise could cause severe or catastrophic adverse effects, and many federal AI services now seek it. The Department of Defense uses Impact Levels under its Cloud Computing Security Requirements Guide: IL2 for publicly releasable data, IL4 for controlled unclassified information, IL5 for CUI with heightened protection together with mission-critical data, and IL6 for classified information up to Secret, with IL6 requiring accreditation for the classified network environment. The Intelligence Community uses Intelligence Community Directive 503 with categorization up to Top Secret and sensitive compartmented information. StateRAMP provides an analogous framework for state governments, and NIST Special Publication 800-53 Revision 5 supplies the underlying control catalog beneath all of them.

Carry those statements strictly and verify them specifically. Federal AI procurement must specify the required authorization level, and attempting to run IL4 data on an IL2 service is a compliance violation. What this lesson cannot do is tell you which level your particular data requires. That determination belongs to your authorizing official and your system owner, it depends on a categorization decision made against your own system, and it is the one input in this entire lesson you should never take from a training document. Ask them before the requirements document is written, not after a vendor has been selected.

Sovereign Cloud Environments and Air-Gapped Enclaves

The major hyperscale providers operate government-specific cloud environments isolated from their commercial regions, with United States person operator requirements, separate access management, and additional contractual and operational controls. Several also operate regions accredited for classified workloads. Rather than relying on any published list of which provider holds which accreditation, confirm current authorization status for each candidate environment against the authoritative government listings, because accreditations, region names, and service availability inside those regions change on their own schedule and a lesson is a poor place to learn them from.

Running AI in those environments typically requires several things at once: model selection restricted to what has been approved for that environment, data-plane isolation, audit and logging that satisfies the applicable FISMA and impact-level requirements, and key management under agency control, often using cryptographic modules validated under the FIPS 140 series. For classified workloads, add operator clearance, physical security, and cross-domain solutions for any movement of data between classification levels. The practical constraint that surprises programs most often is that not every commercially available model is offered in every accredited environment, which narrows capability choices and should therefore be settled early in procurement rather than discovered during implementation.

For the most sensitive workloads, sovereign AI may require air-gapped or on-premises deployment: intelligence analytic systems, military command-and-control applications, and critical-infrastructure control systems where external network connectivity is unacceptable. This is where the open-weight constraint bites hardest, since open-weight models can be deployed into an air-gapped enclave and closed-weight proprietary models generally cannot. Cross-domain solutions permit limited transfer between classification levels under National Security Agency requirements, and any such movement is a formal, engineered process rather than an administrative one.

Air-gapped operation reshapes the whole delivery model. The workforce requires clearances and, for classified work, physical presence in accredited spaces. Development requires offline build pipelines, an offline model registry, and disciplined change management, because the ordinary practice of pulling a dependency from the public internet is simply unavailable. Cost is substantially higher than cloud-based sovereign environments. None of this is an argument against air-gapped deployment where the data demands it. It is an argument for costing it honestly at the point where the sensitivity tier is assigned.

Export Controls, Foreign Ownership, and the Supply Chain

Sovereignty runs outward as well as inward. United States export controls on advanced computing tightened progressively through a Bureau of Industry and Security interim final rule in October 2022 restricting advanced computing chips and semiconductor manufacturing equipment to China, further rules in October 2023 that closed loopholes and expanded entity listings, and a January 2025 interim final rule on AI diffusion that attempted to create country tiers for access to advanced models and chips before subsequent policy evolution modified the approach. Treat all of that as history rather than as the current rule text, and confirm what applies today with your export-control officer before relying on any of it.

Several other instruments sit alongside those rules. The Entity List, maintained by the Bureau of Industry and Security, identifies organizations to which export requires a license that is presumptively denied, with additions including Huawei in 2019 along with other Chinese semiconductor, AI, and surveillance firms. Military end user and military end use rules restrict items destined for military applications. The foreign direct product rule extends reach to items manufactured abroad using United States technology. The Department of State administers the International Traffic in Arms Regulations for defense articles, and the Treasury Department's Office of Foreign Assets Control administers sanctions. The Export Administration Regulations themselves sit at 15 CFR parts 730 through 774.

