What sovereign AI actually requires

Sovereign AI is often presented as a single promise. In practice it is several distinct controls, and each answers a different question. A managing partner benefits from knowing which question each one answers before a design is agreed.

Six terms that are not the same

On-premises means the hardware sits in premises you control. It says nothing about what the machines connect to.

Network-isolated means the system has no route to the public internet or other untrusted networks. It may still reach selected internal systems through controlled paths.

Air-gapped describes an enclave with no network connection to external or untrusted networks. Devices inside the enclave can share their own internal network. Data enters and leaves only through deliberate, controlled transfer. A separate VLAN on a shared switch is logical segmentation, not an air gap: the traffic still crosses equipment that also serves other networks.

Data residency is where data is stored and processed. It is a fact about geography.

Operational sovereignty is who holds the keys, the administrator accounts and the ability to change the system. A server in Monaco administered through standing remote access from elsewhere has residency without full operational sovereignty.

Legal jurisdiction is which courts can compel the people who hold the data. It follows people and companies, not racks.

These properties combine in many ways. A clear design states which ones it delivers and which it does not.

Where the CLOUD Act fits

The U.S. CLOUD Act is sometimes described as reaching any data, anywhere. The Department of Justice frames it more narrowly. Its CLOUD Act FAQ states that providers subject to U.S. jurisdiction must disclose responsive data in their possession or control regardless of where it is stored. It adds that U.S. jurisdiction is not limited to U.S.-headquartered companies, and that control over a subsidiary’s data is a fact-dependent inquiry.

Two points follow. First, storing data in Europe does not by itself remove it from reach if the provider falls under U.S. jurisdiction. Second, the Act concerns communications and remote computing providers. The same FAQ notes that DOJ policy prefers to seek enterprise data from the enterprise itself where practical. When a firm runs a system itself, no third-party provider sits in that chain. The firm still answers to lawful process where it operates. Architecture shapes who holds data; it does not place data above the law.

The FAQ also describes the Act as encryption neutral: it creates no new power to compel decryption, and it does not forbid assistance. Who holds the keys remains a material question.

This section is general information, not legal advice. Specific structures deserve review by counsel.

Residency and cross-border traffic

Large providers document their exceptions with care. Microsoft’s EU Data Boundary documentation states that its commitments are subject to limited circumstances in which data continues to be transferred outside the boundary. Cloudflare’s Data Localization Suite is an enterprise add-on that controls where keys, metadata and TLS processing sit, while traffic still runs on a global network. Hosting location is one input. It does not by itself rule out every cross-border flow.

The same distinction applies to our own public website. It is a marketing site hosted on Cloudflare’s global network. It is not air-gapped and makes no regional hosting claim. The isolated environments we propose for clients are separate deployments, each with its own documented boundary.

A practical threat model

Start with who might act against the firm and what they would want. For a family office or a private legal practice, the relevant scenarios are often ordinary. A partner’s credentials are phished. A laptop goes missing. Ransomware reaches a file share. A support channel stays open longer than planned. A colleague can see files outside their mandate.

A local model addresses some of these and not others. It keeps prompts and documents off third-party inference services. It does not repair a stolen password or a misconfigured permission. ANSSI’s security recommendations for generative AI systems treat the AI system as part of the wider information system. The guide recommends separate environments, administration from dedicated workstations, and logging of what the system does. A local model inherits the strengths and the weaknesses of the environment around it.

An air gap is a practice

Removing the external connection is the first step. NIST’s guide to operational technology security cautions that relying on traditional measures such as air gaps is not enough, and lists removable media among the paths that need control. Every update, model file and document import crosses the boundary by hand. Each crossing benefits from a named person, a verified file, a scan, a log entry and a second reviewer for changes to the system.

An enclave also changes support. Remote assistance and automatic patching give way to scheduled, on-site maintenance with verified media. The protection holds as long as that discipline holds.

Questions worth asking

• Which of the six properties does this design deliver, in writing?
• Who holds administrator accounts and encryption keys, and from where can they act?
• Which data flows leave the building, including telemetry, licence checks and support?
• How do updates and models cross the boundary, and who verifies them?
• How does the firm work on a day the AI system is unavailable?

Clear answers make a design possible to judge. The architecture described here is illustrative; each deployment is scoped to the firm’s own risks and obligations. To discuss your boundaries, write to contact@desgarde.com.