Sovereign AI · Framework · 8 min read
Four questions of control, a system that passes only on all four, and a six-statement self-assessment that gives a number out of 30. The test from Own Your AI, with the European bank that stored everything in Frankfurt and scored 14.
Prem Naraindas
Founder and CEO, Katonic AI
The Sovereignty Test
who governs it · who runs it · who holds the keys · who can switch it off
Then six statements
a number out of 30
The Sovereignty Test is a four-question test of whether an organisation or a government controls an AI system, or only rents it.
Vinod Bijlani and I set it out in Own Your AI: The Sovereign Stack Playbook for Nations and Enterprises (2026), and the canonical version, with the self-assessment you can score on the page, lives at premnaraindas.com/sovereignty-test. It asks who governs the system, who runs it, who holds the keys, and who can switch it off. A system passes only on all four, and a six-statement self-assessment turns the answer into a number out of 30.
It starts from one definition. Sovereign AI is artificial intelligence developed, deployed and governed under the legal, operational and technical control of a defined jurisdiction, such that no external actor can unilaterally access, modify or terminate the AI system or the data it processes.
Three words do the work: access, modify, terminate. If an outside party can do any of the three without your consent, the system is not sovereign, whatever the contract calls it. The test ignores the place and asks who controls the system.
Part one
In March 2024 the chief information security officer of a European bank asked us a question we have heard many times since. “We store all our data in Frankfurt. We’re sovereign, right?”
Every box was ticked. The data sat in a sovereign region under German law and the regulator was satisfied. Foreign contractors ran the system day to day, the orchestration layer depended on a cloud service in another jurisdiction, and there was no path to update or replace the model. Location had been solved. Control had not been started.
Checklists measure location, because location is what a regulator can inspect. The Sovereignty Test measures control, because control is what fails on the morning a provider changes its terms, a court compels disclosure, or an export rule cuts a dependency.
Part two
The test asks four questions of control. Each has a short form, the one to put to a vendor, and a long form, the one to put to yourself.
Question 1
Legal control
Who governs it?
Which jurisdiction's laws govern the system and its data? Can a foreign court compel disclosure? Can a foreign regulator mandate changes?
Question 2
Operational control
Who runs it?
Who operates the system day to day? What are their nationalities, clearances and contractual obligations? Can they be compelled by a foreign entity?
Question 3
Technical control
Who holds the keys?
Who holds the encryption keys, the access credentials and the update mechanism? Does the system keep working if it is disconnected from its foreign dependencies?
Question 4
Strategic control
Who can switch it off?
Who decides what the system can do, what it cannot, and what it becomes next? Can an external actor unilaterally terminate access?
The fourth question is the one almost nobody has written down, and it is the one the Frankfurt bank failed. Nobody in the room could say who decided what the system would become next, or whether an external actor could end access. The answer, when it came, was a vendor’s name.
Part three
Four questions make an argument. Six statements make a score. Score each from 1 (not true) to 5 (fully true), add them up, and read the band.
Six statements. A number out of 30.
Score each 1 to 56 to 12
Fully dependent
13 to 18
Compliance-driven
19 to 24
Strategically sovereign
25 to 30
Fully autonomous
Statement 3 decides the band. A 1 or 2 on owning the weights means there is no tested path to a different model, whatever the other five say. Statement 1 is the half of legal control a regulator can make you solve. Statements 2 and 4 are operational and technical control. Statement 3 is strategic control. Statements 5 and 6 are how you know the other four are true rather than assumed. The bank scored 14, compliance-driven.
These six statements are the quick self-assessment of the Sovereignty Maturity Index, whose full form scores six weighted dimensions out of 100: data 25 per cent, compute 20, model 20, application 15, governance and compliance 10, security and resilience 10. The quick form takes ten minutes. The full index is the first deliverable of the 90-day roadmap in the book.
Part four
Four things are necessary and not sufficient. Each answers one of the questions and leaves the others open.
Necessary, and not sufficient.
