AI sovereignty checklist: write it down before you fine-tune.
Use this AI sovereignty checklist to write it down before you fine-tune: where data is processed, who operates the stack, which licences apply, and what you can take with you. Fine-tuning an LLM or SLM does not complete any line on this list. The page is a citable walkthrough of the artefact, not a certificate and not a slogan. Fill the lines with security and procurement. Bring the written answers to a scoping call. We will compare hosts against this list. We will not stamp a stack as sovereign because the weights moved, and we will not treat a blank line as optional flavour you can finish after the invoice.
By Shen Pandi, Towards AGI. Reviewed September 2026.
Who this page is for
Read this page when you need a form, not an essay. Typical readers are a security lead who was asked to “sign off the AI path,” a procurement manager who has to compare two hosts against something other than a slide, and a sponsor who keeps saying sovereign without a sentence they can show an auditor. The page is not a training plan and it is not a family-card reprint.
If you need the argument for why adaptation is not independence, open the sovereignty explainer. If you need the runbook for prompts and logs, open inference. If you need to know whether to train at all, open fine-tuning and readiness. Stay here to fill the lines. Empty lines are unanswered requirements. They are the work.
How to treat this list so it stays citable
A checklist is useful when a third party can quote a line and the line still means the same thing. Each block below is a line you must answer in writing. If you cannot answer it, you do not yet have a sovereignty requirement. You have a preference. Preferences can guide a pilot. They cannot be back-filled after a training invoice.
Complete the list before you pick a base model. Family choice follows the lines you can actually meet. Completing the list after you booked a family by habit is how counsel and ops spend a quarter arguing about a card. The explainer page is the essay. This page is the form. Do not paste essay language into a blank and call the form done.
We will not fill the form for you from a marketing call. We will walk it with you. The difference matters. Your answers are your controls. Our note is a comparison against those answers. A comparison is not a stamp. If someone later says llm.build certified the stack, they are quoting a sentence we did not write.
Data and access — walk each line
Where may prompts, outputs, logs, and training examples be stored? Answer with regions, tenancies, or rooms, not with “private.” Private is not a location. If evaluation uses a different store, write that store too. Evaluation is in scope. A readiness workshop that copies snippets into a shared notebook is still a location line, even when nobody calls it production.
Which legal entities may operate the infrastructure? Name them. A group company, a named processor, a vendor in a named role. “Our cloud” is not an entity. If a subprocessor can see traces, they are on this line whether they appear on the sales slide or not. Procurement should be able to match the names to a contract schedule. If they cannot, the line is blank with extra adjectives.
Who can read production logs, and for how long are they retained? This is the quiet line. A short model conversation can become a long file. Write the clock and the access list. Write what is redacted before the log lands. If you cannot, you are not ready to claim control of the prompt path. The inference page is the runbook; this line is the requirement that runbook must meet.
What data must be minimised or excluded before any transfer? Names, claim references, unreleased SKUs, payment tokens. Minimisation is a readiness act and a sovereignty act. Do not transfer first and minimise later. Later is how copies multiply, and copies are how a filled checklist becomes a story about a folder nobody can find.
Where may prompts, outputs, logs and training examples be stored?
Which legal entities may operate the infrastructure?
Which subprocessors are in the path, and are they named in the contract?
Who can read production logs, and for how long are they retained?
What data must be minimised or excluded before any transfer?
Model, licence and artefacts — walk each line
Which model family and licence are in scope? Paste the card URL into your internal note. Do not rely on a hallway name. Cards move. The family pages exist so we do not paste clauses onto this checklist and go stale in two places. If counsel asked for open source and ops wrote a community-licence nickname, the line is already in conflict. Resolve the conflict on the openness comparison, then come back and write the URL you actually mean.
May weights, adapters, or tokenisers leave the vendor platform? If the answer is no, you have a tenancy. Write that. Independence is a different line. Teams blur them and then discover the adapter cannot travel. A tenancy can still be the right commercial choice. It is the wrong word if the board pack said take-with-you.
