Lo stato dell'IA sovrana

Many institutions treat Sovereign AI as a shopping list: a local model, a local cloud, a stock of GPUs. Each helps. None is enough. A country or a company can host a model at home and still depend on others for the orchestration, the operations, the tools, the chips or the control plane.

of global GPU cluster performance held by the US, May 2025¹

~75%

of global data-centre capacity for half of internet users outside China²

<10%

data-centre electricity use, 2024 to 2030 (IEA projection)³

415 to 945 TWh

of web pages in Arabic in the latest Common Crawl crawl⁴

0.67%

Control over AI is concentrated. The US held about three quarters of global GPU cluster performance and China about 15% in May 2025. Emerging and developing economies outside China hold half of the world's internet users but less than 10% of global data-centre capacity. For most of them, owning every layer is not on offer. Keeping the decisions is.^1,2

This paper defines sovereignty across six layers: data, compute, models, orchestration and workflows, operations, and legal jurisdiction. The layer most plans miss is orchestration: the software that decides which intelligence handles which task, under which rules. The economically rational answer is usually hybrid, set per workload on a five-level maturity model.

It is written for two buyers who share one architecture but buy it for different reasons. Governments buy national control, resilience and public accountability. Enterprises buy protection for regulated data, model independence and auditability. Every chapter ends with actions for both.

Numbers in small type point to the references at the back. Where a figure comes from a secondary report, the text says whose report it is. Chapter 1 sets out the frameworks. Chapters 2 and 3 cover why now and who is building what. Chapters 4 to 6 cover the stack, the law and language, and the economics. Chapters 7 and 8 are the playbooks and the test.

• Sovereignty is authority, not ownership. Control sits in six layers. A local model on a local cloud is still a dependency if the routing, the operations or the keys sit elsewhere. Ask who decides at each layer, not who owns the hardware (Chapter 1).
• Model sovereignty is not intelligence sovereignty. A national model is one provider. Models such as Nigeria's N-ATLaS plug into a governed layer beside other approved models. They are not rivals to that layer. They are among its best suppliers (Chapter 1).⁵
• Sovereignty has five levels, and most workloads do not need the top one. The scale runs from regional residency to fully air-gapped. Place each workload at the level its risk requires, and pay for isolation only where it is needed (Chapter 1).
• Start with one workflow, not a national AI platform. Set the security, deployment and governance pattern on one valuable, bounded task. Then expand horizontally, reusing the same gateway, keys, logs and partners (Chapter 7).
• Partners are part of the architecture. In emerging markets, Sovereign AI is delivered by a digital authority, a use-case owner, an infrastructure operator and an integrator together. The procurement route is part of the design, not an afterthought (Chapter 3).

Core recommendations

Use the decision tools

Sovereign AI is not a local model, a local cloud or a stock of GPUs. It is the authority to make the decisions that matter at every layer of the stack, and to keep making them when a supplier changes.

Sovereign AI is the ability of a country or organization to decide what happens at six layers: the data it feeds, the compute it runs on, the models that reason, the orchestration and workflows that route each task, the operations that keep it alive, and the jurisdiction whose laws bind it. Losing control of one layer weakens the rest.

Hosting is not the same as control. Data can sit inside your borders while a foreign provider holds the encryption keys, runs the control plane (the software that manages the servers) or can be compelled by its home courts. A national model can run in a national data centre while the workflows, tools and routing that put it to work run on a platform someone else controls. The test: who can switch the service off, read the data, change the model or change the rules, and under whose law?

The fourth layer is the one most plans skip. Orchestration is the software that decides which model receives which task, with which data, under which policy and with which human approval. Whoever runs it decides how the institution uses AI, whatever the model and wherever the servers sit.

Owning a model and governing intelligence are different things. A country can have a national model and still not decide how AI is used in its ministries. It can also govern AI well while using models it did not build.

Model sovereignty is the ability to build, host and adapt a model of your own. Intelligence sovereignty is the ability to decide which models may process which work, under your rules, with a record you own. The first is a supply question. The second is a governance question, and every institution faces it, whether or not it trains a model.

