Sovereign AI:
The Wrong Question

Set the bar at autarky, owning every layer end to end, and no one clears it. Not even the United States: it cannot manufacture its most advanced chips at scale, and it depends on a single Dutch company, ASML, for the extreme-ultraviolet lithography that makes them possible.¹ That dependency is precisely why export control operates as a coalition the US, the Netherlands and Japan acting together rather than as a unilateral American lever.² The only near-exception is China, which has bought down its dependence at enormous cost and a real, persistent though recently narrowing performance gap. Capability sovereignty is purchasable only by a continental superpower willing to pay for it and even then, imperfectly.

So “sovereign” cannot mean self-sufficient. For everyone else it can only mean not captured: control, resilience, and a credible exit, indexed to a named adversary and a named layer. Unindexed “sovereign” with no answer to against whom, at which layer the word is marketing.

It helps to see that AI confers three different kinds of power, and they are not interchangeable:

The United States holds the first two. China is mainly buying the first and building the second behind its wall. Almost no nation can contest either. But the third institutional power is not won by scale or capital alone. It is won substantially by credibility, and it is distributed quite differently from chips and clouds.

This is the heart of the matter, and it can be put in a single line the rest of this paper returns to: every layer of the AI stack is either something you produce or something you prove. The layers you produce capability are conceded. The layers you prove control are open. The next section colours that line in.

Score the stack layer by layer for a mid-sized advanced economy here, the United Kingdom and the gradient becomes concrete. Four verdicts, scored by what it takes to attain each in practice: near-impossible (a chokepoint held by the US–China capability duopoly and the coalition that gates it no substitute at any payable price), hard (attainable in principle, but only at a standing cost physical or operational that most organisations never sustain: routinely promised, rarely in production), partial (a decision point that resolves to red or green by your own architecture and contracts), and achievable (readily attainable at reasonable cost the controls organisations actually implement).

Stack layers

Cross-cutting inputs they apply to every layer above

Read the colours top to bottom and the shape of the problem appears: a red band you cannot own, a green band you can, and a contested middle where cost and architecture decide.

That is the thesis in ten words. The rest of the paper is its consequences.

One distinction in that table separates a strategy from a fantasy: the amber band. The amber cells pipelines and collaboration tooling, and energy are achievable in principle but only at a standing cost most organisations never carry: the scarce skills to run them, the process to keep them compliant as rules move, and the technology tax of upgrades, broken backward compatibility, parallel environments and self-maintained forks. That carrying cost not the architecture is why these stay foreign in practice; sovereign designs of this kind are common in slide decks and rare in production. Even the green cells are achievable, not maintenance-free. “Achievable” describes what is possible, not what is common and the space between those two words is the entire market.

The diagonal in that matrix is the whole argument. The red cells are capability something you produce, and concede. The green cells are control something you prove, audit, and walk away from. Between them sit the cells where real strategies are decided: the blue decision points that resolve to red or green by your own architecture and contracts (open models, cloud), and the amber band control you can genuinely own, but only by carrying a standing cost most won't, plus energy, the one input where Britain is physically rather than operationally short. The marketing blurs these bands; naming them un-blurs the strategy.

It resolves into two species of sovereignty that are routinely sold as one.

This is a division of emphasis, not a counsel to abandon capability. The two are complementary, not substitutes: capability confers leverage over the very standards that assurance trades in, and assurance in turn needs a credible domestic base real research, real talent, real test-beds to stand on. A serious nation pursues both. The argument here is only about sequence and proportion where a mid-power should concentrate scarce effort first, given that one half is winnable now and the other, for now, is not.

Capability sovereignty is what most national budgets are quietly spent on. Yet for any country outside the United States and China trying to survive a real squeeze, it remains, in every sense, entirely out of reach.

Assurance sovereignty is the half that is winnable, cheaper, faster and the half that decides what happens when something goes wrong.

