For the past two years, "AI sovereignty" has meant one thing in most meeting rooms: where the servers are. Is the data in our country? Is the model ours? Where does the cable go?
That question is not wrong. It is just no longer the question. In the eleven days just past, three governments answered the real question — who gets to decide what AI does — in three completely different ways. None of the three was about server location.
01What sovereignty actually means
If I had to put one sentence on a boardroom table, it would be this. AI sovereignty is your ability to keep working on the day someone else decides you should not. It is not about where the machine sits — it is about what you still have on the day the supply stops.
A company can be fully compliant, fully domestic, fully "deployed in our own data centre," and still be shut down by a single email. The server can be in your own building while the model it runs checks in with a vendor every morning — that does not help you. You can have downloaded the model already, and still be stuck if the only three people who know how to run it are the three who just left.
Sovereignty is measured on the morning after something breaks. Not on the architecture diagram.
02Three governments, three tools, eleven days
From 16 October to 29 October — eleven days. The United States, China and Canada each moved, three acts inside the same window, uncoordinated and not responding to one another. But set them side by side and the three governments are answering the same question: now that AI is strong enough to decide whether something should happen, where does that decision sit.
The three answers have nothing in common. One takes the thing away, one decides what may cross the border, one buys its way to a seat at the table. They differ in speed, in precision, in how you verify them afterwards — and in what each one costs. The timeline below plots the three acts against real elapsed days. Here is what happened; then we take them one at a time.
Three governments answered the same question three different ways over eleven days. Sources [1][3][4].
The first answer: ban it
On 20 October, the United States ordered federal civilian agencies to remove DeepSeek from their systems [3]. The order covered not only new purchases but systems already in use — meaning agencies had to go back and take out something that was already running.
The logic is simple and honest: if you do not want to depend on it, do not use it. No negotiation, no licensing terms, no data agreement to argue over. The capability is simply gone.
What you buy is a clean line. Nobody has to make a judgement call about it at three in the morning, because the tool is not there. What you pay is capability. The banned thing is gone whether or not it was the right tool for that job.
And there is a second bill that is harder to see: a ban does not remove the demand, it removes the permission. People who genuinely need the capability find quieter ways to get it, and the quieter ways are exactly the ones nobody reviews. A rule everyone follows is a boundary. A rule everyone routes around is a boundary-shaped hole.
The second answer: control it
On 16 October, China opened a public consultation on a revision to its catalogue of technologies that cannot be freely exported, adding a dedicated section on artificial intelligence [4]. In plain terms, it sorts AI technology into three baskets: some is forbidden to leave, some requires a licence, and the rest flows freely.
The sorting is done by capability rather than by company — the draft offers reference thresholds at roughly 10 to the power of 26 operations of compute, or more than two trillion parameters, along with whether the system targets critical infrastructure, defence, or core government work. These are reference indicators in a consultation draft, not final rules.
The most interesting line is the one almost nobody outside the country would notice. The document states plainly that what is being controlled is the underlying technology, not the product or the service. Weights, training data, source code, algorithm documentation, the core design of a compute system — those are covered. But a company selling an AI service to overseas customers over an API, or shipping an industry solution abroad, does not need an export licence.
That distinction is careful, and worth pausing on. It draws a line between the recipe and the meal. You may not hand over the recipe. You may still sell the meal.
What you buy is a valve: the flow of technology can be opened or narrowed without stopping the business entirely. What you pay is precision. A threshold written in numbers is always one generation behind the technology it describes. And the document has to give open source a separate door — because publishing weights is generous and irreversible at the same time. Once a file is out, it cannot be pulled back.
The third answer: buy it
On 29 October, the Government of Canada announced it would take an equity stake of up to 1.6 billion Canadian dollars in Cohere, a Toronto AI company, as part of a funding round targeting 7 billion at a 35.7 billion valuation [1][2]. The Prime Minister's own release calls it a landmark investment in "secure, sovereign AI."
This is the newest of the three and the least understood, because it does not look like sovereignty at all. It looks like a business deal. But look at what the government tied the money to. By 2030, Cohere must create at least 1,000 new Canadian technical jobs, commit at least 1.7 billion Canadian dollars to additional computing infrastructure in Canada, keep its Canadian incorporation and headquarters, and continue working with the Canadian AI Safety Institute [1].