National models are arriving. HUMAIN released an Arabic assistant built on the ALLaM model and hosted in Saudi Arabia, according to press reports. Nigeria unveiled N-ATLaS, an open model for Yoruba, Hausa, Igbo and Nigerian English, built on Llama-3. Egypt's strategy targets a national foundation model, and Oman's AI programme lists an Omani language model. Morocco signed with Mistral AI, a foreign model maker.^6,5,7,8,9

This distinction settles a false choice. Ministries do not have to pick between a national model and the best global ones. They need one layer that can use both, under national rules, and switch between them.

Sovereignty is a spectrum, not a gate. Each level buys more control at a higher price. The useful question is not how sovereign an institution is, but which level each workload needs.

Other scales exist. The European Commission's Cloud Sovereignty Framework grades suppliers on five assurance levels, SEAL-0 to SEAL-4, across eight objectives. That scale scores the supplier. This model places the workload. Use both: set the level per workload, then test bids against it.^16,17

Governments and enterprises can use the same architecture. They buy it for different reasons, sign through different seats and measure success differently.

The difference matters in the design and in the room. A ministry asks whether the state could run the service if a foreign supplier left. A bank asks whether it could switch models without rewriting its workflows. Both questions have the same answer in the architecture: keep orchestration, keys and logs under your own control, and treat every model and every host as replaceable.

Government also carries a duty enterprises do not: domestic capability. A ministry that only rents AI cannot learn to run it. Enterprises carry a duty governments often do not: cost per task. A design that serves both keeps control where it matters and rents the rest.

Cognitive infrastructure is the compute, data and models that public services and companies think with. Like power or water, it now sits under every other service, and most of it is owned abroad.

Compute is concentrated. As of May 2025, the US held about three-quarters of global GPU cluster performance in Epoch AI's dataset and China about 15%. Epoch says the dataset covers only 10 to 20% of global AI supercomputer performance, and location is not the same as use. Money follows the same pattern: the AI Index 2026 reports 2025 US private AI investment of $285.9 billion, against $12.4 billion for China and $20.92 billion for Europe.^1,19

Emerging markets sit at the thin end. The IEA found that emerging and developing economies outside China hold half of the world's internet users but less than 10% of global data-centre capacity. S&P Global expects the UAE and Saudi Arabia to hold over 80% of their region's capacity by 2030, yet under 2% of the global total. A 2026 study puts Africa at about 0.6%.^2,20,21

Chips are a permission, not a purchase. The AI Index 2026 says TSMC fabricates almost every leading AI chip. In November 2025 the US Commerce Department authorised G42 and Humain to buy up to the equivalent of 35,000 Nvidia GB300 chips each, with security and reporting conditions, according to Middle East AI News. In May 2025 BIS began rescinding the AI Diffusion Rule and said a replacement would follow, according to Akin Gump. We found no confirmed replacement. The July 2025 AI Action Plan aims to export the full US AI stack to countries that join a US-aligned alliance.^22,23,24,25

A licence can be delayed, narrowed or given new conditions. That is one more reason to keep the decisions you can keep: models you can swap, hosts you can leave, and routing you control.

For emerging markets the problem is not only privacy. It is how to capture AI's productivity without exchanging one dependency for another.

Adoption is uneven. Microsoft's Q2 2026 diffusion report shows 18.8% of working-age people using AI worldwide in June 2026, with the UAE at 73.3%. Use was 28.8% in the Global North against 16.2% in the Global South, up from 27.5% against 15.4% in Q1. Microsoft describes the gap as widening.^26,27

