Kostas Karolemeas
Writing archive

Jul 31, 2026 · AI sovereignty

AI Sovereignty Starts With the Ability to Switch Models

Governments cannot outspend hyperscalers on AI infrastructure. A more practical form of sovereignty begins with adaptive harnesses that can route, evaluate, and replace models without rebuilding the system around them.

AI sovereigntymodel routingAI infrastructureopen-weight AIenterprise architecture
Layered teal and copper planes converge around a translucent aqua passage on a cream field

Kai A. Hartung recently made a compelling argument about the limits of AI sovereignty.

His central point is difficult to dismiss: access to a model is only the top layer of a much deeper dependency stack. Underneath it sit the provider, the weights, the serving infrastructure, the accelerators, the semiconductor supply chain, and the political authorities that can influence every one of them.

Open weights do not make those dependencies disappear.

I agree with that diagnosis.

Where I would take the argument in a different direction is the response. Governments should invest in public compute, domestic semiconductor capacity, energy infrastructure, open models, and research. But most governments will not build AI factories at the scale, speed, and replacement cadence of Microsoft, Amazon, Google, Meta, OpenAI, and the capital networks forming around them.

They should not make matching that scale the precondition for sovereignty.

A more practical strategy begins higher in the stack:

build AI systems that can move.

The Capital Gap Is Too Large to Treat as a Temporary Problem

The comparison is imperfect, but the orders of magnitude matter.

Microsoft said it expected roughly $190 billion in calendar-year 2026 capital expenditure, while still expecting Azure capacity to remain constrained. Amazon entered the year planning approximately $200 billion in 2026 capital expenditure, much of it connected to AWS and AI infrastructure. Meta projected $125 billion to $145 billion to support AI and its core business. Alphabet invested $91 billion in 2025 and said 2026 would require another significant step up.

These figures are not clean measures of AI-factory spending. They include servers, networks, data centers, cloud capacity, and other infrastructure. That is precisely the point. Frontier AI scale is not a building full of GPUs. It is a continuously renewed industrial system spanning land, power, cooling, networking, custom silicon, supply contracts, operations, and enough global demand to keep expensive assets highly utilized.

The European Union's response is substantial by public-sector standards. The Commission plans to mobilize €20 billion for up to five AI Gigafactories, complementing €10 billion of European and member-state investment in supercomputing infrastructure and AI Factories from 2021 to 2027. The gigafactories are explicitly designed as private-led public-private partnerships, not as a state-funded attempt to reproduce every hyperscaler.

That is the right instinct.

Public compute can widen access for researchers and startups, support sensitive public workloads, create bargaining power, anchor expertise, and keep strategically important capabilities inside a jurisdiction. It can shape a market that would otherwise concentrate further.

It is unlikely to win a permanent spending contest against companies investing hundreds of billions of dollars per year and recycling revenue from global cloud, advertising, commerce, and software businesses into the next hardware generation.

The physical constraints are growing with the financial ones. The International Energy Agency expects global data-center electricity consumption to roughly double from 2025 to 2030, with AI-focused data-center demand growing faster still. It also warns that grid and supply-chain bottlenecks are already delaying projects. Its latest analysis says the capital expenditure of five large technology companies exceeded $400 billion in 2025 and could rise by another 75% in 2026.

The frontier is becoming an energy and infrastructure business as much as a model business.

Open Weights Open a Door, Not the Whole Building

The release of Kimi K3 demonstrates both the value and the limits of open weights.

Moonshot AI published a model with 2.8 trillion total parameters and 104 billion activated parameters. Its weights, deployment code, and technical material give organizations options they do not have with a closed API: inspect the artifact, adapt it, choose where it runs, and retain access if the original provider changes its commercial terms.

That is meaningful sovereignty.

It is not the same as easy operation.

Even at four bits per parameter, the raw weights imply roughly 1.4 terabytes before runtime overhead, cache, redundancy, networking, and production serving are considered. A downloadable artifact can still require a sophisticated multi-accelerator system and a team capable of operating it reliably.