And it does go wrong. The control gets exercised, against exactly those who hold capability they do not own.

The most recent instance came in June 2026, when Anthropic was directed under US export-control authority to suspend access to two of its frontier models Fable 5 and Mythos 5 for all foreign nationals worldwide. Because nationality cannot be verified at the API layer, the practical effect was an outage for those models for every customer, within hours of the directive, even as its other models stayed up. The controls were in the process of being lifted roughly three weeks later, and access being restored (as of the publication of this paper) but that reversal is the point, not a footnote to it⁵. A deployed, commercial capability was switched off and back on again on a timeline set entirely by a government on the other side of it. One episode proves little on its own; but as the latest move in the pattern below, it shows the mechanism is operational, not hypothetical and that the risk is not merely that a model vanishes, but that access to it is contingent on a policy lever the firm and its customers do not hold.

Nor was it the first reach for the lever. In January 2025, the same authority produced the Framework for AI Diffusion the first US controls ever to reach AI model weights, not just chips sorting countries into tiers drawn in Washington, with even NATO allies such as Portugal and Austria in the second tier.³ It was withdrawn days before taking effect in May 2025 but this was a reconfiguration, not a retreat. The model-weights tiering was dropped; the underlying chip-chokepoint controls remained and, in several dimensions, tightened fresh enforcement guidance, warnings against Chinese accelerators, and chip licences granted only in exchange for a revenue share on the sales.⁴ The lever was not put down. It was re-gripped.

The pattern is the point. The capability layer is a policy instrument; the switch is held elsewhere; it can be thrown at short notice with no regard for your operations. You rent the model, you rent the cloud, you rent the chips. Renting is fine until the landlord changes the locks and a worldwide eviction at an afternoon's notice is no longer hypothetical.

That is the entire case for owning the one layer you actually can: assurance.

The usual British AI conversation is defensive: we can't make the chips, we lost the frontier labs, we can't match the compute budgets. All true, and all beside the point. It measures Britain against the capability column the column nobody outside two superpowers wins.

Measured against the assurance column, the picture inverts, and not by luck. Britain's comparative advantage has never been industrial scale. It has been institutional trust.

None of this means Britain has no capability worth the name. It retains world-class universities and research groups, genuine strength in life sciences and defence AI, and in Arm a company whose designs sit at the heart of most of the world's computing without it owning a single fabrication plant. Arm is the tell: influence over a layer of the stack, secured through design and intellectual property rather than fabrication control without ownership, the very move this paper commends. So the claim is not that British capability is hopeless. It is that Britain cannot own the full capability stack, should not stake its national strategy on the parts it cannot, and holds in assurance a stronger hand it has barely begun to play.

Consider the depth of what Britain actually built on foundations of common law older still, then three centuries of industrialising trust and why its configuration matters for AI:

Why this matters for AI: these are not historical curiosities. They are, almost precisely, the institutional operating system that assurance AI runs on rules, evidence, certification, accountability, audit, and the resolution of disputes about whether a system did what it claimed. Other countries hold individual pieces. No other country has all of them, at this depth, already interoperating and already accustomed to high-stakes regulation. A nation whose oldest courts are nine centuries old and whose trust economy is three is unusually equipped for an era in which trust is the scarce input.

The contrast sharpens it. The US has the NIST AI RMF and a US Center for AI Standards and Innovation (CAISI), but these are advisory, not regulatory. The EU has the AI Act, but that is a legislative framework, not a delivery capability. Britain has the rarer combination regulatory teeth (FCA, PRA, ICO), delivery infrastructure (the audit profession, standards bodies, the courts), and the world's first government-backed AI Security Institute¹⁰ and no other jurisdiction combines all three. The FCA and the PRA, the latter the Bank of England's prudential supervisor, already run model-risk and senior-accountability regimes over the very institutions an assurance market would serve;¹¹ the ICO governs data protection.

