Compliance asks which obligations must be satisfied. Sovereignty asks how much practical control and freedom of action an organisation retains. Sound AI decisions require both perspectives, in proportion to the application.
Educational briefing · Updated August 2026Compliance concerns applicable legislation, contractual commitments, sector rules and internal controls. For AI, the answer depends on facts such as the data involved, the organisation’s role, the purpose of the system and the consequences of its output.
Sovereignty concerns the ability to understand, control, operate, change or exit the dependencies behind an AI application. It is a profile across several dimensions, not a binary label attached to a provider or deployment model.
A compliant system may still create costly or irreversible dependencies. A highly controlled system may still fail an applicable legal obligation. Neither perspective substitutes for the other.
Record its purpose, users, affected people, decisions, data, providers, infrastructure and operational owners. Regulatory and sovereignty conclusions are unreliable when these facts remain implicit.
Identify relevant data-protection, AI, sector, employment, procurement and contractual requirements. Separate binding obligations from internal preferences and risk appetite.
Assess what you can evidence and control across providers, jurisdiction, data, models, infrastructure, operations, skills and reversibility.
Compare provider-operated, managed, portable and self-operated options against the same requirements. Include model capability, cost, staffing and time to change, not sovereignty claims alone.
State the evidence, assumptions, unknowns, owners and review triggers. Reassess when the application, provider, law, data or operational dependency changes.
The appropriate configuration depends on the application’s consequences, data, obligations and operating context. A public-copy assistant may justify a capable provider-operated service and a simple exit plan. Work involving confidential files may justify stronger contractual, data-location and access controls. A high-impact decision process may need redesign, formal human oversight and a tested fallback before model selection.
Do not leave material legal, security or dependency risks unaddressed.
Do not impose cost, complexity or weaker capability without a requirement that justifies it.
Distinguish verified facts from assumptions and unknowns so the decision can be challenged.
These sources establish legal or policy context; they do not determine what applies to a particular organisation or application.
This page is educational material, not legal advice or a compliance determination. Regulatory and policy material changes over time; verify current primary sources and involve qualified legal advisers where conclusions matter.
We help you structure the current state, requirements, dependency profile, evidence gaps and practical response options so your decision can be reviewed.
Talk to us