Export controls matter to federal AI programs in four concrete ways. Controlled AI capability cannot be exported even to allied partners without licensing. Vendors' ability to use their own global supply chains is constrained, which shows up as delivery risk in your schedule. Foreign participation in federal AI development requires screening. And global providers must segment their offerings to stay compliant, which is part of why the model catalog inside a government cloud region differs from the commercial one. Do not extend any country list you find in a training document; the lists move, and applying yesterday's list is its own compliance failure.

Foreign ownership is the other half of this problem. The Committee on Foreign Investment in the United States, chaired by Treasury, reviews foreign acquisitions of United States businesses for national security implications. The Foreign Investment Risk Review Modernization Act of 2018 expanded that authority to cover non-controlling investments in businesses involved with critical technology, critical infrastructure, and sensitive personal data, with a separate rule covering real estate near sensitive federal properties. Some transactions require a mandatory filing rather than a voluntary one, and the specific triggers are regulatory detail your counsel should confirm rather than something to memorize from a lesson.

The precedents are instructive because they show the committee ordering divestiture over data rather than over hardware. In 2019 the Chinese owner of a dating application was required to divest it, and in the same year the Chinese investor in a patient health platform was likewise required to divest. Both cases turned on foreign access to sensitive personal data about Americans, which is precisely the category most AI training corpora fall into. For federal AI programs, foreign ownership review becomes live when acquiring services from vendors with foreign ownership, control, or influence, when reviewing teaming arrangements that include foreign subcontractors, when licensing model weights to foreign partners, and when structuring partnerships with foreign co-investors. Discovering foreign ownership late, after a vendor has been selected, is one of the more expensive failures in this discipline.

The National Security Policy Layer

Above the technical regimes sits a policy layer that shapes what agencies may build. A National Security Memorandum on artificial intelligence issued in 2024 became the principal policy instrument for national security AI, directing agencies to accelerate safe deployment of AI for national security missions, establish risk management practices for intelligence and defense applications, protect United States technological advantages through export controls and industrial policy, and coordinate with allies. It complemented Executive Order 14110, which set broad federal AI direction during the period it was in force and should be read historically rather than as current requirements, and it works alongside the national security systems carveout in OMB Memorandum M-24-10 on advancing governance, innovation, and risk management for federal agency use of artificial intelligence.

Two details are worth carrying. First, coordination for national security AI runs through a group chaired at National Security Advisor level, which tells you the escalation path for genuinely novel questions. Second, the framework for high-impact AI that could materially advance adversary capability included reporting obligations on frontier model development that began under Executive Order 14110 using Defense Production Act authority. Programs outside national security systems still touch this layer through supply-chain screening, export-control obligations, and workforce clearance requirements, so it is not safe to assume the whole area is somebody else's problem.

The defense and intelligence communities layer their own instruments on top. The Intelligence Community published AI ethics principles in 2020 and operates its own risk management process. The Department of Defense maintains a responsible AI strategy and implementation pathway, test and evaluation direction, and Directive 3000.09 governing autonomy in weapon systems. If your program sits inside or alongside those communities, those documents govern the specifics and this lesson does not. Note also that named policy bodies in this space are created, renamed, and disbanded with some regularity, so confirm that any organization you plan to cite still exists under the name you know it by.

Workforce, Clearances, and the Talent Constraint

Sovereign AI is a staffing problem as much as an architecture problem, and it is the constraint most often left out of the schedule. Sovereign deployments frequently require United States citizens, permanent residents, or appropriately cleared personnel. Systems governed by the International Traffic in Arms Regulations require United States persons for access. Classified systems require clearances at the appropriate level, administered under Intelligence Community Directive 704 and the Security Executive Agent directives, with personnel security programs run through the Office of Personnel Management and the Defense Counterintelligence and Security Agency, including the Trusted Workforce initiative and continuous evaluation practices.