A fair objection runs the other way: these powers are not watertight. Capability buys leverage over standards the United States shaped the internet's protocols, the dollar's plumbing and the cloud's defaults partly because it owned the platforms beneath them, and standards power often follows capability power downhill. The claim here is narrower, and survives that objection. Institutional credibility is a partially independent source of standards authority one a non-superpower can actually build, because it does not require owning the platform. Britain's standing in law, audit and standards was not downstream of technological dominance: the common law, the BSI and Lloyd's earned their authority centuries before the digital era, and export it still. Where assurance power overlaps with capability-derived leverage, Britain will be the weaker party; where it rests on institutional credibility, it competes on even or favourable terms. The strategy is to play hard where the second holds.

Tellingly, the government has already conceded the capability column in its own words: Britain, it says, need not build every model it can define the conditions under which models are trusted. That is a state quietly admitting it is playing the assurance game while the headlines talk capability. The honest move is to say so, and to play it deliberately.

Europe's instinct, broadly, has been to chase the columns it cannot win. The sovereign-cloud and shared-compute initiatives GAIA-X most visibly, alongside EuroHPC's public supercomputers were aimed at capability and economic power, and have struggled accordingly: GAIA-X in particular became a cautionary tale about pursuing infrastructure sovereignty by committee.⁸ The Netherlands is the telling exception that proves the rule ASML is the single most strategically important node in the entire global stack, but it is a chokepoint Europe happens to hold, not a capability programme Europe chose to build.

But the easy story “Europe chases chips, Britain sells trust” is wrong, and worth getting right.

Europe is, in fact, building assurance infrastructure faster than anyone. The EU AI Act is, at its core, an assurance instrument: conformity assessment, CE-style marking, notified bodies, risk classification.⁹ ENISA, NIS2 and the emerging European cybersecurity certification schemes are assurance machinery. The European Data Spaces are an attempt to govern data under European law. Europe is writing the assurance rulebook arguably the most comprehensive in the world.

Where Europe is weaker is the assurance delivery layer: the test-beds, the evidence tooling, the certification capacity, the trusted third parties who can actually execute conformity at scale and speed. A rulebook creates demand for assurance; it does not, by itself, supply it. That gap between Europe legislating assurance and Europe being able to deliver it is the larger opportunity, and the place a trust-native Britain can lead, supply, and partner rather than compete.

The strategic read for the UK is therefore not “beat Europe.” It is division of labour: the EU provides the institutional guardrails, and the UK provides the world-class, trusted testing and certification infrastructure that turns those rules into evidence.

A diagnosis without a course of action is just commentary. If the argument holds that assurance is the winnable, valuable, structurally-British half then national strategy follows directly. Six moves, and a unifying principle that makes them cheap.

The unifying move is the cheap part: none of this requires building new institutions. It requires pointing 300-year-old ones courts, auditors, standards bodies, regulators, insurers at a new object. That is a national strategy available to Britain at a fraction of the cost of a compute programme, and largely unavailable to anyone without the institutional inheritance to repurpose.

A caveat on all six. Each is a programme, not a line item any one could fill a paper, and several will need primary legislation, sustained funding, and institutional will that a diagnosis cannot supply. This paper sets the direction and the rationale; the detailed design of each move, and the harder question of whether Britain will execute rather than merely be well-placed to, is the work that follows. Structural advantage is a starting position. It is not a result.

The national argument is also a corporate one, one level down. Every regulated firm faces the identical stack and the identical concession: you will not own the chips, you did not train the model, and your “sovereign” cloud answers to a foreign court.

The first thing to retire is a comforting illusion. “Our data stays in the UK” describes storage. Data that trains a model, passes through an inference layer, or is processed by third-party tooling your code on GitHub, your decisions in Slack routinely crosses the boundary you think you drew. Few firms have full visibility of the path.

Three questions expose the gap, and most AI strategies never ask them:

What a firm can own is the same green band a nation can: visibility of its real dependencies, optionality across models and suppliers, portability designed in from the start, customer-held keys, a costed exit, and an evidence trail.

