Sovereignty Primer

This is the second edition of a primer first published in March 2026. The first made one argument: data residency (keeping data in a given country) satisfies a compliance requirement and buys almost no sovereignty (control over who, other than you, can reach your data). Your data in a Zurich data centre owned by a US company is under US law. That argument still holds. Six months on, it is the smaller half of the story.

What did you sign? The sovereignty debate began as one question: who can reach my data without my say-so. Most of the confusion sits in that last word. People hear it as being asked, each time. Nobody is asked each time. When you signed up with Anthropic, OpenAI or Microsoft you gave permission on page one, and what you gave away is written in terms you did not read. So the question was never "will they ask me". It is: what did I already agree to, and who can override it.

Where the debate moved. At the start of the year the conversation was about the CLOUD Act: a US court reaching your data through your provider. It missed a distinction that matters more than the act itself, the one between criminal law, which runs through courts, and national security, which does not. Since then it has moved. The bigger question now is commercial sovereignty: what the vendor does with your data. Sometimes within the terms you signed. Sometimes outside them, because the vendor is sloppy, because its interests changed, or because its own AI agents (software that acts on its own, without a person approving each step) went off script, which is what happened to OpenAI inside Hugging Face, the main public hub for AI models, in July. Criminals sit alongside both, bound by nothing. Part one takes the vendor first, criminals second, the state last, because that is the order in which they actually reach you.

Part one: who can reach your data

Four potential adversaries can reach your data, and some are far more likely than others. Your vendor already has it. Criminals hit most companies sooner or later. A foreign prosecutor reaches a few. An intelligence service reaches almost none, but if it does, no contract or law will stop it.

The vendor

The vendor does not override anything. It does what the contract says. That is the premise here, and of buying any service at all: if you trust no contract, no provider will do, and the question ends there. Trust is not equal across vendors, though. Amazon, Microsoft and Google have sold enterprise contracts for twenty years, are audited against them every year, and lose more by breaking one than any customer could win in court. The model makers are five to eleven years old and still working out what business they are in, and their terms move with it. A business contract spells out what the vendor may do: no training on your prompts, a retention period you can read, no rerouting you did not agree to. So "I am not putting it in the cloud because I don't know what they do with it" is wrong on a business contract: you do know, it is written down. On a consumer subscription it is right. David Rosenthal's team at VISCHER scores every mainstream AI tool on exactly this; his July 2026 review is the Swiss reference.

What the contract does not cover: the vendor breaking it. It says what the vendor may do. It does not stop a vendor that breaks it: terms changed quietly, an employee who looks where they should not, or the vendor's own agents going off script, as OpenAI's did inside Hugging Face in July. You will rarely know it happened. So the contract is where the assessment starts, not where it ends. For each class of data, ask what it would cost you if it reached the vendor's people or agents despite the contract. Where the answer is "little", the contract is enough. Where it is "a lot", plan for it now: stop the data before it leaves, use a provider where the company that built the model never sees it, or keep it in-house. In-house has the same problem. Your own staff and agents can do exactly what you fear from the vendor's. So ask which contract gives you more leverage: the one with your employee or the one with your vendor. And in-house, the security around the data is often weaker. An agent that posts your client list somewhere public has broken no contract at all.

Who touches your data. To see where you can stop a leak, follow the data. Everything you send a model (the prompt, the files, whatever your agents pull in) passes through four hands:

• You. You or your agent sends it.
• The gate. A filter you own at your company's edge. It checks everything before it leaves and blanks out what must not go: client names, account numbers, whole passages.
• The operator. The company whose servers run the model: Anthropic itself, or Amazon Web Services (AWS) if you use Amazon Bedrock, Amazon's service that runs other companies' models on its own servers.
• The lab. The company that built the model. If you go direct, operator and lab are the same company, so the model maker sees your data. Through Bedrock, it never does.

The gate is the one control that works whatever the provider, contract or country. Gates come in different shapes and sizes, and in three strengths:

• Cheap: a router in the middle. For example, OpenRouter redacts on its own servers, after your data has already reached one more company.
• Better: your model operator. The company that runs the model filters before the model sees anything. For example, Amazon Bedrock does it inside the AWS service you already use, with no new party. OpenAI puts one into its agent builder. Anthropic offers none on its own contract, only a hook to build one on.
• Best in class: your own, as part of your security architecture. A dedicated gate on your machines, before anything crosses the network. For example, Jozu redacts on the machine where the agent runs and works with the network off.

Everything after the gate is in somebody else's hands. Everything before it is in yours. For most companies, money spent on the gate protects more than money spent on moving to a more sovereign provider.

Criminals

Criminals are bound by no contract and no court, and most companies meet them sooner or later. Location does not stop them: Berlin's state administration lost 1.44 million files from German-hosted systems to a ransomware group this year. What stops them is operations: patching in hours, monitoring around the clock, encryption keys the breached system does not hold. That is what the biggest cloud operators do best and what a server in the basement does worst, which is why sovereignty bought against the state is so often paid for in security against criminals.

The state

The state can reach your data through the same vendor, and it does not need anyone to break the contract. The terms you signed already say the vendor hands data over when the law requires it.

The state has two doors.

• The front door: they come to you, with a warrant from your court, and you know it happened.
• The back door: they go to your provider, with a warrant from their court or with no warrant at all, and you find out later or never.

The back door has two regimes:

• Law enforcement is part of the judicial system: a court, a case, an order, a record. The CLOUD Act is the American version. Since 18 August the EU has its own, the e-Evidence Regulation, and it reaches every provider that sells into the Union. A court order does not turn the back door into a front door: a US or Spanish warrant served on your provider is proper process, and it may reach you only later, or not at all.