Read that list again. These are not investment terms. They are sovereignty terms wearing investment terms as a costume. "Keep your headquarters here" is a nationality clause. "Build your compute here" is an infrastructure clause. "Create 1,000 jobs here" is a capability clause. The government bought a vote, and it bought the right to keep the company from leaving.
True sovereignty depends on our ability to build, adopt, and govern AI on our own terms.
Prime Minister of Canada, official release [1]
What you buy is real capability that stays in the country, plus a shareholder with an interest in it not leaving. What you pay is a question nobody wants to ask out loud: if the government owns part of the company, can the government still regulate it honestly? A regulator holding a stake in the regulated is a regulator with a conflict. This is not a criticism of Canada — it is a structural feature of the approach, and it will surface eventually, in some future dispute where the honest answer is expensive for the taxpayer.
There is a second, quieter bill. An equity stake is a one-time decision followed by years of watching. The commitments run to 2030. And if the company misses them? The document says progress will be reported regularly. It does not say what a missed promise costs [1].
03A comparison nobody has put in one table
The three were reported separately: one as a security story, one as a trade story, one as a funding story. Taken one at a time, each makes sense. Taken together, they turn out to be three solutions to the same problem.
So it is worth putting them in one table and asking the same questions of each: what the move actually is, who is able to make it, what it buys, what it costs, where it eventually cracks, and how long it takes to work. The figure below shows what each approach is good at; the table after it goes row by row.
A qualitative comparison, not a score: five positions represent five steps, and the filled count shows relative strength. Read from the three government releases [1][3][4].
| Ban | Control | Buy | |
|---|---|---|---|
| The move | Take it out of your systems | Decide what may cross the border | Take equity, attach conditions |
| Who can do it | A government | A government | A government with money |
| What you get | A clean, empty line | A valve you can open and close | Capability that stays home |
| What you pay | Capability you actually needed | Precision that ages within a year | A regulator who is also a shareholder |
| How it fails | People quietly route around it | The threshold is always one version behind | The promises expire and nobody is accountable |
| How fast | Overnight | Months of drafting | One announcement, years of checking |
What each approach buys, what it costs, and how it fails.
Look at the last row. Ban is fast and blunt. Control is slow and precise. Buy is fast to announce and slow to prove. Those are three genuinely different things to be good at.
Now look at what the table is missing. There is no column for "a company did this." Because a company cannot do any of the three. A twenty-person business cannot ban a vendor, cannot write an export catalogue, and cannot take a stake in anything.
04For a company there is exactly one road: hold it yourself
If you are not a government, you cannot use any of those three tools. What is left is one thing, and it is less powerful than any of them — but it is also the only one that does not require anyone's permission.
Hold it yourself. The machine that does the work, the files it reads and writes, and the thing that remembers what happened — all in your own hands, in a form you can open and carry. Not rented. Not "in our secure cloud." There are four things that have to belong to you. Most teams are renting at least two of them and do not know which.
Where the thinking actually happens. Rented, this is a box in someone else's building with the speed capped by your plan. Yours, it is a box in your office.
Where your documents and instructions land. Rented, how long they are kept is decided by someone else's policy page. Yours, it is a disk you can unplug.
Which model answers the question. Rented, one company decides, and it can change that at any time. Yours, you can switch between several, including ones running on your own machine.
What the system has learned about your work. This is the one people forget and the most expensive one to lose. If six months of decisions live behind somebody else's login, you have not removed your single point of failure — you have relocated it.
And then there is a fifth thing, worth more than the other four combined, that almost nobody asks about before signing: the accumulated work. The instructions you tuned over months. The folder structure your assistants have come to expect. The rules about what may and may not happen. None of it has a standard format. None of it is exported by anything. Ask a vendor what happens to that if you leave, and the honest answers run from "you can copy it out by hand" to silence. Neither one is a migration plan. On this specific point — Memory follows the avatar, not the model — we go deeper in a separate piece.
Four things that have to be yours, plus the fifth that is easiest to forget. The right-hand column is how KarmaBox implements each one [7].
The three national stories above contain six kinds of cost. None of them is abstract — each one describes something that happens on a specific morning. The next section lines all six up against how KarmaBox handles them [7].
05How KarmaBox catches each of those six things
These six are not sales points assembled after the fact. They are the six gaps the three national stories actually leave behind: supply cut off, shadow use, shared memory, rules that stop working, work that cannot travel, and a switch with only two positions. Each one describes something that happens on a specific morning.