There is also a transparency gap. The Open Source AI Definition requires more than weights: it includes the code and sufficiently detailed data information needed to study, modify, and reproduce a system. The latest Foundation Model Transparency Index found that average transparency fell from 58 out of 100 in 2024 to 40 in 2025, with training data and training compute among the least transparent areas.

Open-weight is more controllable than closed access.

It is not automatically reproducible, auditable, affordable, or independent.

The Lower Stack Is Still Geopolitical

The dependency continues below the model.

The US Government Accountability Office identifies geographic concentration as a core semiconductor supply-chain vulnerability. About three-quarters of chips were manufactured and packaged in Asia as of 2022, with advanced logic and memory particularly concentrated in Taiwan and South Korea. The same report notes that the United States produced none of the world's leading-edge logic chips in 2022, despite leading in important parts of chip design.

That concentration gives governments leverage over who can obtain advanced compute. US export controls already regulate advanced accelerators, high-bandwidth memory, manufacturing equipment, and some related activities. The Bureau of Industry and Security explicitly describes high-bandwidth memory as critical to AI training and inference at scale.

The model layer is no longer immune either.

In June 2026, the US government directed Anthropic to suspend foreign-national access to Fable 5 and Mythos 5. Anthropic took the models offline more broadly because it could not reliably separate affected and unaffected users in real time. Access was later restored after the government lifted the restriction and Anthropic agreed to additional safeguards. Anthropic's own suspension statement and redeployment announcement show how quickly a frontier capability can move from global product to unavailable dependency and back again.

The episode was temporary.

The architectural lesson is permanent.

If a critical workflow fails because one named model disappears, the organization never controlled that workflow.

Sovereignty Is Not Binary

No organization is sovereign all the way down.

An enterprise running an open model in its own data center may still depend on American accelerator designs, Taiwanese fabrication, Dutch lithography, imported high-bandwidth memory, foreign networking equipment, open-source libraries maintained elsewhere, and an electricity grid it does not control.

That does not make every sovereignty effort meaningless. It means sovereignty has layers.

I would distinguish at least four:

  1. Decision sovereignty: you control the purpose, policy, permissions, and evidence required before the system acts.
  2. Operational sovereignty: you can keep an essential workflow running when a provider, model, price, region, or policy changes.
  3. Jurisdictional sovereignty: you can control where data and processing reside and which legal regimes apply.
  4. Infrastructural sovereignty: you control enough of the compute, energy, semiconductor, and supply chain to operate without external permission.

The fourth layer requires industrial policy, alliances, capital, and years.

The first three can be improved now.

That is why the model harness matters.

The Harness Is the Practical Control Point

A model harness is the control layer between an application and the models it may use.

In a basic implementation, it hides different APIs behind one interface. That is useful but not sufficient. A sovereign harness has to understand that models are not interchangeable components with identical behavior.

It needs to do at least six things.

1. Route by capability and policy

The application should request a capability—structured extraction, code generation, long-context synthesis, multilingual reasoning, private inference—not a hard-coded model name.

The harness selects from an approved set according to quality, cost, latency, jurisdiction, data classification, availability, and risk. Some requests may use a small local model. Others may justify a frontier service. Sensitive workloads may be prohibited from leaving a specific environment regardless of quality.

This is no longer a speculative pattern. The RouteLLM research showed that learned routing could reduce model costs by more than two times in some evaluations without reducing response quality. FrugalGPT demonstrated that cascades across models could match the best individual model in its experiments at dramatically lower cost. Production platforms are moving in the same direction: Microsoft's model router now combines model selection with automatic failover.

Cost optimization is the easiest benefit to measure.

Resilience is the more strategic one.

2. Maintain a live capability registry

Model marketing pages are not a routing policy.

Every approved model should have a versioned operational profile based on the organization's own workloads:

  • which tasks it can perform reliably,
  • which tool and schema formats it supports,
  • which languages and domains it handles well,
  • what data may be sent to it,
  • where it is hosted,
  • how much it costs,
  • and how it behaves under failure, overload, or long context.