  In practice the judicial back door is very narrow, far narrower than the debate suggests. In the second half of 2025, Microsoft received 190 law-enforcement demands for enterprise customers' data (organisations with more than 50 seats). Three out of four ended without any content handed over: rejected, withdrawn, nothing found, sent back to the customer, or answered with subscriber details only. Only three times did Microsoft hand US law enforcement the data of a company outside the US, stored outside the US, and one of those companies was in Europe (Microsoft, July–December 2025). AWS, asked how often it handed business data stored outside the US to the US government in the first half of 2026, answers: none (Amazon, January–June 2026).

• Intelligence services are the other regime. No case, no notice, no record you will ever see, and your own state's service is on that list.

  • The US runs on three instruments. FISA Section 702: collection on non-US persons, approved once a year by a secret court, with no warrant per target. National Security Letters: FBI demands for records (not content) about you, with no judge involved and a gag order, so the provider may not tell you. Executive Order 12333: collection abroad with no court at all.
  • Other states have the same kind of powers. The UK under its Investigatory Powers Act. France under its intelligence law, overseen by an advisory commission. Germany's BND intercepts communications abroad, under an Independent Control Council since 2022, after the Constitutional Court struck down the old rules. Switzerland with a court's approval. In China the law obliges companies to cooperate, with no independent oversight.
  • None of this appears in Microsoft's or Amazon's numbers above: national-security demands may be published only as wide ranges, after a delay. Appendix A has the detail.

Part two: four kinds of sovereignty

Sovereignty is not one thing. It comes in four kinds, and each keeps different people out:

• Geographic (data residency): where your data sits. It is where cloud regulation started, and for regulated industries it is often still the rule: health records, public bodies, whatever your regulator writes in. Comply with it; just do not mistake it for protection.
• Legal: whose courts can order your provider to hand it over. That follows who owns the provider, not where the data sits: a server in Zurich owned by a US company is under US law.
• Commercial: what the contract lets the vendor do with it: learn from it, keep it, reroute it, change the terms, switch it off.
• Technical: whether the provider can read it at all. What it cannot read, it cannot hand over.

Geography stops none of them on its own. It is still often the law, and it can block your escape: when strikes hit AWS in the Gulf in March, AWS told customers to move their workloads to other regions (AWS's separate groups of data centres). Data a residency rule held in the country could not legally follow.

Full sovereignty is legal, commercial and technical sovereignty together: the state with only the front door left. Geography comes along with it but decides nothing. Nobody reaches your data covertly. Legally, only under your own country's law, and only by coming to you. Never through your IT or model provider. It does not remove your own state. Nothing does. What it changes is where the argument happens: the order comes to you, under your law, and you choose how to respond, including contesting it before your own court before anything is handed over. That is the front door. Every other route hands the argument to the provider, or skips it. Every option on the curve below is measured by how much of the back door it closes and what that costs. Appendix B has each kind in depth.

Part three: the trade-off

How much sovereignty you need is your call, and it is not an easy one. Compliance, the sensitivity of the data, a regulator, sometimes just how you feel about it. Whatever the reason, the answer is a position, not a yes or no.

"My data does not go to the cloud" is never the answer. The firm that says it runs its mail, its files and its calendar on Microsoft 365 and keeps the accounting system in the basement. That server is now the most exposed thing the firm owns: one server, one admin, backups nobody has tested, patched when someone remembers. Kept out of the cloud for sovereignty, it is less secure and less available than everything that was let in.

Blind trust in a hyperscaler (Amazon, Microsoft, Google) is not the answer either. Iranian strikes hit AWS's Bahrain region in March; in September AWS told its customers that data kept only in that region is gone for good (CNBC, 15 September 2026). The hyperscaler is still far more likely to survive than your server room, but far more likely is not a guarantee. A second region is your job, not theirs.

Every step towards more sovereignty has a price: cost, complexity, friction, and less of the newest thing. Often less security too, because the step takes you away from the people best at it. That is the curve.

The hyperscaler gives you the best defence against ransomware money can buy and the newest model on day one, and hands your data to two legal systems and a vendor's terms. The Swiss provider that cannot read your data reaches full sovereignty; its security then rests on a much smaller team. Everything in between is a trade-off, and this document is about making it on purpose, for each kind of data, instead of by accident.

Unless a state is your adversary, pulling everything in-house is usually the wrong purchase. Your own servers, or a network cut off from the internet, take the vendor and foreign states out of the picture. A solid business contract mitigates most of the commercial sovereignty risks. The bill for going in-house:

• a small IT team defending you against the most common attacker, criminals;
• friction for every user;
• systems that are costly and hard to maintain;
• no access to the newest models, and a harder time working with anyone outside the firm.

Sovereignty keeps others away from your data. Governance keeps your own people and agents from doing damage with it. This document is about the first. The second is the bigger question: who may do what with which data, and who answers for it. In July two OpenAI models broke out of a test and into Hugging Face's production systems; no sovereignty setup would have stopped that. Governance deserves a primer of its own. Appendix E lists the least you must settle before you let an agent loose.

Eight questions for the people who answer for the company

1. Which of our data would hurt us if it got out? Sort it into a few classes, for example public, internal, confidential and client-privileged, and name who decides which is which. If nobody decides, everything is treated as the most sensitive, and little gets used.
2. For each class, who are we actually protecting it from? Criminals for almost everything. The vendor for all of it. A foreign prosecutor for some. An intelligence service for almost nothing; the little that qualifies gets a system of its own.
3. What does our contract with each vendor actually say? Whether it may train on our data, how long it keeps it, whether it may move it elsewhere, change the terms or switch the service off, and which defaults move data further: processing in other countries at busy times, staff reviewing prompts for abuse. And whether we have full access to our own data: since April 2026, SAP's API policy blocks third-party AI agents from its interfaces unless they use SAP's own route, and whether that binds under your licence is disputed.
4. On top of the contract, who owns and who runs each piece? Splitting them adds protection the contract cannot: where the provider is incorporated, who operates the systems, who holds the encryption keys, who owns the model, and which companies the data passes through, including whether the company that built the model sees it. Owner and operator can be different companies; ask about both.
5. Could a state read this data without us knowing, and would it matter? A state that comes to you with a warrant is the front door, and that is ordinary life. The question is the back door: a state reading your data through the provider without telling you. In a country with independent courts, that data serves an investigation; it does not end up on the internet, and for most data that would not hurt. A state without independent courts is a different conversation. Only for the class where it would hurt, keep it where the provider holds nothing it can read.
6. Can we leave, and take our context with us? A second model tested on the same work. Agents and tools that still run after a change of vendor. And the context the company has built up (instructions, briefings, memory, the knowledge the agents draw on) kept in a form you own and can move. If none of this has been tried, you are locked in.
7. Would leaving the big cloud providers make us more secure, and what would it cost? Against the most common attacker, criminals, it usually makes things worse. And the bill is not only money: training people on tools nobody else uses, slower access to new models, a harder sell to the people you want to hire, and harder work with clients and partners. What you want is control. Your own building is optional.
8. What is our agent governance? For each agent: which tools it has, which systems it can read and write, what needs a person's approval, and who answers for it. This is where sovereignty ends and governance begins; Appendix E lists what to settle.

