Rethinking National AI Governance: Beyond Ritual to Sovereign Capacity
Many nations adopt AI governance frameworks that mirror corporate best practices or international norms, yet fail to build the capacity to govern AI in alignment with national interests. True sovereignty requires moving beyond compliance to develop independent assessment, adaptation, and innovation capabilities.THE SCENARIO: A newly appointed minister of technology launches a national AI strategy inspired by the OECD AI Principles. The strategy establishes principles for transparency, accountability, and human rights. Within eighteen months, multiple government agencies deploy AI systems procured from foreign vendors under contracts that mandate adherence to the vendors’ own ethical guidelines. When a facial recognition system deployed at borders produces biased outcomes, the ministry discovers it lacks the technical capacity to audit the model, the legal standing to challenge the vendor’s proprietary algorithms, and the operational readiness to replace the system without disrupting critical infrastructure. The nation has adopted the form of governance but not its substance.
An internal review reveals that while the strategy document cites sovereignty as a goal, no mechanisms exist to test whether AI systems serve national interests or merely vendor interests. Training programs focus on operating vendor systems rather than building local expertise. Procurement rules prioritize cost savings and feature sets over sovereignty impact assessments. The nation finds itself capable of drafting lofty principles but unable to ensure that AI deployments actually strengthen its autonomy.
The minister faces a choice: double down on vendor management and contractual compliance, or invest in building national capacity to understand, govern, and potentially replace AI systems. The first path preserves the illusion of sovereignty while deepening dependency. The second path demands sustained investment in institutions, expertise, and infrastructure that can assert national interests in the age of artificial intelligence.
The Question
How can a nation transition from adopting AI governance frameworks as symbolic commitments to building the substantive capacity to govern AI in accordance with its sovereignty interests?
Part One: Deep Dives
The first deep dive examines the illusion of sovereignty created by adopting foreign-developed AI ethics frameworks without localization. When a nation adopts a foreign ethical framework wholesale, it implicitly accepts the moral priorities, risk assessments, and trade-offs embedded in that framework by its originating culture. These priorities may not align with the nation’s own historical experiences, social contracts, or strategic priorities. For example, a framework emphasizing individual data portability may clash with communal data stewardship practices indigenous to certain societies, creating a mismatch between governance tools and lived realities.
The second deep dive examines the dependency trap embedded in vendor-provided AI impact assessments. Many procurement processes require vendors to supply their own bias audits, safety certifications, or ethical compliance reports. This creates a fundamental conflict of interest: the entity selling the system is also the entity certifying its safety. Even when third-party auditors are involved, they often rely on vendor-provided data, model access, and proprietary tools, limiting the depth and independence of their review. The result is a governance theater where assessments are performed but sovereignty over the evaluation process remains with foreign entities.
The third deep dive examines the erosion of adaptive capacity when nations outsource AI model tuning to foreign providers. Fine-tuning a pre-trained model on local data is often presented as a sovereignty-preserving compromise: use a powerful foreign model but adapt it to local needs. However, when the tuning tools, APIs, and expertise remain locked within the vendor’s ecosystem, the nation never acquires the ability to independently evolve the model as local conditions change. Over time, the model becomes increasingly mismatched to local needs, yet the nation lacks the capacity to correct the drift without vendor permission.
The fourth deep dive examines the impact of vendor lock-in on strategic foresight. When critical AI systems are built on proprietary platforms with closed roadmaps, national planners lose visibility into future capabilities and limitations. They cannot anticipate how upgrades might affect existing integrations, nor can they influence the direction of feature development to align with national roadmaps. This forces nations into a reactive posture, constantly adapting to vendor-driven changes rather than shaping AI development to serve long-term strategic goals.
Part One: Deep Dives
The first deep dive examines the illusion of sovereignty created by adopting foreign-developed AI ethics frameworks without localization. When a nation adopts a foreign ethical framework wholesale, it implicitly accepts the moral priorities, risk assessments, and trade-offs embedded in that framework by its originating culture. These priorities may not align with the nation’s own historical experiences, social contracts, or strategic priorities. For example, a framework emphasizing individual data portability may clash with communal data stewardship practices indigenous to certain societies, creating a mismatch between governance tools and lived realities.
