Picture a bank that has done everything its sovereignty policy asks for. Its customer data sits in a datacenter inside the country. A locally owned provider runs the systems, and the bank’s own employees handle daily operations. Each of those steps took time and money, and each one does what it promised.

Then the bank starts using an AI model to make the first pass through loan applications. It also deploys an AI agent that plans and carries out a series of next steps. For every application, the agent pulls records from several internal systems and an outside credit bureau. The bank hasn’t asked whether the model’s maker could be forced to switch it off, or mapped where the agent sends applicant data.

(Note: Of the companies mentioned in this article, my firm, Moor Insights & Strategy, has commercial relationships with AWS, Google, Microsoft and Salesforce.)

To me, “sovereignty” means control over who can reach your data and systems — and who could switch off the systems and AI models you rely on. I’d argue the control doesn’t average out across a setup, because anyone trying to reach your data or shut off your service only needs one way in or one choke point. By that measure, the bank’s protection now rests on the two elements it has probably checked least. The bank rents the model from its maker, so one command from that maker could halt loan decisions within hours. The agent also sends applicant details to the credit bureau with every application. Each loan decision depends in part on what the bureau says, so what happens if the bureau pulls the plug?

Keeping the bank’s data inside the country doesn’t keep it out of reach. A government can order a company under its jurisdiction to hand over data that company controls, even when the data sits in another country. So I’d treat every company holding the bank’s data as a possible way in, including the companies that run the model and the credit checks.

I think a lot of organizations are in the bank’s position, seeing sovereignty as important but still treating it as a kind of insurance. By insurance, I mean knowing that the business can adjust quickly if a new regulation, government policy or internal mandate arises. These companies expect their partners, providers and vendors to offer whatever protections or technical capabilities the new requirement calls for. Say that a regulator requires customer data to stay in the country, or the company’s board decides to drop an AI provider. The business expects to be able to switch on an in-country option that a vendor already sells, or move to another provider, all without rebuilding anything. The bank bought that kind of insurance for its own IT assets. But if an important rule changed tomorrow, the bank’s model and agent would be the slowest pieces to adjust.

Think Of An AI Model As A Supplier That Can Be Switched Off

This summer, a U.S. government order led Anthropic to switch off its two newest models for every customer, just three days after the model was launched. This affected both foreign and U.S. customers, including their access via the big cloud platforms. The model was gone for nearly three weeks.

I think the teams that are early adopters of the most capable new models carry the most exposure. I also expect governments to continue to have a say over who gets access to those models, and how soon. Google recently chose to release its new Gemini 4 Argon model to trusted security teams first, and it plans to open the model to businesses later. Google says it’s taking part in a voluntary process that gives the U.S. government an early look at new models.

Anthropic’s Fable model is available to all its customers. Anthropic also offers Mythos, the same model with fewer safety limits, for security and life-science work. For now, only a limited set of U.S. organizations can use Mythos. Anthropic says it’s working with the U.S. government to open it to more partners at home and abroad.

Model makers can also cut off access for their own reasons. For example, OpenAI plans to stop supplying its models to Cursor, which makes a popular AI coding tool, now that SpaceX owns it. OpenAI said it couldn’t be confident that SpaceX would stick to OpenAI’s terms of service. Cursor’s customers had no say in OpenAI’s decision, but they stand to lose access to OpenAI’s models inside Cursor all the same. Cursor also offers models from other companies, so its customers can switch.

For systems where losing the model would stop the business, I’d keep a second model tested and ready. If your current model comes from a U.S. company, keep in mind that a backup from another U.S. company answers to the same government. One option is an open-weight model, meaning one whose files you can download and run yourself. Its maker can’t switch off a copy running on your own systems, though a government can still bar you from using a particular one.

An AI Agent Takes Your Data Wherever Its Tools Are

An agent works by calling tools, meaning other systems it can search, read from or update. Every call sends data to wherever that tool runs, and some calls change something once they arrive. An agent handling travel, for example, might touch a booking service, an expense system and a payment provider, each with its own owner and its own location.

Most sovereignty controls I’ve seen were built to address people and places. They decide which staff can log in and where data gets stored. But an agent is software that acts autonomously based on whatever permissions it holds. Each time the agent runs, it decides which systems to call and what to send them. So with agents, which systems the software can reach and what it can do matters more than where it runs.

Plenty of agents today reach company systems using a stored key that works like a password. If several agents share a key, the key alone can’t show which one used it. To address this, identity vendors now sell ways to register each agent the way you’d register an employee, with its own identity and permissions. Microsoft’s agent-building tool, Copilot Studio, now gives every new agent its own identity automatically. Okta, AWS, Google Cloud, Salesforce and other large vendors have also agreed that every agent should get its own verified identity. I’d require that kind of identity for any agent that touches regulated data.

Before an agent goes live, I’d want four things written down. Which systems can it reach? Which of those sit with another provider or in another country? What can it change without a person signing off? And who keeps the record of what it did?

What Buyers Should Ask About The AI Model Behind Each Product

I’ve argued before that buyers should work out for themselves, system by system, which part of each vendor’s setup leaves them the least control. Once AI is involved, I’d expect the honest answer to be the model. For software with AI inside it, ask the vendor which model the product uses and what happens to your service if that model is switched off.

For every system where AI makes or shapes a decision, I’d write down two answers before signing the purchase order. The first is the model that you or your software vendor would switch to if the current one became unavailable, and how long the switch would take. The second is everything each agent can reach. Those two answers show whether your sovereignty insurance covers your AI.