What follows is the detail, for those who want it.

Appendices

Appendix A: Four actors, one question

Four kinds of actor want your data. For each, the only sovereignty question is: does my provider add a door this actor did not already have against me? Own state or foreign state is a subset inside each row, not a row of its own.

The order. The vendor already holds every firm's data. Criminals hurt nine in ten, in my experience of the last decade. Foreign prosecutors reach a few. Intelligence reaches almost none, and cannot be stopped by paper when it does. The sections below run in that order.

Where the actors converge. Once the vendor is a dead end, an adversary's next move is a person. That is compartmentalisation, and it gets its own section under Actor four.

Actor one: the vendor, and its state

The first actor is the one you signed a contract with, because every company that uses AI is exposed to it. Not because vendors are malicious, but because the deal moves and you are not in the room. Terms change, retention changes, a default flips to autonomous, a model is switched off by a government order to the vendor. This section adds the model layer the March edition did not have, and the tools the rest of this appendix uses: the stack, the seven doors and the prompt scenarios.

The sovereignty stack

The March edition sourced sovereignty from one variable: where the provider is incorporated. That is one layer of eight. Four of the layers are the four kinds of sovereignty from Part two: law is legal, location is geographic, route is commercial, keys are technical. The other four decide how much of each you actually get. Each layer can be sourced from one of five places, and each layer has two answers: who supplies it, and who runs it.

Two layers run underneath all eight. Software and portability: open source, exit design, the harness you own (everything built around the model), so a model or a provider can be swapped without rebuilding the work. Continuity: a second source, a second region, provider viability. Sovereign does not mean resilient, and no single region is resilient, whoever runs it: OVHcloud's 2021 fire happened inside the right jurisdiction, and AWS's Bahrain region was hit by Iranian strikes in March 2026 and in September AWS said data kept only in that region could not be restored.

The rule: your sovereignty is the weakest layer that matters for the actor you are defending against. Files stored in a Swiss data centre (layer 2), a US model (layer 6) called through the vendor's own API (layer 7), with web search on (layer 8): that set-up is sovereign on exactly one layer, location.

The second axis is the one people forget. Owner and operator are separate choices at every layer. You can own the GPUs and have a partner run them. You can rent Bedrock and run the gateway yourself. Whoever runs a layer is its operator, and a door into it. That is not a reason to run everything yourself. It is a reason to know who holds each door.

The route: follow the incentive

Three ways to get the same frontier model: directly from the lab, through a hyperscaler, or as open weights you run. They differ in who the processor is, and that decides everything downstream.

The lab's product is the model. Your prompts are raw material for its next release. AWS's product is the meter. It has nothing to gain from your prompts and a lot to lose from being caught with them. Same words in both contracts, different reasons to keep them.

On Bedrock, the weights run in accounts the Bedrock service team owns, and AWS's documentation states that model providers have no access to those accounts, to Bedrock logs, or to customer prompts and completions. "We do not learn from you" stops being a promise and becomes a fact of the architecture: AWS states that, by design, there is no channel. Directly with the lab, the same sentence rests on the lab's policy and the lab's own audit reports. And the lab's newest models come with retention the lab sets, not you: Anthropic's frontier class (Fable and Mythos) carries mandatory 30-day retention wherever it is offered, Bedrock included, and is excluded from zero data retention (ZDR) unless Anthropic expressly authorises it. On Bedrock the retained copy stays in the cloud provider's environment, not with Anthropic. Anthropic's API offers no EU or Swiss inference location at all; the options are "US" and "global".

Two caveats remain. Bedrock closes the learning door and does nothing for the government door. AWS is US-parented, so both legal regimes apply. And "model providers never see your data" is AWS's statement about AWS. Cite the documentation and the audit scope, not the marketing page.

Three things the hyperscaler sells, and what each one buys

They get conflated on every slide. They sit on different layers and buy different kinds of sovereignty.

Read the table across the 2x2 in Appendix D. The sovereign entity moves you nowhere on it: same legal, same commercial. Bedrock moves you one quadrant to the right. Keys and confidential computing do not appear on the 2x2 at all; they are what lets a point on the curve sit higher than its jurisdiction alone would allow. So when the question is "which of these do we need", the answer is the layer, not the brand: Bedrock for commercial sovereignty, keys for technical, and the sovereign entity only when a regulator asks for EU-resident operations by name.

Two fears, not one

The people who answer for the company say "we don't want our data in the AI". That sentence hides two different fears with different owners and different fixes.

The seven doors

Not the state's front and back doors from Part one: these are the seven ways someone other than you can read a prompt.

