A chip maker’s engineers pasted proprietary source code and a confidential meeting transcript into a public AI assistant – three times in twenty days. They couldn’t take it back, and the terms at the time allowed the provider to train on it. The company banned the tools outright and started building its own.
That’s the first worry: what you send to a model leaves your building, and you can’t get it back. Confidentiality, IP, trade secrets – handed to a company in the business of learning from data.
The second worry is newer. A design software company built its product on a large AI provider’s model. The provider then launched a design tool of its own, competing directly with the company that had built on it. The stock fell.
And there is a third, which almost nobody accounts for. Companies that sell into government agencies have found their AI provider falling out with that same government – badly enough that officials threatened to blacklist it as a supply chain risk. Their federal customers became a problem, not because of anything they had done, but because of who they had built on. Some already had to say so in filings to their investors.
The concern, and the fix that looks obvious
The company whose model you build on has a roadmap, and roadmaps expand – sometimes through your market, if that’s where they go.
So the answer seems obvious: take an open model instead. One you can download and run yourself. Your hardware, your jurisdiction. Nothing leaves the building. Sovereign.
That answer is popular, it’s half-right, and it’s the reason this piece exists.
Three options, not two
Start with what “open” actually means, because it means two different things and the gap between them is where most sovereignty claims fail. A closed model you call over an API. An open-weight model you download and run – you get the trained model itself, the finished artifact, and nothing about how it was made. A genuinely open-source model gives you the artifact and the recipe: the training code, the data it was trained on, the documentation to rebuild it. Almost everything marketed as “open source AI” is actually open weight – Llama included.
So most of what you’d reach for is open weight: you get the file, not the recipe. Hold on to that distinction, because it’s where the sovereignty question is decided.
What you actually get when you run it yourself
So you download one and run it on your own hardware, in your own jurisdiction. What you gained is real: no prompts crossing the wire, no runtime dependency on someone else’s API, no provider who can change your terms or cut you off. All three of the worries you started with are genuinely addressed.
Now look at what you actually downloaded.
First, the work. Safety, patching, hosting, red-teaming, evaluation – all of it was being done by the provider, quietly, and none of it was itemized on the bill. Run the model yourself and every one of those jobs is now yours.
Second, and less obvious: the model arrived already trained. What went into it – the data, the filtering, what it learned to refuse and what it learned to favor – was all decided before you saw it, none of it visible in the weights, none of it reversible. You can inspect the model – the artifact – itself. What you can’t inspect is what made it. Where the training data – the corpus – came from stays opaque, and so does whatever IP exposure came with it. So does the bias: if the training data was narrow, that narrowness is now yours, shaping every answer the model gives, invisibly.
So one dependency didn’t leave. It froze. Hosting the weights makes you independent of the provider’s servers. It does not make you independent of the provider’s training.
Which is why there’s a third option
Genuinely open source is the only position that reaches the training-time dependency, because it’s the only one where the recipe comes with the artifact. The corpus is published. The training code is available. You can audit what went in and, in principle, rebuild the thing yourself. Provenance stops being a matter of trust.
That is the most sovereign position available at the model layer. It is also the most expensive, the least convenient and – today – the furthest from the frontier. Training from a published corpus is not a weekend project. The data has to be licensed or genuinely open, which costs money or costs quality. The compute has to be paid for. And the model you end up with will not match what the largest providers ship.
The closest thing to it on the commercial market makes the point better than any argument could. Nvidia’s Nemotron models publish the weights, the training recipes and a pre-training corpus of nearly ten trillion tokens, under a permissive license. It’s the most open a commercial model has been, and it is genuinely useful. But read their own documentation: at the time of writing, the published corpus is a subset of what the released model was actually trained on, and they say plainly that a model you train from it will not match the benchmarks of the one they shipped. Proprietary data went into the artifact you’re running, and it isn’t in the box.
So even the most open commercial model on the market stops short of letting you rebuild it. That’s not a criticism of them – publishing ten trillion tokens is a serious act. It’s evidence of how expensive real provenance is: even the vendors who go furthest stop before they get there.
Those aren’t defects in open source. They’re what sovereignty costs when it’s real rather than claimed.
And that’s the price
Line up the three positions and something obvious appears. The closed API is the cheapest, the easiest and the most capable. Open weights sit in the middle on all three. Open source is the most expensive, the hardest and the furthest behind. And the sovereignty runs in exactly the opposite direction.
That’s not a coincidence. Sovereignty means keeping control, and keeping control means doing the work yourself. Every job the provider was quietly doing – hosting, patching, safety, evaluation, and further back, the training itself – is a job you take on when you take the control. The cost isn’t attached to sovereignty for its own sake. The cost is the work, and the work is what sovereignty consists of.
And note what the money doesn’t buy. Normally the most expensive option is the best one. Here it isn’t: pay the most and you get the weaker model. You are not buying capability with that spend. You’re buying control, and taking a capability hit to get it.
Which means the choice isn’t between sovereign and not sovereign:
Run a closed API and you’re buying convenience and capability with sovereignty. Run open weights and you’re buying back control and residency, while the training stays someone else’s. Run open source and you’re buying sovereignty with cost and capability. Each is a defensible trade. None is free.
The only indefensible position is thinking you got both.
The questions worth asking
“Sovereign because it’s open” is not a claim, it’s a slogan.
The useful version is a set of separate questions. Ask them of any option on the table, and you’ll see which parts of sovereignty it actually delivers – and which it quietly doesn’t:
Where does the data sit? Residency – the easiest to satisfy and the one most often mistaken for the whole thing.
Who has legal reach over it? Jurisdiction. Not the same as location, and not settled by it.
Who can see it, and what may they do with it? Access. The chip maker’s question. Whether anyone reads it is one thing; whether they may learn from it is another.
Who operates it? If someone else runs it, patches it and keeps it alive, they hold something you don’t.
Who trained it, and on what? Provenance. The question open weights cannot answer, and the reason the third option exists.
And is the company behind it also, eventually, a competitor? Strategic alignment. The one nobody puts on the checklist, and the one that showed up in an SEC filing.
Can they be cut off? Sanctions, blacklists, export controls. The model still works – you just can’t use it, and neither can the customers you serve with it.
Ask them separately. Whoever is selling you sovereignty should be able to say which ones they mean – and which ones they don’t.
Originally published on LinkedIn