The second deep dive examines the dependency trap embedded in vendor-provided AI impact assessments. Many procurement processes require vendors to supply their own bias audits, safety certifications, or ethical compliance reports. This creates a fundamental conflict of interest: the entity selling the system is also the entity certifying its safety. Even when third-party auditors are involved, they often rely on vendor-provided data, model access, and proprietary tools, limiting the depth and independence of their review. The result is a governance theater where assessments are performed but sovereignty over the evaluation process remains with foreign entities.
The third deep dive examines the erosion of adaptive capacity when nations outsource AI model tuning to foreign providers. Fine-tuning a pre-trained model on local data is often presented as a sovereignty-preserving compromise: use a powerful foreign model but adapt it to local needs. However, when the tuning tools, APIs, and expertise remain locked within the vendor’s ecosystem, the nation never acquires the ability to independently evolve the model as local conditions change. Over time, the model becomes increasingly mismatched to local needs, yet the nation lacks the capacity to correct the drift without vendor permission.
The fourth deep dive examines the impact of vendor lock-in on strategic foresight. When critical AI systems are built on proprietary platforms with closed roadmaps, national planners lose visibility into future capabilities and limitations. They cannot anticipate how upgrades might affect existing integrations, nor can they influence the direction of feature development to align with national roadmaps. This forces nations into a reactive posture, constantly adapting to vendor-driven changes rather than shaping AI development to serve long-term strategic goals.
The fifth deep dive examines the brain drain effect of relying on foreign AI expertise for system operation and maintenance. Nations that depend on foreign technicians to run their AI systems fail to develop a local cadre of engineers, ethicists, and governance specialists who understand both the technical details and the national context. This creates a fragile dependency where even routine updates require foreign intervention, and any geopolitical tension that disrupts access to that expertise can cripple essential services.
The sixth deep dive examines the legal opacity introduced by foreign terms of service and data processing agreements. These documents often grant providers broad rights to collect, analyze, and repurpose user data for product improvement, all while being governed by foreign legal systems. When a government seeks to enforce its own data protection laws, it may discover that the contractual obligations it signed with the provider contradict or override those laws, leaving it with limited recourse without breaching contract and risking service termination.
The seventh deep dive examines the economic sovereignty cost of perpetual licensing models. Many AI systems are offered via subscription or usage-based fees that funnel continuous revenue streams to foreign corporations. Unlike a one-time purchase of perpetual software, these models create a lasting economic dependency where the nation’s spending on AI capabilities directly enriches foreign shareholders. Over time, the cumulative outflow can rival or exceed the cost of building domestic alternatives, yet the off-ramp remains obscured by switching costs and data migration complexities.
The eighth deep dive examines the cultural homogenization risk embedded in default AI interfaces and interaction models. AI systems often embed implicit assumptions about user behavior, communication styles, and decision-making processes that reflect the cultural norms of their developers. When deployed abroad without adaptation, these assumptions can subtly reshape user expectations and behaviors, gradually aligning local digital culture with foreign norms. This soft power effect operates beneath the level of explicit policy, making it difficult to detect and reverse without deliberate cultural sovereignty interventions.
The ninth deep dive examines the strategic vulnerability created by single-source dependencies on foreign AI hardware accelerators. Nations that rely on foreign-designed chips for their AI workloads expose themselves to supply chain risks that can be exploited for geopolitical leverage. Export controls, licensing restrictions, or even corporate decisions to prioritize other markets can abruptly cut off access to critical compute resources, leaving nations unable to run their AI systems regardless of legal or policy intentions.
The tenth deep dive examines the missed opportunity cost of not developing domestic AI innovation ecosystems. Every dollar spent on licensing foreign AI is a dollar not invested in local research, development, and entrepreneurship. Over time, this creates a self-reinforcing cycle: the lack of domestic alternatives increases reliance on foreign systems, which in turn reduces the incentive and capacity to build local capabilities. Breaking this cycle requires deliberate industrial policy that treats AI sovereignty as a strategic infrastructure priority akin to energy or defense.
The eleventh deep dive examines the interoperability trap created by proprietary data formats and application programming interfaces. When AI systems lock data and workflows into vendor-specific ecosystems, nations face steep costs and technical barriers when attempting to switch providers or integrate with locally developed tools. This lock-in extends beyond technical incompatibility to include organizational inertia, as entire workforces become trained on vendor-specific workflows that are difficult to translate to alternative systems.