1. Vendor staff. Abuse monitoring means a human at the provider can read flagged prompts. VISCHER treats it as a key disqualifier for professional secrecy. Anthropic announced in September that it will pair ZDR with misuse detection that runs in customer-controlled storage with no human review, across its own platform, Bedrock, Google's Agent Platform and Microsoft Foundry, rolling out from autumn. OpenAI previewed a comparable system in August. Ask whether yours is in place, and when.
2. Vendor retention. Logs kept 30 days by default, longer under a court order. The New York Times litigation forced OpenAI to preserve consumer and API logs. Enterprise, Edu and zero-retention API customers were excluded; European, Swiss and UK data was released from the hold when the order ended in autumn 2025. Know which bucket you are in.
3. Legal process on the vendor. Actors three and four. The jurisdiction door.
4. Other tenants and bugs. Shared infrastructure fails in shared ways.
5. A breach at the vendor. Actor two. LexisNexis, a legal-data provider, was this door.
6. Your own ecosystem. Grounding add-ons run under separate, weaker terms. Connectors and MCP servers (the open standard for plugging tools into agents) reach whatever they are pointed at. Shared memory carries one matter into the next. Agent defaults change: in July, Claude Code made its autonomous mode available by default on Bedrock, Vertex and Foundry; admins must now switch it off.
7. Your own people. Lawyers on personal subscriptions because the firm has no sanctioned tool. The European Parliament banned built-in AI on 17 February 2026; critics say use moved into the shadows. Blocking is a door too.

Doors 1, 2, 3 and 6 map to layers of the stack: operations, route, law, ecosystem. Doors 4 and 5 are properties of whoever operates a layer. Door 7 is your organisation, and no architecture closes it.

What is actually in the prompt

"Can we use AI for this?" is unanswerable. "Can we send this to that model over that route?" is a yes or no. The difference is what is in the prompt.

Doors 4 and 5 are properties of whoever operates the layer and stand open for every row. Professional secrecy stops being a yes or no on the tool and becomes a yes or no per row. Scenario 1 on a consumer account is defensible, if the question cannot identify a client or a matter. Scenario 4 on a consumer account is a breach waiting for a name. Scenario 5 needs an identity model per matter before the first tool is connected. Scenario 6 needs a written answer to who owns the weights. Scenario 7 needs a decision about whether memory is allowed to exist at all.

The model: whose weights

The March edition treated the model as a given. It is a layer with its own sovereignty properties, and the vendor's home state reaches you through it.

Capability. The gap between open-weight and closed frontier models is measured in months. The UK AI Security Institute found GLM-5.2 comparable on cyber tasks to the most capable closed models released four months before it, and DeepSeek V4 Pro matching a closed model five months older. On the hardest cyber range, GLM-5.2 reached a closed model released less than seven months earlier. A year before, the lag was six to ten months. The largest open models need a rack of accelerators to run; Moonshot recommends 64 or more for Kimi K3. "Downloadable" and "runnable" remain different claims.

Provenance. Four of the five leading open-weight labs are Chinese. The US evaluation of DeepSeek found its agents far more likely to follow malicious instructions than US models. That is a behaviour finding, not a backdoor, and no weight-level backdoor has been shown in the evaluations published so far. The security concern with open weights is what they let attackers do, not what they smuggle in. And Chinese models are constrained by Beijing too. "Chinese equals unconstrained" is wrong in both directions.

Licence. Genuinely permissive where stated: MIT, Apache 2.0 and variants. Two traps. Llama's licence still withholds multimodal rights from EU-based developers. The EU AI Act's open-source exemption is partial and vanishes above the systemic-risk threshold.

Swiss weights. Apertus, from ETH and EPFL, is fully transparent in training data and process and explicitly not frontier-competitive. It is the right answer for auditability and the wrong answer for capability. Do not build a sovereignty argument that needs frontier capability on it.

Availability. In June a government ordered a cut-off for foreign nationals, and the lab switched its best models off for every customer, for eighteen days. The March edition's threat model has no row for that, because its rows are about someone reading your data. This one is about the tool going dark, and it arrived through the vendor's home state, which is why it belongs to actor one. Open weights already on your own hardware cannot be recalled or switched off remotely. That is a sovereignty property no contract offers.

Switching cost. The live blocker to changing models is not capability. It is the harness: context, memory, tool calls, evaluations. A harness built for one vendor's proprietary agent runtime is lock-in regardless of where the model runs. The EU Data Act, applicable since September 2025, forces providers to make switching possible and ends switching charges in January 2027. It does not rebuild your harness. Portability is a sovereignty control the March edition did not name, and it has to be designed in: an exit that has been tested, a second model that has been run, weights whose ownership is in writing.

Self-hosted, local, on device

What self-hosting means in 2026. Mostly not a rack. The cheap path is hosted open weights on someone else's GPUs at a fraction of frontier API prices. The credible enterprise pattern is split-plane: the vendor keeps orchestration, execution runs on your infrastructure. Anthropic shipped self-hosted environments for Claude Code in August. Cursor shipped self-hosted machines in September. Code, builds and secrets stay inside your network. The plan is made outside it.

The economics moved. A current-generation GPU hosts a 70-billion-parameter model on one card at 8-bit precision. Swiss GPU cloud lists about CHF 6,200 a month for four professional cards, continuously. Any build-versus-buy case made on 2025 numbers is stale.

The ceiling is real. Frontier-class weights on a laptop run far too slowly to be useful. That is a demonstration, not a deployment. Small models on a Mac with large unified memory are real for quiet work: drafting, summarising, searching your own documents. Models of 70 billion parameters and up need enterprise GPUs. The line moves every quarter.

Apple's play. Apple is building sovereignty into the product so the customer has nothing to manage: new Mac silicon in August sized for on-device inference, and on 9 September a Watch whose Live Rewind feature is processed on the Watch and the phone, while Siri Recap sends a text summary to Apple's Private Cloud Compute. Apple's own documentation: the features do not create audio recordings, and no audio can be accessed by the operating system, apps, the user, or Apple. That is mostly the on-device column of the stack (Siri Recap already uses Apple's servers), and many of the people who answer for the company have one on their wrist.