The registry must be backed by continuous evaluation. NIST's AI Risk Management Framework says AI systems should be tested before deployment and regularly while in operation. Its 2026 work on monitoring deployed AI systems reinforces why: performance degradation, drift, fragmented logging, and infrastructure inconsistency are operational risks, not abstract governance concerns.

A model can only be replaceable if the organization knows what replacing it changes.

3. Keep state outside the model

Prompts, policies, tool definitions, retrieval, memory, workflow state, audit records, and approval logic should belong to the application control plane.

If the provider owns the conversation state, proprietary tool behavior, memory format, or agent loop, changing the model may require changing the product.

The model should contribute intelligence to the system.

It should not quietly become the system.

4. Design for degradation, not imaginary equivalence

Failover does not mean every model produces the same answer.

A replacement may be slower, more expensive, less capable, subject to a smaller context window, or unable to use a particular tool safely. The harness therefore needs defined degraded modes.

If the preferred model becomes unavailable, perhaps the system:

  • switches from autonomous action to recommendation,
  • reduces the number of tools it may call,
  • requires human approval,
  • breaks a long task into smaller verified steps,
  • or falls back to a local model for essential but narrower functions.

Continuity is not the promise that nothing changes.

It is the ability to change deliberately instead of failing accidentally.

5. Diversify control regimes, not only vendors

Two model names hosted in the same cloud region, dependent on the same accelerator supply, and subject to the same government are not two fully independent options.

Resilience analysis should record correlated dependencies:

  • provider,
  • hosting platform,
  • geography,
  • governing jurisdiction,
  • accelerator family,
  • model lineage,
  • and critical software components.

The objective is not maximal diversity for every request. It is knowing which apparently separate choices can fail together.

6. Test the exit

Portability that has never been exercised is an assumption.

Teams should regularly run critical workflows on the second-choice model, measure the regression, rehearse provider loss, validate data export, and record how long the switch takes. Procurement should treat those results as seriously as price and benchmark scores.

The relevant metric is not “supports multiple models.”

It is:

how much useful capability remains, and how quickly, when the preferred dependency disappears?

What Governments Should Fund

This argument is not a case against AI factories.

It is a case for being precise about what public money should accomplish.

Governments should fund shared compute where markets underprovide it: scientific research, universities, startups, public-interest models, language and cultural coverage, defense, health, and other sensitive sectors. They should continue semiconductor and energy investment because no software abstraction removes the physical stack.

But they should also invest much more aggressively in the portability layer:

  • open evaluation suites built around public-sector and critical-industry tasks,
  • reference architectures for multi-model routing and failover,
  • open protocols for tools, traces, model metadata, and policy enforcement,
  • procurement rules that require exportable state and tested exit plans,
  • shared registries of model capabilities, restrictions, and incidents,
  • smaller sovereign models for degraded but essential operation,
  • and funding for open training data, code, and documentation rather than weights alone.

This is less visually impressive than inaugurating a gigafactory.

It may create more immediate leverage.

A public AI factory concentrates scarce compute. A good harness, common standards, and credible evaluations make every compatible source of compute and intelligence more usable. They improve bargaining power with vendors, lower switching costs, expand the value of open models, and let public institutions adopt frontier services without designing themselves into permanent dependence.

Build Optionality Before You Need It

The original sovereignty argument is right about the depth of the problem.

The world outside the two largest AI powers cannot assume that downloading weights, choosing a European provider, or locating a data center domestically completes the job. Every layer rests on another layer, and several are concentrated enough to become geopolitical instruments.

But the inability to control the entire stack is not a reason to surrender control where it is achievable.

Governments probably cannot outbuild the hyperscalers.

Most enterprises certainly cannot.

They can build systems whose intelligence is not fused permanently to one model. They can own their policies, context, workflows, evaluations, tools, and operating evidence. They can route work according to capability and jurisdiction. They can preserve a degraded path when the frontier path closes. They can test switching before a crisis forces it.

That is not full technological sovereignty.

It is operational sovereignty.

And it is the form we can start building now.

Sources