KarmaBox is built against that list. The judgement does not live in a prompt; it sits outside the model. The figure below is that structure: six problems on the left, the pinch in the middle where the judgement happens, and the six corresponding designs on the right. After it, we take each one in turn.
Where the six come from: the first three from the October government releases [1][3][4], the fourth and fifth from common migration failures, the sixth from the usual complaint about permissions. The right-hand side is the corresponding KarmaBox design [7].
| The problem raised above | The corresponding design in KarmaBox |
|---|---|
| One email can stop the whole team | The machine is on your side; models, files and memory never pass through a vendor login |
| A ban removes permission, not demand — shadow use goes unreviewed | Every action is recorded, including the ones that were refused |
| On a shared service your data sits in memory someone is about to reuse | One machine serves only you; no multi-tenant inference |
| Rules written into a prompt stop working when the model changes | Four action classes are judged outside the model, so swapping the model does not move the line |
| The work you accumulated over months cannot be taken with you | Memory is a file you can open, back up and delete |
| It is all-or-nothing, with nothing in between | Every action can sit in one of three states: automatic, ask first, deny |
The six problems raised above, and the six corresponding KarmaBox design decisions [7].
On the day supply stops, nothing stops
I said above that sovereignty is measured on the morning after something breaks. So let us look at that morning directly. The machine is on your side: a unit sitting in the office, around 128GB of memory, drawing roughly 170 watts — about a bright bulb and a bit. Two of them linked give 256GB, enough to run a larger model while other work continues. This machine does not go through any vendor's login, so "your account has been suspended" is not an event that can happen to it [7].
The model can be yours. For confidential material and high-volume repetitive work, the model running on that machine handles it, and not one byte leaves the room. Genuinely hard reasoning can still go to the best hosted model — but which route a request takes is your decision, not a default. We unpack that choice further under routing by task.
Memory is a file. This deserves its own paragraph because it is the least-asked question. What the system has learned about your work over these months is a file on your disk, not a conversation hidden inside someone's project. You can open it, read it, back it up, delete it. When a client asks what your AI did with their contract, the answer is to look at a record, not "it summarised it."
So back to the question: if the vendor closes tomorrow, what stops? The answer is the parts you deliberately sent to the cloud, and knew you were sending. Everything else keeps running.
Every action leaves a trace, including the ones that did not happen
I said above that the most awkward side effect of a ban is that people route around it, and the routed-around part is what nobody reviews. The root of that problem is not the ban. It is that the default is not to record. A system that only keeps "what was done" can never show you "what was attempted and blocked."
In our design there is a checkpoint between the moment the model proposes an action and the moment that action reaches the outside world. Every proposed action enters the log — including the ones that were stopped [7]. The value of this shows up a month later: you hold a map of what your assistants tried to do. That map is far more useful than a map of what they succeeded at, because the first one is your actual risk profile.
One machine serves only you
On 26 October, Cloudflare published an account of a fault in one of the AI models it hosts [6]. For about two weeks, a small number of customers received answers that contained text from other customers' conversations. It happened 155 times.
The cause was not an attack and not a clever trick. It was this: an AI needs a scratchpad to think on. When a request finishes, that scratchpad is handed to the next request. It is supposed to be wiped first. This time, part of it was not — and so the next customer saw fragments of what the previous one had been writing. Cloudflare put a sentence in its own report that I think everyone should read:
Pages are not currently zeroed between requests.
Cloudflare incident report, 26 October 2026 [6]
So — why does a shared service have this problem at all? Because a shared service is, by design, one machine serving many customers. That is the entire reason it is cheap: the hardware gets reused. And that is precisely why "leftover from the last person" exists as a category of risk.
A machine that serves only you does not have this failure. Not because it is built better, but because the thing that failed is the sharing itself. Your data sitting in memory that someone else is about to reuse — that entire class of risk simply does not arise on a machine that serves one customer.
The rules sit outside the model, so they do not move when the model does
A rule written into a prompt is a very politely worded suggestion. The reason is practical. Whether a rule in a prompt actually holds depends on three things: whether the model was trained to be obedient, whether other material in the context crowded the rule out, and whether the second and third assistant further down the chain can even see that sentence. You do not fully control any of the three, and changing the model means all three have to be re-established from scratch.
Our approach moves the decision outside the model. Four classes of action — send, publish, spend, delete — are judged on the server, after the model proposes the action and before anything actually happens. The outcome does not depend on which model answered this time [7].
