The most urgent finding
The most acute sovereignty gap for most institutions is not a foreign government legal demand. It is that external AI model providers — Anthropic, OpenAI, Microsoft, Google — have ongoing access to your queries, decision logic, and outputs by design. Every day. In every API call.
Anthropic CEO Dario Amodei stated publicly: "I think the next tier of risk is actually AI companies themselves. The governance of AI companies deserves a lot of scrutiny."
The Models column of this matrix is where most institutions score at Level 1. That is the finding that should shape your board conversation.
Five questions for the board
1. Do we own our AI — or do we rent access to someone else's?
2. Can management prove — with technical evidence, not contracts — where every AI workload executes?
3. If our primary AI provider restricted or revoked access tomorrow, what would operationally happen?
4. Could we produce a complete AI decision audit trail from 18 months ago within 24 hours?
5. Do we control what our AI providers can see — or are we trusting their promises?
Why Most Institutions Score Poorly on Models and Agents
Across every institution type, the Models column and Agents column consistently score the lowest. This is structural, not incidental. External model providers — Anthropic, OpenAI, Microsoft, Google — have ongoing access to your queries, decision logic, fine-tuning data, and inference outputs by design. Every day. In every API call. This is not a legal demand scenario. It is the operational reality of how AI models are served.
FINAL GUIDANCE
Key Principle 1 — Sovereignty Is a Journey, Not a Destination
Most institutions will progress through maturity stages over time. Each stage builds the capability required for the next. Do not attempt to jump directly to full sovereignty without building foundational expertise.
Learning phase
Rent with standard governance
Build institutional AI governance knowledge and contractual discipline
Compliance phase
Rent with enhanced governance and BYOK
Achieve regulatory examination readiness; sensitive data technically protected at rest
Strategic phase
Compose — hybrid architecture
Sovereign core for mission-critical and highest-sensitivity workloads
Autonomy phase
Build — full sovereign infrastructure
Complete institutional command of AI infrastructure across all five ecosystems
Key Principle 2 — Control Is Non-Negotiable for Mission-Critical AI
The fundamental question every institution must answer:
When AI becomes mission-critical, who will control the infrastructure that produces it?
If the answer is 'we will', you have an AI strategy.
If the answer is 'someone else', you have an AI dependency.
Key Principle 3 — Start Now, Even If You Are Not Ready to Build
Every institution — regardless of current score — should take the following steps immediately:
1. Complete this assessment and the 5×5 matrix honestly — establish your baseline
2. Engage legal counsel to review all AI vendor agreements against your regulatory and contractual requirements
3. Classify workloads by sensitivity and criticality — not all AI workloads require the same governance
4. Negotiate enhanced contractual terms with AI model and agent providers — even if not yet building
5. Build internal team capability in AI governance progressively — the framework cannot be governed without people who understand it
6. Document your architecture for portability — never allow vendor lock-in without understanding its cost
7. Monitor for triggers requiring reassessment — regulatory changes, competitive events, client requirements, spend thresholds