The twelfth deep dive examines the normative isolation that results from outsourcing AI ethics deliberation to foreign bodies. When a nation’s AI governance debates are shaped primarily by international forums dominated by foreign perspectives, its own ethical traditions and communal decision-making processes may be marginalized or overridden. This can lead to a disconnection between governance frameworks and the moral intuitions of the populace, undermining legitimacy and compliance.
Part Four: Phased Implementation Framework
The journey from symbolic governance to sovereign capacity requires a sequenced, resourced plan that builds institutional capability while maintaining operational continuity. The following four-phase framework provides a roadmap that nations can adapt to their specific contexts, starting with assessment and culminating in institutionalised sovereignty practices.
Phase 1: Assessment (Weeks 1-4)
Conduct a comprehensive sovereignty audit of all critical AI systems. Map each system across the five-domain Sovereignty Test Matrix and the seven-layer technology stack to identify where sovereignty is strong and where it is weak. Prioritise systems based on their criticality to national functions such as defence, elections, energy, finance, and identity management. The assessment should produce a clear dependency map that shows which layers are domestically controlled, which are foreign-controlled, and where dependencies create political, economic, cultural, intellectual, or technological vulnerabilities.
Deliverables of this phase include a sovereign AI inventory, a dependency heatmap, and a prioritised list of systems requiring intervention. The assessment should involve cross-functional teams from technology, governance, legal, and operations to ensure a holistic view.
Phase 2: Strategic Planning (Months 2-3)
Develop a sovereign technology roadmap based on the assessment findings. Define clear objectives for each layer of the stack and each domain of the test matrix, specifying target levels of domestic control and timelines for achievement. Create investment plans that prioritise critical systems and allocate resources for both short-term mitigation (e.g., contractual renegotiations, interim monitoring tools) and long-term sovereignty goals (e.g., building domestic alternatives, developing local expertise).
Establish governance structures that include technical experts, legal experts, and policymakers to oversee the transition. Define metrics for tracking progress, such as reductions in foreign dependency scores, increases in local AI governance capacity, and milestones for domestic capability building.
Phase 3: Implementation (Months 4-12)
Execute the phased migration of critical workloads to more sovereign alternatives. Begin with non-critical systems to build expertise and confidence, then progress to systems with higher sensitivity. For each system, evaluate options including: (1) migrating to domestically-controlled cloud providers, (2) implementing hybrid models that keep sensitive data on-premises while using cloud for burst capacity, (3) adopting open-source stacks with local support contracts, or (4) building government-owned infrastructure for the most critical functions.
Phase 4: Institutionalisation (Months 13-18)
Embed sovereignty considerations into standard technology procurement, architecture review, and risk management processes. Update procurement policies to require sovereignty impact assessments for all major technology purchases. Establish ongoing monitoring and auditing mechanisms to detect changes in dependency levels or emerging vulnerabilities. Develop domestic technology industry capabilities through research funding, education programs, and strategic procurement that supports local vendors.
The Question Revisited
How can a nation transition from adopting AI governance frameworks as symbolic commitments to building the substantive capacity to govern AI in accordance with its sovereignty interests? The answer lies in rejecting the illusion of sovereignty through symbolic adoption and embracing the sustained effort required to build national capacity for assessment, adaptation, and innovation. A nation must first transparently map its dependencies across the five-domain Sovereignty Test Matrix and seven-layer technology stack to understand where sovereignty is strong and where it is weak. It must then establish clear sovereignty objectives based on criticality and risk, prioritizing systems that are essential to national functions. Finally, it must execute a phased implementation plan that builds domestic capability while maintaining operational continuity, investing in institutions, expertise, and infrastructure that can assert national interests in the age of artificial intelligence.
The TEE Method™ framework provides the structure for this approach: first, Transparently map all dependencies across the seven-layer stack and five-domain test matrix; second, Establish clear sovereignty objectives and priorities based on criticality and risk; third, Execute a phased implementation plan that builds domestic capability while maintaining operational continuity. Nations that follow this approach will find that sovereignty is not a binary state but a spectrum of capabilities that can be strengthened over time through deliberate, strategic investment in both technology and governance.
