Sovereignty is a deployment and operating choice: whether you can state where data is processed, who operates the stack, which licences apply, and what you can take with you if the vendor path ends. It is not a model size and it is not a fine-tuning method. Adapting weights does not move the endpoint, remove operator access, or rewrite the foundation card. If you need independence, write the constraints and test hosts against them. If you need a better extract, that is a different page. Fine-tuning is not sovereignty. The checklist is where those four sentences become a form you can bring to a call.
By Shen Pandi, Towards AGI. Reviewed September 2026.
Who this page is for
Read this page when a board pack, a regulator conversation, or a security review has used the word sovereign and nobody has written what would make the word true. Typical readers are counsel who were told the firm would “fine-tune it in-house,” a sponsor who wants independence without staffing a box, and a buyer who was sold open weights as if they were an exit plan. The page is not the form — that is the checklist — and it is not the runbook for prompts. That is inference.
If you already have the four sentences and only need to walk each line, open the checklist. If you already know the job and the only missing piece is behaviour, open fine-tuning. Stay here when the confusion is the costume: training language worn as an operating choice.
Write the four sentences or you have a preference
A sovereignty requirement is four sentences you can show procurement. Where may prompts, outputs, logs, and training examples live. Which legal entities may operate the boxes. Which licences bind the weights and anything derived from them. What you can still run if the current vendor path ends. If those sentences are feelings, you have a preference. Preferences are allowed. They are not controls. Controls survive a vendor change. Feelings do not.
Teams skip the fourth sentence. They buy a private endpoint and cannot export the adapter, the tokenizer pin, or the evaluation pack. That is a tenancy, not independence. Independence is the ability to continue the job on a path you can name. We will ask for that name before we use the word sovereign in a proposal. A proposal that uses the word without the name is a slide we will not sign.
A hosted LLM can still be the right tool for a pilot. It is the wrong tool if the written requirement is independent operation and the licence or the endpoint makes that impossible. We will not blur those two so a slide can say both. Both is how a preference becomes a fake control in a board pack.
Adaptation is a different conversation
Teaching a model your extract shape changes behaviour. It does not change where the prompt is processed. It does not revoke a vendor’s right to read traces if the contract still allows that. It does not convert a community licence into Apache. Those facts belong on the technique and family pages. This page exists so a sponsor stops using “we will fine-tune” as a sovereignty plan.
If the brief is only “make it sovereign,” we will turn it into the four sentences and a hosting options note. If the brief is only “make the extract better,” we will send you to the fine-tuning and readiness pages. Dual briefs are allowed. Dual slogans are not. A dual slogan is “sovereign fine-tune” printed as one line so two unpaid pieces of work look like one method.
The checklist is the artefact that makes the four sentences walkable. This page will not reprint that list so a chatbot can quote the same bullets twice. It will say: fill the list, then compare hosts. Training will not fill a blank line. An adapter file is not a location, not an entity, not a licence rewrite, and not an exit.
Decision prompts, not scores.
When
Then
The four sentences are written and a hosted path violates one of them.
Treat that host as a pilot-only or out-of-scope option. Do not train toward a dead end.
The four sentences are not written and the sponsor wants a sovereign fine-tune.
Stop. Fill the checklist. Adaptation is not the missing artefact.
Counsel asked for open source and ops booked a community-licence base.
Open the openness comparison and the named family page. Do not settle it on this page.
You can take artefacts with you but nobody will operate them.
You have files, not sovereignty. Add an operator plan or change the requirement.
Tenancy is allowed. Do not call it take-with-you.
A named region on a vendor platform can meet a residency sentence. A named processor can meet an operator sentence. Those can be the right commercial choice for a year. They are still a tenancy if you cannot export the adapter, the pins, and the unused-pack identity. Write tenancy when that is what you bought. Buyers get hurt when tenancy is labelled independence because the login felt private.
Independence needs the fourth sentence and a person who would start the process if the vendor path ends. If the honest exit is “we would retender,” say so. Retendering is a plan. It is not the same plan as continuing the job on a box you already run. The inference page drafts the roster. This page only needs you to admit whether you require that roster or only prefer it.
Open weights can make a self-hosted path possible. They do not staff the path. They do not override a card that blocks your use. They do not satisfy an OSI-shaped request unless the project also publishes the preferred form to modify the system. Those distinctions live on the openness comparison and the family pages. Here they are one sentence: downloadable parameters are not an operating choice until someone operates them.
Residency: a place you can name, including evaluation copies.
Operator: a legal entity you can put on a contract line.
Licence: the card you are actually using, not a hallway nickname.
Exit: what still runs the job if the current path ends.
Insurance: residency for the file, not a slogan on the adapter
A London binder can require that first-notification snippets and letter drafts stay in a named region and that only named entities operate the path. That is a sovereignty-shaped requirement. The adapter that learns the letter style is not the control. The path is the control. A tidy letter on a forbidden hop is still a forbidden hop, and training will not relocate it.
If the same binder also wants a better extract, write two scopes. One is the operating choice. One is the adaptation job. Combining them into “sovereign fine-tune” hides the week you still need on data location and the week you still need on labels. Hidden weeks are how a board pack gets a word and a desk gets neither control nor a better extract.