I have watched this difference show up in one specific case. A team wrote "never touch the price list" into a prompt and held it for six weeks. In week seven they switched models to save money, and the next day the assistant folded a competitor's pricing page into a proposal for a client. Not one word of the prompt had changed. The thing executing that sentence had.
The work you accumulated is a file, not a black box
I said above that the fifth thing is the most valuable and the least asked about. Here, that work lands in files: the instructions you tuned, the folder structure your assistants expect, the rules you set about what is allowed to happen. They live on disk, not somewhere you cannot open. That means two very simple things — you can back it up, and you can take it with you.
It is not all-or-nothing; there is a middle setting
The most common complaint is that AI is either something you must watch constantly or something you let go of entirely. Neither is usable. We put every action into one of three states [7].
For things where failure is cheap and reversible. Reading a file, drafting a document, looking something up. If it is wrong, delete it and start again.
For anything that leaves the machine. Sending an email, publishing a post, spending money. The model prepares the action and stops, and you get a notification — on your phone, if you are out — stating exactly what it wants to do and to whom. One tap to approve, one tap to refuse, and a refusal requires a one-line reason, which goes into the log.
For what this particular role should never do at all. A research assistant does not get the ability to email clients. Not because it usually would not, but because that question should never reach it.
The middle setting carries the most design thought, because it is simultaneously a protection and a staffing cost. Someone reviewing four hundred approval cards a day is not approving, they are clicking confirm. So the settings have to be assigned by person, not by feature.
One more layer: the one doing the work is not the one checking it
When something comes out wrong, you need to be able to locate where — was the instruction wrong, was the file wrong, or should this step never have existed. When everything is packed into a single assistant, every change is a gamble that might break four other behaviours.
Our approach separates the roles. Each AI avatar has its own job, its own boundary, and its own set of tools it can reach. There is a direct benefit too: the one doing the work and the one checking it are not the same. An assistant grading its own homework produces a grade that means very little.
06Common questions
If the servers are in my country, do I have sovereignty?
No. Location answers where the data lands; it does not answer what you still have on the day the supply stops. A company can be fully compliant, fully domestic and deployed in its own data centre, and still be shut down by a single email — as long as the model on that machine checks in with a vendor every morning. Sovereignty is measured on the morning after something breaks.
Which of the three government approaches can a business copy?
None of them. Ban, control and buy are government tools: a twenty-person business cannot ban a vendor, write an export catalogue, or take a stake in anything. All three answer who holds the power. What a company can answer is a different question — who holds the risk.
What can actually go wrong on a shared cloud AI service?
Cloudflare's 26 October 2026 incident is a concrete example: over about two weeks, a small number of customers received answers containing text from other customers' conversations — 155 times in total. The cause was that inference memory pages were not zeroed between requests [6]. It was not an attack; it is a structural feature of sharing, since reused hardware is exactly what makes it cheap.
Why isn't writing the rules into the prompt enough?
Because whether a prompt rule holds depends on whether the model is obedient, whether other context crowded it out, and whether the assistants further down the chain can even see it — none of which you fully control, and all of which reset when you change models. Judging the four action classes (send, publish, spend, delete) outside the model is what keeps the line from moving on a model swap [7].
What is hardest to take with you when you switch vendors?
Not the data — the accumulated work: instructions tuned over months, the folder structure your assistants expect, the rules about what may and may not happen. It has no standard format and nothing exports it. That is the thing worth asking about before you sign.
07In closing
There is one thing worth carrying away from the three national stories: all three of them are deciding who holds the power. A twenty-person company cannot use a single one of those three tools. What a company can answer is a different question — who holds the risk.
Put the machine, the files, the model, the memory and that accumulated work somewhere you can open yourself. It is not a stronger position than a government's. But it is a position that does not depend on anyone else making a decision in your favour.
If your AI vendor sent you one email tomorrow, how many things on your list would stop?
Every government action above was read from a primary release. The Canadian figures (up to CAD $1.6bn, round targeting CAD $7bn, CAD $35.7bn valuation, and the four 2030 commitments) come from the Prime Minister's Office release [1]; the Chinese thresholds (10^26 operations, two trillion parameters) are reference indicators in a consultation draft [4]. Every source was visited and verified on 30 October 2026 — the numbered markers in the text open the originals directly.