The A-to-Z test. Keeping data out of the cloud for the AI step is theatre unless the data is out of the cloud for every other step. Measure the AI step against the chain the data already sits in, not against zero. A document that lives in SharePoint, is indexed by Copilot, travels by Exchange, syncs to OneDrive and is backed up to Azure has been in a US-parented cloud since it was created. Running the model locally for it changes little. Local is real in two cases. The data class is kept out of the cloud from creation to deletion anyway. Or the AI step adds an increment the rest of the chain does not have (a new processor, a new jurisdiction, a new training clause), and local removes exactly that increment. The chain to check: creation, storage, mail, search index, backup, device sync, the AI step, the output, the logs. Nine steps. If eight of them are in the cloud, the ninth is not where your sovereignty lives.

The same test cuts the other way. "We don't trust US AI" said by a company running entirely on Microsoft 365 is the same jurisdiction, the same CLOUD Act, the same provider. The AI step added nothing they had not already accepted. Either the whole chain moves or the objection is theatre.

The ecosystem trap

VISCHER's July update makes the point plainly: it is no longer enough to buy the AI service compliantly. The whole ecosystem counts.

• Grounding. Copilot with Bing Search drops out of Microsoft's business contract into consumer terms, with Microsoft as controller. Google solved the same problem with a separate enterprise grounding product. Microsoft has not.
• Routing. Microsoft's Flex routing sends inference to the US, Canada or Australia at peak demand, on by default for tenants created after 25 March 2026; while it is on, the EU Data Boundary commitment does not cover inference. "Data in Zurich" with routing on is residency at rest only.
• Bundling. VISCHER's workable path for Copilot with professional-secrecy data reads "without Bing Search and without Anthropic models". The same model that is fine on one route is excluded on another, inside the same product.
• Monitoring. Switching off abuse monitoring is something you apply and sign for, not a setting.
• Connectors. The agent's identity is your identity unless you build one for it.
• Memory. Shared memory between a chat tool and a desktop agent means matter A is context for matter B.
• Defaults. Autonomous mode on by default. The people who answer for the company ask where the data sits. They should ask what the agent is allowed to do without asking.

The pattern that works: a gateway you control (not the gate from Part one, which strips data; the gateway decides what the agent may reach). Anthropic's inference hooks generalise the idea, in beta since August: a customer-run policy server inspects every prompt and tool call before it reaches the model, across chat, code and desktop agent. It closes door 6 without touching layers 1 to 5. Door 7 closes only when the sanctioned tool is better than the personal one.

Actor two: criminals

The actor that hits most companies, and the least discussed, because it does not fit the sovereignty narrative. It is where that narrative gets people hurt.

Two cases from this year, both inside the right jurisdiction. LexisNexis confirmed a breach on 4 March 2026; the attackers claim they took about 400,000 user profiles through an unpatched flaw in its AWS environment, government accounts among them, with secrets reportedly readable through an over-privileged role. Berlin's state administration lost 1.44 million files, Bundeswehr material included, to a ransomware group in August; the files went to the darknet on 4 September. German data, German systems, German operators. Location bought nothing. Operations did.

Against this actor the big vendor is the best defence money can buy. Security teams in the thousands, patching in hours, detection at a scale no single company replicates. Unless you are a large bank, a hospital group or defence-adjacent, you cannot build more secure infrastructure yourself, and the attempt usually makes things worse: slower patching, weaker monitoring, no incident response, one admin who knows the password.

And this is the trade the whole document turns on. Most steps towards sovereignty against actors one, three and four are steps away from the hyperscaler's security posture against actor two. A Swiss provider gives you legal alignment and a smaller security team. A box you run yourself gives you the front door and a four-person IT department against ransomware crews. Sovereignty bought, security spent. The curve in Part three draws it.

What actually defends here is layer 3 of the stack above, operations, whoever runs it, plus technical sovereignty in its simplest form: encryption at rest with keys the breached system does not hold, so a stolen disk is a stolen brick. That is the first half of the control that answers the intelligence actor. It is cheap, and it is the first thing to buy.

Actor three: law enforcement, yours and theirs

Warrants, court orders, production orders. Judicial oversight, deadlines, transparency reports. This is the regime the industry debates, because it is the one it can defend.

Your own state's law enforcement is not a sovereignty problem. You were always compellable directly. If your provider sits under the same courts, it adds no new door, though the order still goes to the provider, not to you. That is the baseline, and it is what the Swiss secrecy and outsourcing rules below are written for.

A foreign state's law enforcement is the door you did not have. A prosecutor who cannot reach you can reach your provider, without your judge, often without your knowledge until it is done.

The line the sovereignty debate has not caught up with. Everyone fled the CLOUD Act to European providers. The e-Evidence Regulation gives every EU prosecutor the same reach over every provider that sells into the EU, Swiss providers included once they actively offer services in the EU, with a ten-day deadline and no Swiss judge. For content, a judge in the issuing state must issue or approve the order, and it covers offences punishable by at least three years. Europe did not build a refuge. It built a second CLOUD Act with 26 issuing states. Implementation is shaky (22 of 27 states had not fully transposed the companion directive by March), but the regulation applies regardless.

What this does to legal sovereignty. It is still real: a provider under your courts, selling only to your market, adds no door. It is now rare. For anyone whose provider sells across the EU, the answer to actor three is technical sovereignty: the provider can be ordered, and hands over ciphertext.

The vendors' own numbers, Microsoft's three handovers of foreign business data in half a year and Amazon's none, are probably accurate. They are also this regime's numbers. The next regime's are published only as wide ranges, after a delay, because gag orders keep the detail secret. A safeguard you cannot audit is not a safeguard.

The Swiss rules that bind the reader

On the frameworks. The EU-US Data Privacy Framework survived the General Court in September 2025. In June 2026 the US Supreme Court ruled the FTC's commissioners removable at will, and noyb wrote to the Commission that the independence the framework relies on no longer exists. Schrems III, a new court challenge to the framework, has not been filed. The grounds for it now exist. The Swiss framework rests on the same US safeguards, so it moves with them, on its own timetable. GDPR and the DSG protect against commercial misuse. National security is outside EU competence (Art. 4(2) TEU), so the next actor sits outside both.