The planning consequence is arithmetic. The source gives a clearance processing time often running from six to eighteen months, against a talent pool far smaller than the general commercial AI market. A program that assumes commercial hiring velocity for cleared roles will slip, and it will slip at the point where the schedule has no slack left. Mechanisms exist to help: the Intergovernmental Personnel Act allows cleared researchers from academia to join federal work, and direct-hire authorities including component-specific ones such as the defense cyber excepted service accelerate hiring. None of them shortens an investigation that has already started.

Contractor access carries the same requirements. Vendor personnel working on government AI systems may require access credentials, clearances, or both, and prime contracts typically flow these requirements down to subcontractors. Foreign national access even to unclassified work may require a technology control plan under export-control rules. The practical instruction is to identify which roles require what access before the solicitation is written, because a requirement discovered after award is a modification, a delay, and occasionally a protest.

Allied Interoperability

Sovereignty is not isolation, and designing as though it were produces systems that cannot work with the partners the mission depends on. The United States coordinates with allies through Five Eyes intelligence sharing among the United States, United Kingdom, Canada, Australia, and New Zealand; through NATO on defense technology; through the AUKUS arrangement with Australia and the United Kingdom, whose second pillar covers advanced capabilities including artificial intelligence, autonomy, cyber, hypersonics, and quantum; and through multilateral policy work including the G7 process launched in 2023 and the OECD AI Principles. Congress passed tailored export-control provisions in a fiscal year 2024 defense authorization act to support the AUKUS work.

An international network of AI safety institutes launched in 2024 to coordinate technical safety evaluation across participating countries. Confirm the current membership and, importantly, the current name of the United States participant before citing it in any document, because that body has been renamed since the network launched and citing a defunct name in a policy paper undermines everything around it. The general lesson holds beyond this one example: in a fast-moving policy area, the half-life of an institution's name is shorter than the half-life of a program plan.

Interoperability across allied systems requires compatible classification markings, cross-domain access agreements, and joint development frameworks. All three are far cheaper to design in at the start than to retrofit after a system is accredited, because retrofitting means reopening an accreditation. If your program has any prospect of allied participation, put the requirement in the architecture now even if the partner is not yet named.

A Sovereign AI Risk Register

Helena's five questions become a reusable register that a team completes before any AI procurement touching sensitive data. Every row needs a named owner and a documented answer. A verbal assurance from a vendor account team is not an answer, and the discipline of writing the answer down is what converts a sovereignty conversation into a sovereignty decision that survives staff turnover.

The Honest Trade-Off

Sovereignty has a cost, and pretending otherwise leads to bad decisions. The most capable commercial models are usually the ones with the weakest sovereignty profile. The models you can fully control are often a step behind in raw capability and require your own people to run them. Helena's job is not to maximize sovereignty at all costs. It is to match the level of control to the sensitivity of the data, and to be able to explain that match to an inspector general.

Her resolution was tiered. Highly sensitive case content goes to a self-hosted open-weight model behind the agency boundary, accepting somewhat lower summarization quality in exchange for control of the entire data path. Lower-sensitivity administrative text, such as internal scheduling notes and public-facing question and answer content, runs on an accredited dedicated instance where the stakes justify trading some control for capability. That tiering let her start reducing the backlog within a quarter without routing a single case file through infrastructure she did not control.

Two cautions attach to that resolution. Self-hosting gives you the data path, not the whole stack: the model's origin, its training data, the open-source components around it, and any third-party service in the pipeline remain part of your sovereignty posture and belong on the register. And a tier assignment is a decision with a date on it, not a permanent property of the data. Revisit it when the mission changes, when the data changes, or when the vendor changes hands, which is the event most likely to invalidate an assessment nobody has looked at in two years.