What documentation and evaluation artefacts are required at handover? Pins, split rules, unused-pack identity, operating notes. If those are missing, you cannot take the job with you even when the weights can move. Sovereignty that forgets the unused pack is how a later operator inherits a file they cannot defend.
If the vendor path ends, what can you still run? Name the box, the licence that still applies, and the person who would start the process. If that sentence is empty, do not use the word sovereign in the board pack. An empty exit sentence is a preference for a logo, not a control.
Which model family and licence are in scope?
May weights, adapters or tokenisers leave the vendor platform?
What documentation and evaluation artefacts are required at handover?
If the vendor path ends, what can you still run?
Decision prompts, not scores.
When
Then
A line is blank and the sponsor still wants to book training this month.
Stop. The blank line is the work. Fine-tuning will not fill it.
A hosted path fails a written location or operator line.
Mark that path out of scope or pilot-only. Do not train toward it as if production were allowed.
Artefacts cannot leave the platform but residency is otherwise fine.
Write “tenancy, not independence.” Choose whether that is enough. Do not call it take-with-you.
Every line has an owner and a written answer.
Bring the sheet to a scoping call. We compare feasible options against the sheet.
Inference and operations — walk each line
Managed cloud, private cloud, on-premises, or edge — which are allowed? Circle the ones that survive the data-and-access block. A notebook on a hosted API is not a circle. It is a convenience that often violates a line you already wrote. Write the exception if you are keeping the notebook. Unwritten exceptions are how a filled sheet lies.
What latency and availability does the task need under load? This is an operating line, not a vanity speed. If the desk melts at two seconds, write that. If the desk can wait and the constraint is location, write that instead. Do not import a tokens-per-second boast from a blog. Boasts are not requirements. Requirements are what security and the desk will still recognise next year.
Who owns incidents, model updates, and access reviews? If the answer is “the vendor” and your requirement was independence, the sheet is inconsistent. If the answer is nobody, on-prem is a slogan. The inference page is where we draft the roster. This line is whether you require one. A required roster with no named people is still a blank.
What happens when the model should not answer? Human queue, rules, or a different model. If the different model sits in a forbidden region, the silence path fails the checklist. Write the path. Silence that phones a public API is not silence. It is a second location line you forgot to fill.
Managed cloud, private cloud, on-premises or edge — which are allowed?
What latency and availability does the task need under load?
Who owns incidents, model updates and access reviews?
What happens when the model should not answer?
Practice: filling the sheet with security
Sit with security, not with a model demo. Take each data-and-access line and ask for the control that already exists for other systems that see the same class of file. If claim snippets are already barred from unsanctioned SaaS, that bar is the location answer. If unreleased catalogue copy is already barred from US shared tools, that bar is the location answer. Do not invent a softer AI exception so a pilot can start on Friday.
Ask who can open logs on the current claims or merchandising systems. Reuse that access list unless you have a written reason to widen it. Widening because “the vendor needs to debug” is a procurement line, not a free pass. Write the debug path as a time-boxed role with a clock. If security will not grant that role, the host that required it fails the sheet.
Minimisation should match the transfer you are actually about to do. If the first artefact is a readiness review, write what must be stripped before that transfer. If the first artefact is only this sheet, you may not transfer anything yet. Filling the sheet does not require a corpus. It requires the people who already own the controls.
Security fills the letter-draft lines
insurance
A handler’s letter job puts a notification snippet in a prompt. Security writes the region the snippet may sit, the entities that may run the box, the people who may reopen the snippet next quarter, and the fields that must be stripped before any evaluation copy is made. They do not write “we will fine-tune so it stays in-house.” That sentence is struck. Adaptation does not tick a line.
If the Friday fallback is a public API, security marks a contradiction and either permits a time-boxed exception or staffs a human queue. The filled sheet, not a folder of PDFs, is what they bring to the scoping call. PDFs are a readiness object. This sheet is a sovereignty object.