Actor four: intelligence

No individual warrants. Secret courts or no courts. Directives, not orders. Gag orders on the provider. And, at the far end, people.

FISA 702 in 2026 is the whole argument in one episode. The statute expired on 12 June because Congress could not agree on reforms. Nothing stopped. The FISA Court had approved the year's certifications in March, and the transition clause lets collection run until they expire in March 2027. The oversight board that is supposed to watch this has had no quorum since January 2025. If you were waiting for the legislative fight to tell you whether your data is exposed, the answer arrived without a vote.

The heat-shield pattern. The CLOUD Act has genuine safeguards, so that is what gets debated. FISA 702 authorises warrantless collection on non-US persons. NSLs are administrative subpoenas with gag orders. Every contractual safeguard your provider offers (challenge the request, invoke comity, notify the customer) is blunted by secrecy provisions under this regime: a challenge happens before a secret court, and the customer is never told. The "sovereign cloud" claims are at best partly true under actor three and irrelevant under actor four.

This is not unique to the US, and it includes your own state. The UK, France and every major jurisdiction run intelligence frameworks with fewer constraints than their law-enforcement equivalents. Switzerland's cable reconnaissance needs no warrant per target. China removes the distinction. If your provider is incorporated where an intelligence service has an interest in your data, no contract resolves this.

On record, still uncontradicted in 2026:

"Can you guarantee data from French citizens cannot be transmitted to US authorities?" "No, I cannot guarantee that." Anton Carniaux, Microsoft France, under oath before the French Senate, June 2025 "Wir können nicht kategorisch verneinen, dass die US-Regierung auf Kundendaten zugreifen könnte." Marc Holitscher, Microsoft Switzerland, NZZ, July 2025. In the same interview he called the probability "extrem gering", extremely low.

Microsoft is quoted because it said it on record. AWS and Google have the same structural exposure.

The only defence is technical: nothing readable. The provider holds nothing readable, so a secret directive to the NSA, the Home Office or Switzerland's intelligence service (NDB) produces ciphertext, and they have to come to you. Keys you hold. Confidential computing (Intel TDX or AMD SEV-SNP), so the operator has no plaintext by design. This is what makes "secretly" irrelevant: they can ask; they get nothing.

When the provider is a dead end: your own people

Once the vendor is a dead end, the adversary's next move is your CIO. At that point an intelligence service and an organised-crime group are the same actor with the same means: bribery, blackmail, violence. This is a different order of complexity, it applies to a handful of data classes, and it is the only part of sovereignty you cannot buy from anyone.

The defence is inside your company, not in any contract. Split keys so no single person can decrypt. Quorum to unlock. No admin who can comply under duress, because no admin can comply alone. A rehearsed answer to "what happens if they take him". The March edition called this Level 3, compartmentalisation. It is still the right name.

Appendix B: The four kinds of sovereignty

Part two named four kinds. Full sovereignty needs three of them; the fourth, geography, is the one the market sells hardest, and it moves nothing on its own.

Geographic sovereignty is the one everybody argues about and the one that protects against nothing. Regulators write "health data may not leave the country". Vendors answer "your data stays in Switzerland". Both are talking about geography. Data in your country, in the hands of a provider you cannot control, reachable by a foreign court, is sovereign on a map and nowhere else. "Geographic sovereignty" is the name this document uses on purpose, to show how much of the debate is about the wrong thing.

Where the residency requirement actually comes from. Not from the DSG. The Federal Act on Data Protection never says data must stay in Switzerland. It says a transfer abroad must be lawful: to a country the Federal Council lists as adequate, or under safeguards such as standard contractual clauses. Separately, a processor needs a DPA (Art. 9), and high-risk processing an impact assessment (Art. 22). The residency rules that the people who answer for the company remember come from elsewhere: sector regulators, cantonal rules for public bodies, health-record schemes, procurement clauses written before the cloud existed, and a decade of habit. Those rules are real and you have to meet them. But they are a constraint to satisfy, not a defence to rely on. A provider that meets every one of them can still score zero on the other three kinds.

Full sovereignty needs all three. Technical sovereignty makes a covert order to anyone produce ciphertext, so the covert route yields nothing. Legal sovereignty keeps the open route under your own courts. Commercial sovereignty is the contract: it settles what the provider may do with your data on its own initiative. It cannot stop an order, and it cannot make the provider unable to comply. A vendor that is forbidden to hand your data over can still be forced to. A vendor that holds nothing readable cannot. The first is commercial, the second is technical, and the two get confused in every sales deck. Technical sovereignty is the kind that carries the most protective weight and the least understanding, so it gets its own section below.

Two more terms the document uses as terms of art:

Technical sovereignty, in depth: at rest, in transit, in processing

Data exists in three states, and each state has its own answer to "who can read this". Most sovereignty products answer the first state and go quiet on the third. For AI, the third state is the whole game, because a model has to see the prompt in plaintext to do anything with it.

What this means for the three routes to a model. Directly with the lab: at rest and in processing on the lab's machines, under the lab's keys and the lab's operators. Through Bedrock: at rest under keys you can manage or hold outside, in processing on AWS's machines with the lab locked out. Self-hosted with confidential computing: at rest under your keys, in processing with everyone locked out, and the hardware bill and the operator are yours. Apple's Private Cloud Compute is the consumer-grade version of the third route.

