You love eating well. What you can’t stand is being at the mercy of someone else’s kitchen – their hours, their rules, the night they close early or change the menu you’d built your evening around. So you think about building your own kitchen. Best equipment, finest ingredients, no one else’s schedule. Your food, your terms.
Hold that thought. Because in AI, more and more companies are reaching for exactly that kitchen – and for good reason. Three cases from infra work you probably remember.
The first worry: what you send to a model leaves your building, and you can’t get it back. A chip maker’s engineers pasted proprietary source code and a confidential meeting transcript into a public AI assistant – three times in twenty days. The terms at the time allowed the provider to train on it. The company banned the tools outright and started building its own.
The second is newer. A design software company built its product on a large AI provider’s model. The provider then launched a design tool of its own, competing directly with the company that had built on it. The stock fell. The company whose model you build on has a roadmap, and roadmaps expand – sometimes through your market, if that’s where they go.
The third almost nobody accounts for. Companies that sell into government agencies have found their AI provider falling out with that same government – badly enough that officials threatened to blacklist it as a supply chain risk. Their federal customers became a problem, not for anything they’d done, but for who they’d built on. Some had to say so in filings to their investors.
Three worries, one instinct behind all of them: get out from under someone else’s kitchen. Your hardware, your jurisdiction, nothing leaving the building. Sovereign.
That instinct is popular, it’s half-right, and it’s the reason this piece exists.
Three options, not two
“Open” means two different things, and the gap between them is where most sovereignty claims fail. A closed model you call over an API. An open-weight model you download and run – you get the finished artifact, and nothing about how it was made. A genuinely open-source model gives you the artifact and the recipe: the training code, the data details, the documentation to rebuild it. Almost everything marketed as “open source AI” is actually open weight – Llama included.
So most of what you’d reach for is open weight: you get the file, not the recipe. Hold on to that, because it’s where the sovereignty question is decided.
What you actually get when you run it yourself
You download one and run it on your own hardware. What you gained is real: no prompts crossing the wire, no runtime dependency on someone’s API, no provider who can change your terms or cut you off. All three worries, genuinely addressed.
Now look at what you actually downloaded.
First, the work. Safety, patching, hosting, red-teaming, evaluation – all of it was the provider’s job, quietly, none of it itemized on the bill. Now every one of those jobs is yours.
Second, and less obvious: the model arrived already trained. What went into it – the data, the filtering, what it learned to refuse and to favor – was decided before you saw it, none of it visible in the weights, none of it reversible. You can inspect the model – the artifact – itself. What you can’t inspect is what made it. Where the training corpus came from stays opaque, and so does whatever IP exposure came with it. So does the bias: if the training data was narrow, that narrowness is now yours, shaping every answer the model gives, invisibly.
So one dependency didn’t leave. It froze. Hosting the weights makes you independent of the provider’s servers. It does not make you independent of the provider’s training.
Which is why there’s a third option
Genuinely open source is the only position that reaches the training-time dependency, because it’s the only one where the recipe comes with the artifact. The Open Source Initiative, which has defined what open source means for software since the late 1990s, now sets the bar for AI too: not just the weights, but the training and processing code, and a description of the data complete enough that someone else could build a substantially equivalent model. Not necessarily the raw corpus – that may be licensed or too large to ship – but enough to know what went in and, in principle, to rebuild it. Provenance becomes inspectable rather than opaque.
That is the most sovereign position available at the model layer. It is also the most expensive, the least convenient and – today – the furthest from the frontier. Training from a published corpus is not a weekend project. The data has to be licensed or genuinely open, which costs money or costs quality. The compute has to be paid for. And the model you end up with will not match what the largest providers ship.
The closest thing to it on the commercial market makes the point better than any argument could. Nvidia’s Nemotron models publish the weights, the training recipes and a pre-training corpus of nearly ten trillion tokens, under a permissive license. It’s the most open a commercial model has been, and it is genuinely useful. But read their own documentation: at the time of writing, the published corpus is a subset of what the released model was actually trained on, and they say plainly that a model you train from it will not match the benchmarks of the one they shipped. Proprietary data went into the artifact you’re running, and it isn’t in the box.
So even the most open commercial model on the market stops short of letting you rebuild it. That’s not a criticism of them – publishing ten trillion tokens is a serious act. It’s evidence of how expensive real provenance is: even the vendor who goes furthest stops before they get there.
Those aren’t defects in open source. They’re what sovereignty costs when it’s real rather than claimed.
And that’s the price
Line up the three positions and something obvious appears. The closed API is the cheapest, the easiest and the most capable. Open weights sit in the middle on all three. Open source is the most expensive, the hardest and the furthest behind. And the sovereignty runs in exactly the opposite direction.
That’s not a coincidence. Here, at this layer, sovereignty means doing the work yourself – because the deep dependency in a model is only reachable that way. That’s different from a dependency you accept on purpose because its consequences are ones you can live with; this is one whose consequences you don’t want to accept, and removing it costs work. Every job the provider was quietly doing – hosting, patching, safety, evaluation, and further back, the training itself – is a job you take on when you take the control. The cost isn’t attached to sovereignty for its own sake. The cost is the work, and the work is what sovereignty consists of here.
And note what the money doesn’t buy. Normally the most expensive option is the best one. Here it isn’t: pay the most and you get the weaker model. You are not buying capability with that spend. You’re buying control, and taking a capability hit to get it.
Think again about the kitchen. Best equipment, finest ingredients, no one else’s hours. But the chefs who made that food unforgettable stay at the famous places. And the recipes that took years to perfect were never written down for you to take home. You’re left with the most expensive kitchen in town and a cook who’s good, not great.
You didn’t buy the meal. You bought the kitchen.
Which means the choice isn’t between sovereign and not sovereign:
Run a closed API and you’re buying convenience and capability with sovereignty. Run open weights and you’re buying back control and residency, while the training stays someone else’s. Run open source and you’re buying sovereignty with cost and capability. Each is a defensible trade. None is free.
The only indefensible position is thinking you got both.
The questions worth asking
“Sovereign because it’s open” is not a claim, it’s a slogan. The useful version is a set of separate questions. Ask them of any option on the table, and you’ll see which parts of sovereignty it actually delivers – and which it quietly doesn’t:
Where does the data sit? Residency – the easiest to satisfy and the one most often mistaken for the whole thing.
Who has legal reach over it? Jurisdiction. Not the same as location, and not settled by it.
Who can see it, and what may they do with it? Access. The chip maker’s question. Whether anyone reads it is one thing; whether they may learn from it is another.
Who operates it? If someone else runs it, patches it and keeps it alive, they hold something you don’t.
Who trained it, and on what? Provenance. The question open weights cannot answer, and the reason the third option exists.
And is the company behind it also, eventually, a competitor? Strategic alignment. The one nobody puts on the checklist, and the one that showed up in an SEC filing.
Can they be cut off? Sanctions, blacklists, export controls. The model still works – you just can’t use it, and neither can the customers you serve with it.
Ask them separately. Whoever is selling you sovereignty should be able to say which ones they mean – and which ones they don’t.
Originally published on LinkedIn