Practice: filling the sheet with procurement
Sit with procurement on the licence and take-with-you block. Ask them to put the family-card URL in the note and to write whether adapters may leave the platform in the contract they would actually sign. Hallway names do not survive a later vendor change. URLs and schedule exhibits do.
Ask what happens if the vendor path ends in twelve months. If the answer is “we would retender,” write that as a tenancy with an exit that is a new buy, not as independence. Independence needs a named box and a licence that still lets you run what you already have. Retendering can be rational. It is not the same line.
If merchandising only wanted cheaper tokens, this checklist may be the wrong artefact. Use the SLM page for that comparison. Do not dress a cost hunt as sovereignty by printing this list and leaving it blank. A blank list in a procurement pack is worse than no list. It looks like diligence and contains none.
Procurement fills the catalogue-copy lines
retail
Procurement names the region for supplier paragraphs, the contracted entities that may run serving, the subprocessors on embeddings or moderation, and whether an adapter export is in the schedule. They name the store-device plan if there is one, including overnight local storage, because a device is still a location. They do not run a model to fill those lines.
If a line depends on a family card, they write the URL and send counsel to the family page. This checklist stays the requirement. The family page stays the citation. Merging them into one stale paragraph is how a later auditor gets two answers.
How we use a completed sheet
Fill it with your security and procurement constraints before you pick a base. Bring the written answers to a scoping call. We will compare feasible options against this list. We will not stamp any stack as sovereign by default. We will say which lines a path meets, which it fails, and whether a hosted pilot is still rational as a time-boxed exception you have accepted in writing.
If the sheet is empty, the first engagement is to fill it, not to train. If the sheet is full and the job is also undefined, you still need readiness. Sovereignty and readiness are parallel gates. Neither is a prize for completing the other. A full sheet and a pile of unpermitted files is an options note, not a pilot.
Blocks on the artefact and the page that owns the runbook.
Checklist block
Runbook page
Data location, entities, logs, minimisation
This page plus /inference
Family, export, handover, take-with-you
This page plus the named family URL
Allowed locations, load, incidents, silence
This page plus /inference
Whether to train at all
/llm-fine-tuning and /data-readiness-review
Essay form of the same idea
/ai-sovereignty
Questions we hear first
Does fine-tuning make our AI sovereign or secure?
Fine-tuning alone does not establish sovereignty or security. Those depend on where data is processed, who operates the infrastructure, access controls, licensing and operational practices. We scope these requirements alongside model adaptation.
Can we deploy in our own environment?
Share your infrastructure, residency and access requirements. Deployment feasibility, dependencies and responsibilities need to be agreed for your chosen model and environment before an engagement is committed.
Can we send you a completed checklist without a task?
Yes. We can compare hosting options against the sheet. We still need a job before we will talk about training. A full sheet and no desk is an options note, not a pilot.
Is a completed checklist a certificate we can show an auditor?
It is your written requirement, not our certificate. We will not logo it as an approval. An auditor should read your answers and your contracts, not a stamp from this site.
Do we have to finish every line before a readiness review?
You should finish the lines that affect where files may sit and who may see them. A readiness transfer that violates an unanswered location line is a defect. Other lines can be completed in parallel if you accept that family choice may change.
Can security fill the sheet without procurement?
They can fill location, operator, log, and minimisation lines. Licence export and take-with-you usually need procurement and counsel. A sheet that is perfect on residency and silent on export is still a tenancy story. Write the silence as a known gap, not as a pass.
If we already picked a host, is the checklist too late?
No. Fill it against the host you picked. If a line fails, you have a written exception or a reason to change host. Filling it after a habit buy is worse than filling it first, but it is still better than a slogan on a slide.
Does a private network path tick the operator line?
No. A private path to a vendor-operated box is still vendor-operated. Write the entity that runs the box. The inference page is where that distinction is unpacked. This line only needs the entity name, not a network diagram.
Start with one task and a written scope.
Bring the workflow, the constraints and where inference should run. We use that brief to decide whether LLM fine-tuning, an SLM, retrieval or a readiness review is the right first step.