Part three of Building the Recursive Enterprise: Businesses do not need to own every model, but they should control the data, memory and evaluation loop that make those models valuable.
In Part 1 of this series, I argued that recursive improvement needs a budget, an evaluator and a stopping condition.
In Part 2, I looked at how software development has spent decades building faster feedback loops—and how AI can now participate in more of that process.
That raises a final question:
Who controls the loop and everything it learns?
AI sovereignty is sometimes presented as a choice between sending everything to frontier models in the cloud and spending a small fortune running every model locally.
For most small and medium-sized businesses, neither extreme is sensible.
Practical sovereignty means controlling the parts of the system that are unique to the business: sensitive data, organizational memory, evaluation records, routing policies, credentials and the experience accumulated through repeated use.
The objective is not to own every model.
It is to retain control of the improvement loop.
Sovereignty is not isolation
Businesses have spent the past two decades moving infrastructure into the cloud. They rent storage, servers, databases and software from large providers because those providers can often deliver better reliability, security and scale than an SME could build independently.
AI does not make that model obsolete.
A company-controlled system running in AWS, Azure or Google Cloud can still be part of a sovereign architecture. The business can control its application, permissions, encryption keys, network policies, logs and data lifecycle without owning the physical server.
Sovereignty should therefore not be defined simply by location.
A more useful definition is control:
- Who can access the information?
- Where is it processed and retained?
- Which systems can act on the company’s behalf?
- Can the business change providers without losing its memory?
- Can it inspect and evaluate how decisions were made?
- Which parts remain useful when the current model is replaced?
A server under someone else’s building can still be company-controlled. A chatbot running on an employee’s laptop can still send its prompts to an external service.
“Local” and “sovereign” are not always the same thing.
AI changes the cloud boundary
Traditional cloud storage can be relatively passive.
A company may encrypt a file before uploading it and retain the key inside its own environment. The provider stores the encrypted bits but does not need to understand the document. AWS, for example, explicitly supports client-side encryption in which S3 plays no role in encrypting or decrypting the object.
AI inference is different because the model needs usable information.
A model cannot summarize a contract, analyse a codebase or evaluate a financial forecast unless that information becomes available somewhere inside the processing environment.
Generative AI also encourages people to provide much more context than traditional internet services did.
In the search era, we often described the problem:
What clauses usually appear in a distribution agreement?
In the AI era, we increasingly submit the problem itself:
Review this complete distribution agreement, identify the risks and propose revised wording.
The second request may produce a much better answer. It may also disclose customer names, pricing terms, negotiating positions and commercial strategy.
That information may contain the company’s “alpha”: the knowledge, assumptions and processes that distinguish it from its competitors.
Decide what must remain sovereign
Not every business document requires the same level of protection.
Public marketing material may be suitable for almost any approved model. Routine internal information might be processed through an enterprise AI service with appropriate contractual and technical controls. Confidential customer records, proprietary source code or unreleased strategy may require a private environment.
Some information should not enter a model at all.
A private key controlling a cryptocurrency wallet is an obvious example. The model may help prepare an unsigned transaction, explain what it does and request approval. It should not receive the secret required to authorize it.
The same principle applies to passwords, authentication tokens and encryption keys. These should remain inside deterministic systems such as hardware security modules, credential vaults or dedicated signing services.
A useful classification might be:
Public information
→ approved external models
Internal information
→ approved enterprise services
Confidential or differentiating information
→ private processing or carefully sanitized requests
Credentials and high-impact secrets
→ never exposed directly to a modelThe exact categories will differ between businesses. The important step is to define them before employees make their own decisions document by document.
The practical answer is hybrid
A sovereign AI architecture can combine three layers.
The private layer handles confidential documents, internal retrieval, organizational memory, classification, extraction and routine generation. It might run on company premises or inside a company-controlled cloud environment.
The external capability layer provides advanced reasoning, research, coding or multimodal capabilities when an approved external model creates sufficient additional value.
Between them sits a routing layer:
Business task
→ classify the information
→ select an approved environment
→ minimize or sanitize the context
→ run the task
→ evaluate the result
→ retain the useful experience internallyFor example, a private system could extract relevant clauses from a confidential contract and replace names, amounts and identifying details with neutral placeholders. A person reviews the sanitized question before it is sent to an external model. The answer returns and is applied to the original document inside the private environment.
The external model contributes capability. The business retains the source material and the record of what was learned.
Keep the boundary outside the model
AI systems are probabilistic. The same request can produce different answers across repeated runs.
That does not mean cloud retention policies are random. Storage, logging and network access are properties of the surrounding service.
Probabilism matters because the business should not rely on the model itself to enforce confidentiality. Asking a model to “remove anything sensitive” is not a dependable security boundary. It may overlook indirect identifiers, metadata or combinations of facts that reveal the source.
Models can assist with classification and redaction, but the final decision should be enforced by controls outside the model:
- information-classification rules;
- pattern-based redaction;
- data-loss-prevention scanning;
- provider allowlists;
- access controls;
- outbound logging;
- and human approval for sensitive requests.
The model may recommend where a task should go. The surrounding system should decide whether it is allowed to go there.
Local capacity is not a replacement for the cloud
A monthly AI subscription looks inexpensive beside a dedicated AI workstation. That makes local infrastructure appear difficult to justify, particularly for an SME.
But they are not equivalent purchases.
The subscription buys access to someone else’s models, infrastructure and service terms. Local or privately controlled capacity buys a processing boundary in which repeated workloads can be performed without sending the source material to an external model provider.
That does not make local AI automatically cheaper. Hardware must be purchased, maintained, powered, secured and eventually replaced. Local models may also be less capable than frontier services for some tasks.
The comparison should therefore be:
Cost + capability + privacy + reliability + strategic control
A business does not need to begin with a GPU cluster. It might start with an existing computer, one dedicated workstation, a self-hosted model in its cloud account or an enterprise service configured for an appropriate data boundary.
The purpose of this first investment is not to reproduce every frontier capability.
It is to establish a sovereign foothold.
Own the memory, not necessarily the model
Models will continue to change. Today’s preferred local model, cloud provider or agent framework may be replaced surprisingly quickly.
A business should therefore avoid building its organizational memory inside one model or vendor-specific interface.
Retain the durable assets separately:
Business problem
+ relevant context
+ model and workflow used
+ proposed answer
+ evaluation
+ human correction
+ observed outcome
+ costThese records become evaluation suites, regression tests, routing rules and examples for future systems.
A new model can then be tested against the company’s real work. If it performs better, it can replace the previous model without taking the organization’s accumulated experience with it.
The model is rented capability.
The evaluated experience is the asset.
Start with one controlled workflow
An SME does not need a complete sovereign AI platform before it begins.
Choose one repeatable workflow involving information worth protecting. Define which data must remain private, which external services are approved and how results will be evaluated.
Then run the loop:
Process sensitive material privately
→ send only approved context externally
→ evaluate the result
→ retain corrections and outcomes
→ improve the routing decision
→ repeatThis is practical AI sovereignty: not isolation from frontier intelligence, but the ability to use it without surrendering control of the business.
The models will change. The hardware will age. Providers and prices will move.
The improvement loop is the asset that can continue to compound.
Further reading
- AWS: Protecting data using client-side encryption
- NIST Generative AI Risk Management Profile
- Microsoft: Data privacy and security for models sold by Azure
- Google Cloud: Generative AI data retention and zero-data-retention controls
- CISA: Best practices for securing AI data
- OWASP: Do not rely on model instructions as security controls
Building the Recursive Enterprise
How businesses can enter the RSI curve early without surrendering cost control, judgment or sensitive data.
Leave a Comment