Make it concrete. A regulated financial institution deploying an AI system for credit decisions would, under an assurance architecture:

None of this is theoretical. It is deployable today, from existing components, at a fraction of the cost of building a domestic frontier model. For an organisation, exactly as for a country, sovereignty does not mean isolation. It means resilience and assurance not autarky.

Two of those deserve to be made concrete, because in AI they mean something specific. A costed exit is not the cloud-era chore of migrating virtual machines. In generative AI it means no lock-in to a vendor's proprietary prompt structures or bespoke API shape, and a system built behind a semantic abstraction layer so a frontier API can be swapped for a fine-tuned local open model in an afternoon, without rewriting the application around it. An exit that requires re-engineering the system is not an exit; it is a hostage note with a delay on it.

And owning these controls is achievable, not free the same caution that governs the nation governs the firm, only sharper. It is a standing operational cost, not a one-time architectural decision: people with scarce skills, process to stay compliant as the rules move, and the technology tax of upgrades, backward-compatibility breaks, parallel environments and self-maintained forks. Most firms quietly conclude the cost outweighs the benefit and default to the convenient foreign option which is why genuinely sovereign architectures are far more common in strategy documents than in production. The resolution is not heroics or bigger teams. It is that assurance has to be delivered as a capability, not attempted as a project: industrialised, maintained and certified by someone whose business it is, so a firm consumes assurance rather than carrying its full operational weight alone. That is the move that converts an achievable-in-principle column into an achieved-in-practice one and it is why an assurance market exists at all.

Assurance is not a posture or a policy slogan. It is a produced artifact, and it has to be manufactured decision by decision as evidence. Understanding how clarifies what the strategy and the firms above are actually buying.

The organising principle inverts the usual architecture. The model closed or open, foreign either way is treated as the least-trusted component in the system, not its centre of gravity. Everything that makes a decision trustable is built in the layers that can be controlled, around a model assumed to be fallible and replaceable. From that principle, the rest follows:

The discipline that separates this from its own marketing is a single bar: assurance must be demonstrable provable artifacts, not slideware. That bar is also the moat. It is what most “trustworthy AI” claims cannot clear, and it is exactly what serious assurance work produces.

A note on what would make this wrong

Two honest conditions sit under the argument. First, the referee's role assumes a world where standards still interoperate across blocs. If the United States and China harden into separate technological spheres with their own incompatible standards, the market for neutral assurance is smaller and more regional than this paper implies and mutual recognition with the European Union, not global reach, becomes the prize that matters most. That makes the export-frameworks move in section 7 less a nicety than the load-bearing hedge.

Second, the size of the assurance economy is genuinely uncertain. Governance layers do not always capture the value that platform owners do; assurance may prove a vast and durable sector or a necessary-but-modest compliance industry. The case here does not rest on it being enormous. It rests on it being winnable, durable, and strategically positioned the half of the stack a mid-power can actually own which holds whether the prize turns out to be large or merely significant.

Strip the matrix to its spine and the strategy fits on a single line.

The contest for capability is loud, expensive, and for everyone but two superpowers already lost. The contest for assurance is quieter, cheaper, and wide open. Confusing the two is the single most expensive mistake in national and corporate AI strategy today, because it pours resources into a race that cannot be won while neglecting the one that can.

Britain has been handed an unusual configuration of assets: a 300-year inheritance of institutions whose entire purpose is trust, on foundations of common law older still, arriving exactly as trust becomes the scarce input in the most important technology of the age. Other countries hold elements of this inheritance. None hold all of them, at this depth, already accustomed to high-stakes accountability.

The authors build production AI assurance systems for regulated financial services. Arvind Kumar was previously Global Trade CTO at Deloitte. David Maitland was VP at H2O.ai, and Srini Kulkarni was Technology Advisor to the Board of South African Revenue Services.