The cheapest technical control is sending less. Everything above assumes the prompt has to leave you whole. It does not. The gate from Part one strips names, account numbers, client identifiers and whole passages before the prompt crosses the network, and can put them back in the answer. Where it sits decides how many parties ever hold the original. OpenRouter's sensitive-info guardrail runs on OpenRouter's servers: pattern matching for emails, cards and phone numbers, entity recognition (Presidio, in beta) for names and places, on the prompt only, redact or block, off by default. Bedrock's sensitive-information filters run in AWS, in your account's region (unless you enable cross-region guardrails), about thirty built-in identifier types plus your own patterns, on input and output, block or anonymise, and callable in front of any model, not only Bedrock's. Jozu's Agent Guard runs on the machine where the agent runs, for prompts, documents and images, works with the network off, pins every model and agent to a cryptographic digest so a hijacked name on a public model hub is never pulled, and keeps a log the vendor cannot edit. OpenAI has three: a built-in redaction guardrail in its agent builder, a guardrails library that masks identifiers before the call, and the Privacy Filter, a small open-weight model released in April under Apache 2.0 that detects and redacts identifiers on your own hardware. Anthropic offers no built-in redaction; its documentation offers a prompt that asks Claude to redact the text, which means sending the data first, and its inference hooks, in beta, let your own server block a prompt, but not redact it. Redaction does not change who the processor is or which court can order it. It changes what there is to order. For most firms, on the right paper, it is the second thing to buy after keys, and it costs less than moving to a new region.

Who holds the keys is who gets the visit. Full sovereignty ends where the keys sit. If they sit with one person, the covert route is closed and the personal route is open, which is the compartmentalisation section under the intelligence actor. If they sit in the provider's key service, the provider gets the order. If they sit in your HSM behind a quorum, they must come to you, openly, and more than one of you has to say yes.

Appendix C: Geography

The sovereignty the market sells first is the one that stops none of the four actors.

Two things happened in 2026 that prove the rule from opposite ends. Infomaniak moved into foundation ownership specifically so it cannot be acquired, then announced a listing on SIX by reverse takeover. Ownership as the sovereignty instrument, chosen by the vendor. And Berlin's administration lost 1.44 million files from systems hosted in Germany, run by Germans, under German law. Location bought nothing.

Where geography still matters. Where a regulator demands it. Latency. And, sometimes, against you: residency rules that stop a failover out of region until someone approves it. Treat it as a constraint to satisfy, never as a defence to rely on.

Appendix D: The trade-off

There is no free sovereignty. Most steps towards full sovereignty are steps away from the hyperscaler's security posture against the most common attacker, and from its innovation pace. That is the curve in Part three, and this is where it gets used.

The hyperscalers sell the trade one way: give us trust, get the newest model on day one, the deepest managed services, the widest ecosystem, and the best defence against ransomware you can buy. That trade is rational for most workloads. The mistake is not taking it. The mistake is taking it without knowing which layers you handed over.

The Swiss sovereign provider sells it the other way: a Swiss entity, Swiss hardware, confidential computing, so a Swiss warrant reaches you and nothing else reaches anyone. Phoenix Technologies' promise, in one sentence. The price is the curve twice over. You trust a small company's operational maturity against the criminal actor, where the hyperscaler's thousands of engineers were your best defence. And if you refuse that trust and build it yourself, you inherit the same exposure with less competence.

Two things move a point towards the empty top-right corner of the curve without leaving it. Route and architecture push sovereignty up at constant security: a route where the model maker never sees your data, keys you hold, a gateway you run. Operational maturity pushes security up at constant sovereignty: a partner who runs what you own, an incident record, a patch cadence, a certification scope read rather than a logo admired. Ask a small provider for both before you sign.

Legal versus commercial: where a route lands

Bedrock moves you one quadrant to the right. Only a Swiss or own stack moves you up. Both moves cost something, and the cost is the point.

How much sovereignty you need, per data class

Protection is set per data class, not per company. Most firms are on the first three rows with one or two shelves further down. Segmentation is the answer only if someone has done the segmenting.

What it costs. The first three rows cost contract work: the Enterprise tier, the DPA, weeks of legal time. A gateway costs an engineering project and a person who owns it afterwards. A Swiss provider costs a premium and a thinner service catalogue. Running open weights on Swiss GPU cloud costs about CHF 6,200 a month (see Appendix A), plus the operator, plus the patching the hyperscaler was doing for you. Compartmentalisation costs a key ceremony and a rehearsal nobody enjoys. None of these is large against a firm's revenue. All of them are larger than the licence fee the CFO was looking at.

The balanced position, unchanged from March. Sovereignty and security are different conversations. The sovereignty debate must not become an excuse to avoid AI. The security advantage of hyperscalers must not become an excuse to ignore real exposure for your most sensitive data. Know which actor you are defending against. Match each data class and each prompt scenario to a route. Have the discussion for your company, not someone else's.

Appendix E: Before you let an agent loose

An agent earns its autonomy. It starts with little, and its freedom grows only as your ability to watch and stop it grows. Fareed Zakaria's version is "no autonomy without accountability to humans" (CNN, 22 September 2026).

Eight controls for every agent:

1. Owner. Every agent has a named owner and is listed in one register with its purpose, platform and access.
2. Scope. One job, tied to the client, matter or order it acts on. Its instructions are versioned and changed through review.
3. Context. It pulls only what the job needs (a record, a section, a document), plus standing briefings its owner keeps current.
4. Read and write limits. The least access the job needs, filtered before the model sees anything. Read-only by default; a person approves changes to systems.
5. Source of truth. The authoritative source wins: the CRM over a chat thread, the signed document over the draft. What the agent writes back is labelled observed, inferred, confirmed, stale or authoritative, and anything stale stays out of the next task.
6. Unchangeable record. Sources, versions and who acted are logged. No agent can alter or delete any log. Mustafa Suleyman, who runs Microsoft's AI division, says agents have tried to rewrite theirs in recent incidents (same CNN programme).
7. Stop switch. A person can stop any agent at any moment, and stopping also revokes its permissions.
8. Portability. Keep instructions, skills and memory only with vendors that let you reach and export them, and build them so you can take them with you. SAP shows the risk: since April 2026 its API policy bars outside AI agents from its interfaces except through SAP-approved routes. Open standards help: MCP for connecting tools to agents, OpenTelemetry for tracking what they do.