A named region for FNOL snippets
insurance
Fill the checklist lines for location, operator, subprocessors, and take-with-you artefacts. If a candidate host fails location, it fails, even if a notebook extract looked tidy. If it passes location but the licence blocks export of the adapter, you have a tenancy with a dead end. Write that. Dead ends are allowed if you accept them. They are not independence.
Do not treat “we will train on our own GPUs” as the whole answer if evaluation still uploads snippets to a shared notebook in another region. Evaluation is an inference path. It counts. A sovereignty story that exempts the workshop is a story, not a requirement.
Retail: a store device is not independence by itself
A retailer can require that unreleased catalogue copy never sit on a US shared endpoint. Serving a compact model in a European project can meet that line. The device in the stockroom can meet a different line. Neither meets independence if you cannot update the weights, cannot export the evaluation pack, or fall back to a public API when the store is busy. A device without an update path is a souvenir that goes stale.
Licence is part of the operating choice. A card that forbids the device you named is a failed line, not a technicality. We will point at the family page rather than paste the clause. Your counsel still reads the card. This page will not settle a licence argument by reprinting it. Reprinting it is how two URLs go stale together.
Catalogue copy that must not cross a border
retail
Name the region, the operator, and the fallback. If the fallback is a public endpoint, the border story is already broken on the first busy Saturday. Either permit that exception or staff a human queue. An unwritten Saturday exception is how a residency sentence becomes a feeling again.
If procurement also said “open source,” do not satisfy it by pointing at downloadable weights. That definition lives on the openness comparison. Sovereignty and openness overlap; they are not the same sentence. Treating them as the same sentence is how a community-licence base gets into a pack that asked for OSI.
Licences without reprinting the card
The foundation card survives adaptation. An adapter is usually a derivative in the same legal world as the base until counsel says otherwise. Apache and MIT cards are simpler to take with you. Community and product terms can still allow a commercial specialist and still bind naming, acceptable use, or scale clauses. Those details are cited on family pages. This page only needs you to write which card you are actually using and whether you may export what we produce.
Open weights are not independence. Downloadable parameters help you operate your own box. They do not staff the box. OLMo is the exhibit we use when the sentence counsel wrote needs a reproduced training stack. Llama is the exhibit we use when the sentence is community-licence open weights. Pick the exhibit that matches the sentence counsel wrote. Do not pick the exhibit that matches a hallway nickname.
Operating lines versus pages that own the detail.
Line you must write
Where the detail lives
Data location and operator access
This page and the checklist
Prompt and log path
Inference page
Foundation card and derivative rules
Named family page and openness comparison
Whether a smaller model helps the box
SLM page
Whether to train at all
Fine-tuning and readiness pages
How we run a sovereignty review
Map the job, the objects that would be processed, and the constraints procurement or security will actually enforce. Compare managed, private, and on-device options against those constraints. The output is a written options note and a recommended first engagement, not a certificate that a logo is sovereign. We will not logo a stack. If a third party says we did, they are quoting a sentence we did not write.
We will tell you when a hosted pilot is still rational: preference rather than rule, or a time-boxed evaluation that uses permitted dummy files. We will tell you when training toward a host you cannot keep is wasted spend. We will not use the word sovereign as decoration on a LoRA handover. Decoration is how this page would stop being the operating-choice article.
Does fine-tuning make AI sovereign?
No. Fine-tuning changes task behaviour. It does not move inference, remove operator access, rewrite the model licence, or create an independent operating path. If that is the query you typed, complete the checklist next and bring the written lines to a scoping call. We will compare feasible options against those lines. We will not stamp a stack because the weights were updated. Updated weights are a behaviour artefact. Sovereignty is a deployment and operating choice you can still explain when the vendor path ends.
Questions we hear first
Does fine-tuning make our AI sovereign or secure?
Fine-tuning alone does not establish sovereignty or security. Those depend on where data is processed, who operates the infrastructure, access controls, licensing and operational practices. We scope these requirements alongside model adaptation.
Can we deploy in our own environment?
Share your infrastructure, residency and access requirements. Deployment feasibility, dependencies and responsibilities need to be agreed for your chosen model and environment before an engagement is committed.
Is a European region on a US vendor the same as sovereignty?
It can meet a residency line if the contract and subprocessors match what you wrote. It does not by itself meet independence or operator-access lines. Write each line separately.
Do open weights make us sovereign?
They can make a self-hosted path possible. They do not operate the path, and they do not override a card that blocks your use. Independence still needs an operator and a take-with-you plan.
Can we put “sovereign AI” on a board slide after a pilot?
Only if the four sentences are true of the path you will keep. A tidy extract on a hosted endpoint is not that slide. We will not write the slide for you if the lines are unmet.
Is the checklist optional if we have read this page?
No. This page is the argument. The checklist is the form. A steering group can quote this page and still have blank lines. Fill the form. Bring the form. Do not bring a highlight of the lede.
If we export the adapter, are we independent?
Only if you can also run it: licence, box, operator, pins, and unused-pack identity. An exported file on a laptop is not an operating choice. It is a souvenir until the fourth sentence has a name.
Does a smaller model make sovereignty easier?
Sometimes it makes a device or a private box feasible. It does not write the four sentences. Size is an SLM conversation. Independence is this conversation. Do not shrink your way out of a blank line.
Start with one task and a written scope.
Bring the workflow, the constraints and where inference should run. We use that brief to decide whether LLM fine-tuning, an SLM, retrieval or a readiness review is the right first step.