What the test is notA sovereign region run by a subsidiary whose parent sits in another jurisdiction answers the operational question and leaves the legal one open. Location is not control.
A black-box model from a foreign provider, on a supply chain that can be severed, is still under external control. It just runs in your building.
Open weights called through someone else's hosted API in someone else's jurisdiction give you transparency, not control.
Total self-sufficiency is neither achievable nor desirable. The goal is managing dependencies, not eliminating them. Sovereignty is the capacity to choose and to switch.
This is not an argument against the cloud. A tenancy you control, with your keys, your choice of model, your update schedule and a tested path to leave, can pass inside a hyperscaler. A subscription you cannot leave fails in your own data centre. The test never asks where the software runs. It asks who can switch it off.
Part five
Six statements, each scored from 1 (not true) to 5 (fully true), give a number out of 30: where the training data is stored, whether critical systems survive the primary provider terminating access, whether the weights of sensitive models are owned rather than licensed, whether applications run offline or on another provider, whether governance policies are enforced, and whether systems are tested against adversarial threats and supply chain disruption. The bands are 6 to 12 fully dependent, 13 to 18 compliance-driven, 19 to 24 strategically sovereign and 25 to 30 fully autonomous. Statement 3 decides the band: a 1 or 2 on owning the weights means there is no tested path to a different model. These six statements are the quick self-assessment of the Sovereignty Maturity Index, whose full form scores six weighted dimensions out of 100.
No. Sovereign hosting answers the location question. The Sovereignty Test asks the control question: who can access, modify or terminate the system. A region can be sovereign while the AI inside it is not. Data in the right place, run by contractors who can be compelled elsewhere, on a model you cannot swap, fails on three of the four questions.
Yes. The test is not an argument against the cloud. A tenancy you control, with your keys, your choice of model, your update schedule and a tested path to leave, can pass inside a hyperscaler. A subscription you cannot leave fails in your own data centre. The test never asks where the software runs. It asks who can switch it off.
No. Open weights called through someone else's hosted API in someone else's jurisdiction give you transparency, not control. Open weights you run, update and can replace are a different matter, and statement 3 of the self-assessment is where the difference shows.
No. The phrase is now used three ways. Nada Kakabadse's essay for the Global Government Forum, "No one can switch it off: why AI is a new sovereignty test", uses it for the question a government faces. The Canadian Science Policy Centre's "Who actually decides? The sovereignty test AI for All must pass" uses it for a national programme. Both are arguments. The Sovereignty Test by Prem Naraindas and Vinod Bijlani (Own Your AI, 2026) is the test itself: four questions, six statements, a number out of 30. It was first published on the Katonic blog on 7 January 2026 as the Control Test and renamed in October 2026.
The hosting question has its own page, with the three questions to put to a hosting vendor: is sovereign hosting the same as sovereign AI.
Close
Run it on one system, not on the organisation. Score the six statements honestly, then write four sentences for your lowest statement: who holds the keys, who could compel disclosure, who could terminate access, and what you would do the morning after. If any sentence ends in a vendor’s name, that is your gap. Put the same four questions to the vendor, and time the answer.
Location is the half a regulator can make you solve. Control is the half nobody owns until you do.
Cite it as: Naraindas, P. and Bijlani, V. (2026). Own Your AI: The Sovereign Stack Playbook for Nations and Enterprises, chapter 2, “The Sovereignty Test”. Canonical page: premnaraindas.com/sovereignty-test. First published on this blog on 7 January 2026 as the Control Test; renamed in October 2026.
Prem Naraindas
Founder and CEO, Katonic AI
Prem Naraindas is the founder and CEO of Katonic AI and co-author of Own Your AI: The Sovereign Stack Playbook for Nations and Enterprises (2026). The Sovereignty Test, the Sovereignty Maturity Index and the self-assessment are on his site.
premnaraindas.com →§ Related articles
The six statements take ten minutes on the canonical page, and the result tells you which of the four questions to put to your vendor first.
