What Is Sovereign AI? A UK Definition

“Sovereign AI” now appears in the marketing of almost every vendor selling to UK regulated organisations. It gets used for everything from an air-gapped deployment on hardware the customer owns to a hosted API whose parent company has signed a document promising to be careful.

That range makes the term close to useless in a procurement conversation. The underlying concern is real, though, and it is getting sharper. If you are buying, you need a way to test the claim. If you are building, you need to know which tier your workload needs, because the cost between tiers differs by a large multiple.

This is the definition we use with clients, and the questions we use to test a vendor’s version of it.

The short version

Sovereign AI is a claim you can test. An AI system is sovereign to the extent that you can answer four questions with evidence: where data is processed, who can compel access to it, what is retained, and whether you can leave.
Residency is not sovereignty. It answers one of the four questions.
There are three tiers: self-hosted, private UK deployment and contracted hosted. Match each use case to a tier by the highest data classification it will touch in production.
The UK has no AI statute, so you reason about your use and document it. UK organisations serving EU users also remain in scope of the EU AI Act.

A working definition

An AI system is sovereign to the extent that the organisation accountable for the data can answer four questions with evidence:

Where is the data processed? Which physical jurisdiction do the accelerators sit in during inference, including any fallback capacity used when the primary region is full? Where the company is headquartered does not answer this. Neither does the region name on the marketing page.
Who can compel access to it? Which legal regimes reach the operator? A UK region run by a US-parented company is reachable under the US CLOUD Act wherever the disk is.
What is retained, and for how long? Prompts, outputs, embeddings and logs are four separate retention questions. Vendors routinely answer only the first.
Can you leave? If the terms change or the price triples, what does the exit look like, and how much of what you built comes with you?

Only the first question is about geography. Data residency is a component of sovereignty. It is not a synonym for it. A vendor that answers question one confidently and deflects on two to four is selling residency and calling it sovereignty.

The three tiers

Tier 1: Self-hosted

Open-weight models on hardware you own or rent exclusively, inside your own network. Nothing crosses the perimeter.

This is the only tier that answers all four questions without qualification. It is also the most expensive and the most demanding to run. You are now responsible for GPU capacity planning, model updates, inference optimisation and uptime.

The common mistake here is assuming self-hosting means running the largest available model. For most document work, a well-configured mid-size open-weight model on a modest GPU footprint is close enough to a frontier model. The difference rarely survives contact with your real accuracy requirement. That covers retrieval, classification, extraction, summarisation and drafting against a house style. Test that on your own data before you buy hardware, and test it before you conclude self-hosting is unaffordable.

Self-hosting the model does not contain an agent that can call tools. If you run agents on this tier, give them their own boundary. Our guide to NVIDIA OpenShell and Sentry on DGX and HGX covers how.

Suits: identifiable patient data, privileged legal material, unpublished market-sensitive information, anything where a breach would be existential.

Tier 2: Private UK deployment

Dedicated model instances in a UK region of a cloud platform on which you hold the contract, isolated from shared inference pools.

This is where most regulated production workloads belong. You get in-country processing and contractual control without owning accelerators. What you do not get is immunity from the legal reach of the operator’s parent jurisdiction. That matters for some organisations and does not for others. Deciding which you are is a legal question, and it should be answered in writing.

Suits: most regulated workloads, where the binding constraint is residency, retention and isolation and physical possession is not required.

Tier 3: Contracted hosted

A frontier model accessed over an API, under enterprise terms that specify zero retention, no training on your inputs, and a defined processing region.

There is nothing wrong with this tier. For public information, marketing copy, internal drafting and code assistance on non-sensitive repositories it is the right engineering answer, and refusing it on principle costs capability for no reduction in risk.

What makes it defensible is the classification work behind it. You have decided, in writing, which data classes may reach it, and you have a control that enforces that boundary.

Suits: low-classification workloads, where frontier capability is worth a well-understood and bounded exposure.

The test that separates the tiers

Ask this: if this vendor were served a lawful order tomorrow by a government other than ours, what could they hand over?

Tier 1: nothing, because they do not hold it.
Tier 2: whatever is in the region, subject to the operator’s jurisdictional exposure.
Tier 3: whatever the retention terms permit them to still be holding.

That one question does more work in an information governance meeting than any amount of architecture diagramming. It moves the discussion from trust to capability. Whether a vendor would is beside the point. The question is whether they could.

Where the UK position differs

Two things make the UK context different from the EU conversation.

There is no single UK AI statute. As of September 2026 the UK has no cross-economy AI law. Obligations arrive through existing regulators applying existing law: the ICO on data protection, the FCA on model risk and consumer outcomes, the MHRA where a model is a medical device. This is often described as lighter touch. In practice it is harder to satisfy, because there is no checklist that discharges your duty. You have to reason about your specific use and document the reasoning. Our guide to UK AI regulation in 2026 sets out what binds you.

UK organisations serving EU users remain in scope of the EU AI Act wherever they are established. Sovereignty from the EU is not available as a compliance strategy if your outputs affect people in the EU. See the EU AI Act for UK organisations.

So a UK organisation often needs to satisfy a UK regulator’s principles-based expectations and a specific EU regime with one architecture. That is achievable, but only if the evidence requirement is designed in from the start.

What to do first

Before any deployment decision, do the classification work. Take your top ten candidate AI use cases and, for each, write down the highest data classification that will touch the system in production. Not in the pilot.

That one table usually collapses the decision. Most organisations find that two or three use cases require Tier 1 and a handful sit comfortably in Tier 2. The rest were never sensitive enough to justify the debate that had been holding them up for six months.

The expensive failure is applying one tier to everything. Either you pay for air-gapped infrastructure to summarise public documents, or you discover at the assurance gate that the thing piloted on synthetic data cannot go live on real records.

Frequently asked questions

What is sovereign AI?

AI that an organisation can run and control on its own terms. In practice, you can show where data is processed, who can compel access to it, what is retained, and how you would leave.

Is data residency the same as sovereign AI?

No. Residency answers where data is processed. Sovereignty also covers who can compel access, what is retained and whether you can exit. A UK region run by a US-parented operator meets residency but not the second question.

Does using a UK cloud region make AI sovereign?

Not by itself. You get in-country processing and contractual control, but the operator’s parent jurisdiction can still reach the data. Whether that matters is a legal question to answer in writing, workload by workload.

Can you use hosted frontier models and still be sovereign?

For low-classification data, yes, if you have decided in writing which data classes may reach the model and a control enforces that boundary. For sensitive material, use a private or self-hosted tier.

Our AI readiness assessment produces this classification table, with a costed deployment recommendation per use case. If you already know which tier you need, private and self-hosted deployment is where we build it. To weigh the tiers on cost, read self-hosted or hosted LLMs.

Sovereign AI: what it means in a UK context