Anti-Patterns

Residency theater

The vendor states that data stays in the country, the statement is true, and the sovereignty claim is still false because operator access, foreign legal process, or the supply chain undermines it. This is the single most common failure in the discipline, and it usually survives procurement because the residency claim is the one thing the evaluation team knew to ask about. The fix is structural: evaluate residency, jurisdiction, and operational control as three separate findings with three separate owners, and never let a strong answer on one stand in for the other two.

Treating a boundary or a clause as a guarantee

A network boundary, a domestic region, or a contract clause prohibiting data reuse reduces exposure. None of them guarantees that no foreign party can reach your data, and describing them that way to an executive is how an agency ends up with no contingency plan. Clauses are enforced after the fact, in a forum, against a counterparty who may be subject to another country's compulsory process. Write the protection down, then plan for the case where it fails, and say plainly in the business case which protections are preventive and which are only remedial.

Assuming self-hosting closes the question

Running an open-weight model on your own infrastructure gives you the data path, which is a great deal. It does not give you provenance of the weights, provenance of the training data, control of the open-source components in the serving stack, or assurance about any third-party service in the pipeline. Hidden foreign dependencies, undisclosed by the prime contractor and unnoticed in the architecture review, are a documented failure pattern. Enumerate the supply chain explicitly, including subcontractors and open-source components, and treat the enumeration as a deliverable.

Discovering ownership, export, or clearance constraints late

Three constraints reliably arrive after they can be absorbed cheaply: a foreign ownership issue in the vendor or a subcontractor surfacing at award, an export-control problem discovered during international collaboration, and clearance processing that was never in the schedule. Each of these is knowable at the requirements stage and painful at every stage after it. Screen ownership before selection, route any international element past your export-control officer before work begins, and put clearance lead time in the baseline schedule rather than in the risk register.

Classifying by reflex in either direction

Overclassification quietly destroys operational utility: the data becomes unusable by the people who need it, the accredited environment supports fewer models, the cost multiplies, and users route around the whole system. Underclassification exposes information that should have been protected. Both are failures of the same discipline, which is deliberate categorization by the accountable official against the actual data. The tell for the first is a program where everything is at the highest tier because nobody wanted to sign for a lower one.

Planning sovereign procurement on a commercial clock

Sovereign procurement cycles run longer than commercial ones, and sovereign environments lag commercial capability by a margin that changes constantly and never reaches zero. A program that plans against commercial timelines and commercial model availability will miss its fiscal-year obligation window and will also promise a capability the accredited environment does not offer. Plan for the lag explicitly, check model availability in the target environment before committing to an approach, and align the schedule with the appropriation cycle rather than with the vendor's roadmap.

Practice Prompts

Work these against a real system in your own portfolio rather than a hypothetical one, and involve your general counsel, your security lead, and your authorizing official from the start. Anything you produce here is an input to their decisions rather than a substitute for them, and the output should be short enough to attach to an acquisition package. Where an exercise asks you to record an answer, record it in the system's own documentation rather than in correspondence, because the point of the exercise is to survive the departure of the person who did it.

1. Take one AI system or proposal that touches sensitive data and complete the full risk register from this lesson, including the supply chain, ownership, authorization, and workforce rows. Mark every row where your current answer is a verbal assurance rather than a document, and treat that set as your actual risk list.
2. Ask your authorizing official, in writing, what authorization level the data in that system requires, and what would change if the data set expanded to include a category you are considering adding. Record the answer in the system's documentation rather than in an email thread.
3. Trace the supply chain of one deployed AI capability end to end: the model and its origin, the hosting environment, the open-source components in the serving stack, every third-party service the pipeline calls, and every subcontractor. Identify which elements you cannot currently attribute to a country of origin.
4. Write the exit plan for your most important AI vendor dependency. Specify what you would do in the first week, the first month, and the first quarter after the vendor withdrew the service, and identify the point at which mission delivery would actually stop.
5. Build a two-tier or three-tier data sensitivity map for one program, assign each tier to a consumption pattern from public API through accredited instance to self-hosted open-weight model, and write the one-sentence justification for each assignment that you would give an inspector general.