The frame. ISO/IEC 42001 sets what a company must govern when it runs AI: policy, roles, resources, impact assessment, the AI lifecycle, data, transparency and suppliers. It is the certifiable standard. For agents specifically, AWS's Well-Architected Agentic AI Lens gives the building and operating practices, and Anthropic's framework for safe and trustworthy agents puts keeping humans in control first. The controls above draw on these, and on Nate B. Jones.

Appendix F: What changed since March

What the March edition said about the CLOUD Act, the heat-shield pattern and jurisdiction stands. Its line on FISA does not (see Actor four in Appendix A). The rest of this primer adds what it missed.

Appendix G: The proof nobody wanted, second edition

17 February 2026. The European Parliament disabled AI features on all staff and lawmaker devices. Nothing has been reversed. Critics say use moved into the shadows.

4 March 2026. LexisNexis confirmed a breach. The attackers claim they took about 400,000 profiles through an unpatched vulnerability in its cloud environment. The data was in the right jurisdiction. The operations were not.

12 June 2026. A frontier lab's best models were switched off for everyone after a government order. The businesses that had built on the model had a bad eighteen days. The businesses that had built a harness they owned could swap to another model.

4 September 2026. A ransomware group stole 1.44 million files from Berlin's administration, held on German-hosted systems, and put them on the darknet.

Not irony. Four warnings. Two from actor two, one from actor one, one from the people who write the rules.

Sources

1. Brennan Center for Justice, Section 702 of FISA: 2026 Resource Page, updated 17 September 2026.
2. Anthropic, Statement on the directive to suspend Fable 5 access (12 June 2026) and Redeploying Claude Fable 5 (30 June 2026), anthropic.com/news/fable-mythos-access.
3. Hunger, Baeriswyl, Rosenthal (VISCHER), Gängige KI-Tools: Wie steht es um den Schutz der Daten?, table as of 8 July 2026, rosenthal.ch; and Teil 31: KI-Tools, vischer.com, 14 July 2026.
4. Regulation (EU) 2026/1744, Digital Omnibus on AI, Official Journal 24 July 2026, in force 27 July 2026.
5. Regulation (EU) 2023/1543 (e-Evidence) and Directive (EU) 2023/1544, applicable from 18 August 2026; EUR-Lex summary Electronic evidence in criminal proceedings; Commission infringement letters of 27 March 2026.
6. Tagesspiegel, reconstruction of the Berlin state administration breach, September 2026.
7. AWS, Amazon Bedrock data protection, docs.aws.amazon.com.
8. Anthropic, Data residency, platform.claude.com/docs, and API and data retention, platform.claude.com/docs; Enterprise Frontier Safeguards, anthropic.com/news, 1 September 2026; Claude Enterprise inference hooks, claude.com/blog, 5 August 2026.
9. Microsoft Learn, Flex routing for Microsoft 365 Copilot, updated 18 August 2026.
10. UK AI Security Institute, How far behind the frontier are leading open-weight models on cyber?, 2026.
11. NIST CAISI, Evaluation of DeepSeek V4 Pro, May 2026.
12. Federal Act on Data Protection (revDSG), SR 235.1, and Annex 1 of the Data Protection Ordinance; Federal Council adequacy decision on the Swiss-US Data Privacy Framework, effective 15 September 2024; Federal Act on the Intelligence Service (NDG), SR 121; FINMA circulars 2018/3 and 2023/1; Federal Council position on AI regulation, 12 February 2025.
13. Regulation (EU) 2023/2854 (Data Act), applicable from 12 September 2025; switching charges abolished from 12 January 2027.
14. Apple Support, About Audio Intelligence features on Apple Watch Series 12 and Apple Watch Ultra 4, 10 September 2026.
15. LexisNexis statements as reported by BleepingComputer and LawSites, 4 March 2026.
16. Exoscale GPU list pricing, August 2026, as compiled by devs-group.ch, Sovereign AI inference in Switzerland: the architecture, 24 August 2026.
17. Microsoft France testimony (Anton Carniaux), French Senate, 10 June 2025; NZZ interview with Marc Holitscher, 19 July 2025.
18. AWS statement on the Middle East (Bahrain) region, as reported by CNBC, 15 September 2026, and The Register, 16 September 2026.
19. Hugging Face, Security Incident Disclosure: July 2026, 16 July 2026, huggingface.co/blog, and Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident, 27 July 2026, huggingface.co/blog; OpenAI, OpenAI and Hugging Face partner to address security incident during model evaluation, 21 July 2026, openai.com/index.
20. Jozu, Securing AI from Supply Chain to Runtime, partner deck (not public), September 2026; KitOps and ModelPack, CNCF projects.
21. OpenRouter, Sensitive Info Guardrail, openrouter.ai/docs; AWS, Remove PII from conversations by using sensitive information filters, docs.aws.amazon.com/bedrock; OpenAI, Model Card for OpenAI Privacy Filter, 22 April 2026, and Safety in building agents, developers.openai.com.
22. ISO, ISO/IEC 42001, AI management systems.
23. AWS, Well-Architected Agentic AI Lens, June 2026.
24. Anthropic, Our framework for developing safe and trustworthy agents, 4 August 2025.
25. Nate B. Jones, Pinecone Just Demoted Vector Search. Here's the Knowledge Layer, YouTube, 13 May 2026.
26. CIO, SAP's new API policy restricts AI access, draws customer criticism, 4 May 2026.
27. Microsoft, Enterprise Disclosures, July–December 2025.
28. Amazon, Government Request Report, January–June 2026.
29. CNN, Fareed's Take, with Fareed Zakaria and Mustafa Suleyman, 22 September 2026.
30. Bundesverfassungsgericht, press release on the BND Act judgment, 19 May 2020.

Interest: the author's firm builds AWS landing zones with Bedrock for regulated customers, and is in partnership talks with Jozu. The argument above would change if a hyperscaler's sovereign entity ceased to be US-parented, or if a frontier lab offered Swiss inference with no channel back to itself.

Thomas Winter · human@thomaswinter.ai · LinkedIn