Sovereign AI is a control problem, not a postcode problem
Keeping data inside a border is only one layer. The harder work is controlling the models, the compute and the access around them — and most governance teams have not covered all four.
- Sovereign AI infrastructure requires control over models, data, compute and access layers, not just geographic data residency. Self-reported m:…1062
- Domino reports that 62% of governance teams concentrate controls on the data layer, while 45% have adopted model-layer controls and 43% infrastructure-layer controls. Self-reported m:…1062
- Multiverse Computing and YellowDog.ai have partnered to support European sovereign AI by combining model compression with dynamic compute management. Self-reported m:…5184
- Intel has added NVIDIA OpenShell to the Intel Agent Toolkit, providing default-deny egress controls at program, host, HTTP method and path level. Self-reported m:…3366
- Corti's Agentic Framework includes human approval mechanisms for actions that require a person's decision and lets developers trace which models and tools agents used. Self-reported m:…4965
Four layers, not one border
Domino Data Lab argues that sovereign AI rests on control across four layers: the models, the data, the compute and the access that AI systems depend on. Data residency, the company says, only means data physically stays within a defined geographic boundary, while data sovereignty covers the laws and regulations governing access to it. Sovereign AI, in this framing, is the full-stack version of digital sovereignty, and Gartner frames technology sovereignty the same way, as a question of dependencies rather than locations. m:…1062
The gap between that framing and current practice is wide. Domino reports that 62% of governance teams concentrate controls on the data layer, while 45% have adopted model-layer controls and 43% infrastructure-layer controls. Only 23% of organizations use model registry and inventory tools, the company says, and 26% use model monitoring and observability tools. This suggests the layers most exposed to model theft and misuse are the least governed: Domino notes that distillation attacks, in which a competitor queries a model through its API to train a derivative, moved from research into practice as of February 2026, and that vendor support engineers can read production data regardless of contract terms. m:…1062
Compute is the scarce layer
The compute layer has its own bottleneck. Multiverse Computing and YellowDog.ai have entered a strategic agreement to support European sovereign AI, the companies say, combining Multiverse's CompactifAI technology with YellowDog.ai's dynamic compute management platform. The partnership aims to address the current GPU shortage by making models more efficient and aggregating available GPU capacity. CompactifAI uses quantum-inspired tensor-network methods to compress large models, while YellowDog.ai's Compute Manager helps organizations provision, schedule and optimize compute across cloud, hybrid cloud, multi-cloud and on-premises environments. m:…5184
The target sectors show where the companies expect demand: financial services, life sciences, advanced engineering, energy, telecoms, public services and defense-adjacent industries. The European Commission describes AI Gigafactories as large-scale, industry-led AI infrastructure facilities, which puts this partnership in the context of a wider build-out rather than a single product sale. Multiverse says it serves more than 100 customers, including Iberdrola, Bosch and the Bank of Canada. This suggests sovereign compute is being sold as efficiency plus scheduling, not just as new hardware. m:…5184
Control inside the agent stack
Healthcare shows why the access and governance layers matter once agents act on their own. Corti has expanded its Agentic Framework to provide an execution and control layer for developers, the company says, letting them coordinate agents and connect them to healthcare systems without building custom infrastructure. Its stack lets organizations choose their own models and deploy in preferred environments, including on-premises. The framework includes human approval mechanisms for actions that require a person's decision, and new capabilities let developers trace which models and tools agents used. Failures here are not abstract: Corti notes that autonomous agent failures in healthcare can negatively affect patient records and clinical workflows. m:…4965
The forecasts behind this push are large, and they cut both ways. IDC forecasts 1.2 billion AI agents operating globally by 2029 and 217 billion AI agent actions per day by 2029, as cited by Corti. Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps. This suggests scale and governance failure arrive together: the more agents act, the more the missing approval and tracing layers cost. m:…4965
Enforcement outside the model
Intel's addition to its Agent Toolkit takes a different approach to the same problem: enforce policy outside the model rather than inside its instructions. Intel has added NVIDIA OpenShell as an optional component to the toolkit, and OpenShell provides default-deny egress controls at the level of program, host, HTTP method and path. Enforcement operates outside the model's context window, so an agent cannot talk its way past the boundary. The toolkit also mints dedicated model keys for sandboxes that the agent never receives directly, and it can run Kubernetes nodes as Intel TDX confidential VMs for data-in-use protection. m:…3366
One detail matters for buyers: OpenShell integration is off by default in the Intel Agent Toolkit, and OpenShell itself is an open-source runtime licensed under Apache-2.0. The control exists, but it has to be switched on and wired through the Agent Sandbox API. That is the pattern across all four layers in this edition's evidence: the tools for sovereign control are available, while adoption, especially on the model layer, lags behind the data layer where most governance effort still sits. m:…3366
What is still unresolved
- The evidence does not give the sample or method behind Domino's governance percentages, so they cannot be checked against a wider population.
- Whether Gartner's expectation that open-weight models account for 50% of enterprise AI use cases by 2028 holds, and what it would mean for model-layer control.
- Whether the Multiverse and YellowDog.ai partnership has delivered measured efficiency gains for customers yet; the evidence describes aims and technology, not results.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.