Sovereignty is not about eliminating all foreign dependence—it is about ensuring that no foreign power can unilaterally compromise your nation’s essential functions.
The TEE Method™ framework provides the structure for this approach: first, Transparently map all dependencies across the seven-layer stack and five-domain test matrix; second, Establish clear sovereignty objectives and priorities based on criticality and risk; third, Execute a phased implementation plan that builds domestic capability while maintaining operational continuity. Nations that follow this approach will find that digital sovereignty is not a binary state but a spectrum of capabilities that can be strengthened over time through deliberate, strategic investment in both technology and governance.
Seven-Layer Stack Audit
The Physical Layer encompasses the tangible foundations of digital infrastructure: servers, storage devices, networking equipment, data center facilities, and fiber optic cables. While localization laws may require that data resides on servers within national borders, they rarely address the provenance of that hardware. The servers in a ‘sovereign cloud’ data center are typically manufactured in facilities located in Taiwan, South Korea, China, or the United States. The networking gear—routers, switches, optical transmission equipment—comes from similarly concentrated global supply chains. Even the data center building materials, cooling systems, and power infrastructure often rely on internationally sourced components. True sovereignty at this layer would require domestic or allied manufacturing capacity for critical hardware, secure supply chains for components, and the ability to maintain and repair equipment without dependence on foreign technical expertise or proprietary documentation.
The Virtualization Layer consists of the software that abstracts physical hardware into flexible, allocatable resources: hypervisors, container orchestration platforms, and cloud management software. This layer is where the hyperscale providers exert significant proprietary control. VMware ESXi, Microsoft Hyper-V, and various open-source hypervisors like KVM and Xen dominate this space, but the management layers—vCenter, Azure Stack, Google Anthos—are often proprietary and tightly integrated with the providers’ broader ecosystems. Even open-source virtualization platforms frequently depend on proprietary drivers, firmware, or management tools for optimal performance on specific hardware. Sovereignty here requires either domestically-controlled open-source alternatives with full hardware compatibility, or the establishment of national capabilities to audit, modify, and maintain proprietary virtualization stacks.
The Storage Layer includes the systems that persistently hold data: distributed file systems, object storage, block storage, and database engines. While data localization laws focus on where this layer resides, they often ignore who controls the software that manages it. Proprietary storage solutions from cloud providers (Amazon S3, Azure Blob Storage, Google Cloud Storage) or enterprise vendors (NetApp, Dell EMC, Pure Storage) may offer advanced features but come with vendor lock-in, opaque operational characteristics, and potential remote management capabilities. Open-source alternatives like Ceph, GlusterFS, or MinIO exist but require significant expertise to deploy at scale and may lack the performance or integration capabilities of proprietary counterparts. Storage sovereignty demands transparent, auditable storage systems that can be independently verified and maintained without foreign vendor dependence.
The Networking Layer governs how data moves between systems: physical switches and routers, software-defined networking (SDN) controllers, load balancers, and content delivery networks. This layer is particularly vulnerable to foreign control because networking equipment markets are highly consolidated, with a few vendors (Cisco, Juniper, Huawei, Nokia) dominating globally. SDN controllers, while promising greater flexibility, often come from the same vendors or from cloud providers seeking to lock customers into their ecosystems. The protocols that govern internet traffic—BGP, DNS, TCP/IP—are theoretically open, but their implementation in operational systems frequently includes proprietary extensions or dependencies. Network sovereignty requires control over both the physical infrastructure and the software that manages it, including the ability to independently verify routing decisions, traffic prioritization, and security policies.
The Software Layer encompasses the operating systems, middleware, runtime environments, and application platforms that run atop the virtualization layer. Linux distributions dominate here, but even open-source operating systems may include proprietary firmware blobs, drivers, or management tools. Container platforms like Kubernetes are open-source but often deployed with proprietary monitoring, security, or service mesh additions from cloud providers. Application platforms—whether traditional enterprise middleware like .NET and Java EE or modern like serverless functions—frequently tie users to specific providers through proprietary APIs, specialized services, or data format lock-in. Software sovereignty requires the ability to run essential workloads on platforms whose source code can be inspected, modified, and compiled locally, without dependence on foreign vendors for patches, updates, or technical support.