Reflection

Think about the AI capability your agency uses today, including the features that arrived inside software bought for another purpose. For how many of them could you answer Helena's five questions right now, from a document rather than from memory? The gap between the systems you could answer for and the systems you actually run is the real state of your sovereignty posture, and it is usually wider than the governance documentation suggests.

Then consider the trade-off from the mission side rather than the security side. Somewhere in your organization there is a backlog like Helena's, with real people waiting on it, and a control decision that makes it move more slowly. Sovereignty work loses credibility when it refuses that trade-off rather than pricing it. What would it take for you to be able to say, with evidence, exactly how much capability a given control costs and exactly what exposure it removes?

Glossary

• Sovereign AI. Effective control by the responsible authority over the full AI stack: compute location and access, software supply chain, training and fine-tuning data, model weights and derivatives, operators, and the legal regime governing compelled disclosure.
• Data residency. A requirement that data be stored, and in the version that matters, processed, within a specified geography. One dimension of sovereignty rather than the whole of it.
• Jurisdictional reach. The ability of a government to compel a provider under its legal authority to disclose data, regardless of where the data physically sits.
• Open-weight model. A model whose parameters are published, allowing deployment on infrastructure you control, including environments with no external connectivity. Contrast with closed-weight models available only through a vendor service.
• Air-gapped enclave. An environment with no connection to external networks, used for the most sensitive workloads, requiring offline build and deployment processes and cleared personnel.
• Cross-domain solution. An accredited mechanism for moving data between systems at different classification levels, subject to national security agency requirements. A formal engineered control, never an administrative step.
• Foreign ownership, control, or influence. The condition in which a foreign person or entity holds ownership or influence over a contractor sufficient to raise national security concern, triggering review and potentially mitigation agreements.
• Residency theater. A truthful in-country data storage claim presented as, or mistaken for, a sovereignty guarantee that operator access, legal process, or the supply chain does not support.

Related Lessons

• AI in Defense and National Security covers the mission side of national security AI that this lesson approaches from the infrastructure and procurement side.
• AI Supply Chain Security: End-to-End goes deeper into tracing model, data, component, and subcontractor provenance across the full stack.
• Multi-Cloud, Multi-Model Strategy addresses the architectural consequences of avoiding single-vendor dependency, which is the operational control layer in practice.
• AI Infrastructure Cost Optimization takes up the cost side of sovereign deployment, which is where air-gapped and self-hosted choices are paid for.
• International AI Governance covers the multilateral policy environment that allied interoperability sits inside.

Closing

The instruments in this lesson will change. Authorization baselines are revised, export control rules are rewritten, policy memoranda are superseded, institutions are renamed, and the model that was unavailable in an accredited environment last quarter may be available next quarter. Nothing here should be treated as a current compliance reference, and everything specific should be confirmed with the officials who own it: your authorizing official for categorization and authorization level, your general counsel for jurisdiction and ownership, and your export-control officer for anything crossing a border.

What does not change is the structure of the questions. Where is the data stored and processed, who can lawfully compel its disclosure, how do we consume the model, is our data reused, can we survive without this vendor, who can see our queries, what is in the supply chain, who owns the vendor, what level does this data require, and who needs a clearance. Helena's meeting ended because nobody could answer five of those. The discipline of sovereign AI leadership is neither refusing the technology nor surrendering to it, but classifying your data, matching each tier to the right level of control, and writing the answers down before the demo dazzles you into skipping the questions.