The Identity and Access Management Layer controls who can access what resources, under what conditions, and with what authentication. Cloud providers offer robust IAM solutions (AWS IAM, Azure Active Directory, Google Cloud Identity) that integrate deeply with their platforms and often provide convenient single sign-on capabilities. However, these systems create significant dependency: user directories, authentication policies, audit logs, and access control rules all reside within the provider’s ecosystem. Migrating away from such a system can be operationally disruptive and technically complex, requiring re-architecture of applications that depend on provider-specific authentication tokens or federated identity protocols. True IAM sovereignty necessitates domestically-controlled identity infrastructure that can authenticate users and manage access rights without reliance on external validation or proprietary protocols that could be altered or withdrawn by foreign entities.
The Legal and Policy Layer forms the outermost envelope that governs how all technical layers may be used, accessed, and controlled. This layer includes the terms of service, licensing agreements, data processing addendums, and service level agreements that users sign with cloud providers. It also encompasses the extraterritorial reach of laws like the US CLOUD Act, China’s Cybersecurity Law, or the EU’s GDPR, which can compel data disclosure or access regardless of where data is physically stored. Localization laws attempt to operate at this layer but often fail to address the reality that contractual obligations with foreign providers may create conflicting legal duties. Sovereignty at this layer requires not only national legislation that asserts control over data and infrastructure but also the capability to enforce that legislation against foreign entities through domestic legal mechanisms, international agreements, or technical countermeasures that prevent unwanted access regardless of legal demands.
Part Two: Sovereignty Test Matrix
Applying the five-domain Sovereignty Test Matrix to national AI governance reveals where sovereignty is strong and where it is weak across Political, Economic, Cultural, Intellectual, and Technological dimensions. Politically, a nation that relies on foreign-developed AI governance frameworks may find its policy autonomy constrained when those frameworks encode foreign policy priorities or diplomatic sensitivities. For example, an AI ethics guideline that restricts certain surveillance technologies due to concerns in the originating country may prevent the adopting nation from deploying similar technologies for legitimate domestic security needs, even when domestic law and public opinion support such use. The political dimension of sovereignty requires that governance frameworks allow for national self-determination in balancing competing values and risks.
Economically, dependence on foreign AI governance models often entails hidden costs that erode fiscal sovereignty. When a nation adopts a foreign framework, it may need to purchase compliance tools, training programs, or certification services from vendors based in the originating country. These payments create a steady outflow of capital that could otherwise be invested in domestic institutions. Moreover, the economic benefits of AI governance—such as the development of local auditing firms, certification bodies, or consulting firms—are captured abroad. True economic sovereignty requires that the governance regime stimulate local economic activity and retain value within the national economy.
Culturally, imported AI governance frameworks may encode cultural assumptions that do not align with local norms, leading to a gradual erosion of cultural sovereignty. For instance, a framework that emphasizes individual consent as the primary basis for data governance may clash with societies where communal decision-making or elder authority plays a central role in information governance. Over time, institutions may begin to internalize these foreign norms, altering internal policies and practices in ways that distance them from local cultural realities. Cultural sovereignty demands that governance frameworks be adaptable to local cultural contexts and that they reinforce, rather than undermine, locally valued social structures.
Intellectually, reliance on foreign governance frameworks creates a dependency that hinders the development of domestic expertise. When nations consistently import their governance models, they miss opportunities to develop local expertise in AI governance theory, policy design, and implementation. This intellectual dependency creates a cycle where local institutions lack the capacity to innovate in governance, making them increasingly reliant on external sources for updates and guidance. Intellectual sovereignty requires investment in domestic research and educational programs that can generate original insights into AI governance tailored to national contexts.
Technologically, imported governance frameworks often assume a certain technological infrastructure that may not match local realities, creating technological sovereignty gaps. A framework that assumes widespread broadband access, cloud computing availability, or advanced digital identification systems may be difficult to implement in regions with limited infrastructure. Moreover, reliance on foreign technological platforms to implement governance (such as using a foreign-hosted compliance monitoring tool) creates points of vulnerability where external actors could disrupt or manipulate governance processes. Technological sovereignty requires that governance frameworks be implementable with locally available technology and that they encourage the development of domestic technological capacity to support governance functions.
When scored across these five domains, many nations find that their AI governance efforts score highly on symbolic adoption but low on substantive sovereignty. A typical score might reveal strong performance in adopting internationally recognized principles (Political: 3/5) but weak performance in building independent assessment capacity (Economic: 2/5, Cultural: 2/5, Intellectual: 2/5, Technological: 2/5), resulting in a total score well below the threshold that indicates genuine sovereignty capacity. The matrix reveals that sovereignty is not a binary state but a spectrum, and that meaningful progress requires targeted investment in the weakest domains.
This article draws on the TEE Method™ framework from SOVEREIGN: Who Owns the Future? For the complete framework and further guidance on building digital sovereignty, see tonishatagoe.com.
Part Four: Phased Implementation Framework
Phase 1: Assessment (Weeks 1-4)
Conduct a comprehensive sovereignty audit of all critical AI systems. Map each system across the five-domain Sovereignty Test Matrix and the seven-layer technology stack to identify where sovereignty is strong and where it is weak. Prioritise systems based on their criticality to national sovereignty, including defense, elections, energy, finance, and identity systems.
Phase 2: Strategic Planning (Months 2-3)
Develop a sovereign technology roadmap based on the assessment findings. Define clear objectives for each layer of the stack, specifying target levels of domestic control and timelines for achievement. Create investment plans that prioritise critical systems and allocate resources for both short-term mitigation and long-term sovereignty goals. Establish governance structures that include technical experts, legal experts, and policymakers to oversee the transition.
Phase 3: Implementation (Months 4-12)
Execute the phased migration of critical workloads to more sovereign alternatives. Begin with non-critical systems to build expertise and confidence, then progress to systems with higher sensitivity. For each system, evaluate options including: migrating to domestically-controlled cloud providers, implementing hybrid models that keep sensitive data on-premises while using cloud for burst capacity, adopting open-source stacks with local support contracts, or building government-owned infrastructure for the most critical functions. Throughout implementation, maintain rigorous security and compliance standards, ensuring that sovereignty enhancements do not come at the cost of security or operational effectiveness.
Phase 4: Institutionalisation (Months 13-18)
Embed sovereignty considerations into standard technology procurement, architecture review, and risk management processes. Update procurement policies to require sovereignty impact assessments for all major technology purchases. Establish ongoing monitoring and auditing mechanisms to detect changes in dependency levels or emerging vulnerabilities. Develop domestic technology industry capabilities through research funding, education programs, and strategic procurement that supports local vendors. Ensure that sovereignty is not a one-time project but an ongoing aspect of technology governance.
The Question Revisited
How can a nation transition from adopting AI governance frameworks as symbolic commitments to building the substantive capacity to govern AI in accordance with its sovereignty interests? The answer lies in treating governance as a capacity-building exercise rather than a compliance exercise. Nations must invest in the institutions, expertise, and infrastructure needed to assess, adapt, and innovate in the AI domain. This means developing domestic capabilities to evaluate AI systems against national interests, modify systems to better serve those interests, and create alternatives when existing options fall short. It requires moving beyond vendor management to strategic autonomy, where the nation retains the ability to shape AI development and deployment in alignment with its sovereignty goals.
The TEE Method™ provides a structured approach to this challenge. First, Transparently map all dependencies across the seven-layer stack and five-domain test matrix to understand where sovereignty is strong and where it is weak. Second, Establish clear sovereignty objectives and priorities based on criticality and risk, focusing resources on the most vital systems. Third, Execute a phased implementation plan that builds domestic capability while maintaining operational continuity, ensuring that sovereignty enhancements do not come at the cost of security or effectiveness. Nations that follow this approach will find that sovereignty is not a binary state but a spectrum of capabilities that can be strengthened over time through deliberate, strategic investment in both technology and governance.
Ultimately, sovereignty in the age of artificial intelligence is not about rejecting foreign technology or achieving complete self-sufficiency—an unrealistic and undesirable goal in an interconnected world. It is about ensuring that critical AI systems remain under effective national control, that nations retain the capacity to govern AI in accordance with their interests, and that they possess the resilience to adapt to changing circumstances. By investing in sovereign capacity, nations can harness the benefits of AI while safeguarding their autonomy, creating a foundation for sustainable technological independence.
This article draws on the TEE Method™ framework from SOVEREIGN: Who Owns the Future? For the complete framework and further guidance on building digital sovereignty, see tonishatagoe.com.