Key Takeaways

• Sovereignty is a full-stack property, not a storage location. It covers compute location and access, software supply chain, training and fine-tuning data, model weights and derivatives, operators and their clearances, and the legal regime governing compelled disclosure.
• Residency, jurisdiction, and operational control are three separate findings. Domestic hosting does not prevent a foreign-owned provider from being compelled by its home government, and neither answers whether you could operate if the vendor disappeared.
• How you consume the model sets your control. Public APIs give the least, accredited government instances more, self-hosted open-weight models the most, and each rung trades capability for control in a direction you should choose deliberately.
• Authorization level is your authorizing official's call, never a training document's. The source states FedRAMP High for severe or catastrophic impact, IL4 for CUI, IL5 for CUI with heightened protection plus mission-critical data, IL6 for classified up to Secret, and that running IL4 data on an IL2 service is a violation. Confirm your own requirement in writing.
• Self-hosting closes the data path, not the supply chain. Model provenance, training data, open-source components, and third-party services remain live sovereignty questions, and hidden foreign dependencies undisclosed by a prime contractor are a documented failure pattern.
• Export control and foreign ownership are requirements-stage questions. Screen vendor and subcontractor ownership before selection, route anything international past your export-control officer first, and never extend a country list you found in a document.
• Clearances are a schedule input. With processing often running six to eighteen months against a small talent pool, a program that plans cleared roles on commercial hiring timelines has already slipped.
• Sovereignty is not isolation. Allied interoperability through Five Eyes, NATO, and AUKUS arrangements requires compatible markings, access agreements, and joint frameworks designed in from the start, because retrofitting means reopening an accreditation.
• Tier the data, then match the control, then revisit it. A tier assignment has a date on it and should be reviewed when the mission, the data, or the vendor's ownership changes.

Frequently Asked Questions

Is data residency enough for sensitive government data?

No, and treating it as sufficient is the most common error in this area. Residency tells you where the bytes sit and, if the contract is written carefully, where they are processed. It tells you nothing about whether the operating company can be compelled by another government to disclose them, whether the model or the components around it originate abroad, or whether you could keep operating without that vendor. Evaluate all three layers as separate findings and require a document for each.

Which authorization level does our AI system need?

That question has exactly one correct destination, which is your authorizing official, working from the categorization of your specific system. The regimes described here, FedRAMP baselines for civilian federal use, Department of Defense Impact Levels, Intelligence Community Directive 503 for the intelligence community, and StateRAMP for states, define the ladder. Where your system sits on it depends on the data and the consequence of compromise, and getting that answer in writing early is cheaper than discovering it during an authorization review.

Should we always choose a self-hosted open-weight model?

Only where the sensitivity justifies the cost. Self-hosting gives the strongest control over the data path and enables air-gapped operation that closed-weight models generally cannot support. It also transfers the hosting, patching, safety, and alignment burden to you, typically at a capability level below the leading commercial models, and it does not by itself resolve provenance of the weights or of the components around them. Tier the data and match the control, rather than adopting one answer for everything.

Can a contract clause guarantee our data is never used for training?

A clause creates an enforceable obligation and it is worth having, but it is a remedy rather than a barrier. It is enforced after a breach, in a forum, against a counterparty that may itself be subject to another jurisdiction's compulsory process. Treat contractual protections as one control among several, pair them with technical isolation and with a documented exit plan, and be explicit with executives about which of your protections prevent a problem and which only compensate for one.

How do we handle a vendor that is acquired by a foreign firm mid-contract?

Plan for it before it happens, because it is the event most likely to invalidate an assessment nobody has revisited. Foreign investment review may reach the transaction, and mitigation or divestiture can be required, but that process runs on its own timeline and not yours. Your protections are an exit plan you have actually tested, contract terms that address change of control, ownership screening that covers subcontractors as well as the prime, and a scheduled review of tier assignments so a change of ownership triggers a fresh look rather than passing unnoticed.

Does sovereignty mean we cannot work with allies?

No. It means allied work has to be designed in rather than retrofitted. Compatible classification markings, cross-domain access agreements, and joint development frameworks all have to exist before systems can interoperate, and adding them after accreditation means reopening the accreditation. Separately, export control still applies between allies: transferring controlled capability abroad requires licensing regardless of the relationship, which is why any international element belongs in front of your export-control officer before work starts rather than after.