Six stakes beyond privacy

• Local language. Arabic is the main language of 0.67% of pages in the latest Common Crawl crawl. Models learn mostly from English text, and Chapter 5 measures the gap.⁴
• Domestic IP. UNCTAD finds that about 100 firms, mostly American and Chinese, hold 40% of global private R&D investment. Work done only on rented platforms builds someone else's capability.²⁸
• Talent retention. Colt, citing the Uptime Institute, says nearly two-thirds of data-centre operators struggle to hire and keep qualified staff. Morocco targets 200,000 graduates trained in AI by 2030, and Egypt 30,000 trained specialists.^29,30,7
• Public-sector capability. A ministry that only rents AI cannot learn to run it. Oman's ministry funds AI projects in government entities and in the governorates.³¹
• Procurement sovereignty. The power to set the terms. The Commission's cloud framework makes a sovereignty score an award criterion in its tender.¹⁸
• The ability to switch. Under the EU Data Act, cloud providers must remove switching charges, including egress, from 12 January 2027. Buyers elsewhere can write the same into contracts.³²

The counter-argument is fair. Building is costly and slow. Epoch estimates xAI's Colossus cost $7 billion and drew about 300 MW. A country can buy hardware it cannot power or fill. That is why the goal is control of the decisions, not ownership of every part. Chapter 6 sets out the hybrid economics.³³

Each region pulls a different lever: capital in the Gulf, law in Asia, strategy and funding in Africa, early investment in South America. The figures come from announcements and press reports.

Also moving

• Saudi Arabia and the UAE: HUMAIN and AMD plan up to $10 billion for 500 MW of AI compute over five years, according to Techfinitive. The first 200 MW of a 1 GW Stargate UAE cluster is targeted for 2026, according to Gulf News.^38,39
• Egypt and Morocco: Egypt's 2025 to 2030 strategy shifts toward Sovereign AI built on local data. Morocco aims to add 100 billion dirhams to GDP from AI by 2030, anchored by a 500 MW data centre in Dakhla, per Reuters.^40,41
• India, Malaysia and Indonesia: the IndiaAI Mission was approved in March 2024 with ₹10,371.92 crore over five years. YTL completed an AI data centre at its 600 MW Kulai park. Indosat and GoTo say Sahabat-AI's serving data and GPUs stay in Indonesia.^42,43,44
• Kazakhstan and Mexico: Kazakhstan's AI law took effect on 18 January 2026. Mexico plans Coatlicue, a public supercomputer with 14,480 GPUs.^45,46

Regional frameworks set direction, not duties. The African Union endorsed its Continental AI Strategy in July 2024. ASEAN concluded DEFA talks in May 2026, with signing targeted for November 2026. Latin American countries adopted the Cartagena and Santiago declarations, as reported. None is recorded as binding today. Duties sit in national law, covered in Chapter 5.^47,48,49,50

In emerging markets Sovereign AI is rarely one buyer and one vendor. A coalition delivers it: a national digital authority, a use-case owner, an infrastructure operator and an integrator or cyber partner.

The technology architecture and the commercial architecture are one drawing. The party that hosts the system shapes the procurement route. The integrator shapes who operates it. Design one without the other and you get neither.

Chapter 1 named six layers. This chapter opens them up. The pattern is simple: own the thin layer that decides, and keep everything beneath it replaceable.

The AI gateway. Most day-to-day control sits in one entry point that every request must pass. It enforces policy, records each request, filters content, checks for data leaving the building, and routes calls to approved models. We found no published standard for gateways, so this is a design pattern, not an established product class.

Zero trust inside. NIST SP 800-207 defines zero trust architecture as granting no automatic trust based on network location or device ownership. Give each data store and pipeline its own identity and narrow permissions. The OWASP Top 10 for LLM Applications, 2025 edition, lists vector and embedding weaknesses beside prompt injection.^55,56

Keys and logs. With bring-your-own-key, the institution creates and holds the encryption keys, not the provider; Google's Data Boundary, for example, supports External Key Management. EU AI Act Article 12 requires high-risk systems to log events automatically so operation is traceable. A log that names the user, the data and the model for every call is the base of any audit.^11,57

An open-weight model is one whose trained weights you can download and run yourself. That is not the same as open source. The licence sets what you may do, and for sovereignty the licence is a control, like a key.

Read the terms, not the label. Llama 4 requires attribution and a separate licence from Meta for very large products. Earlier Gemma terms let Google restrict usage remotely if it believed they were breached. The Falcon licence terms were not readable on its card, so check them before commercial use.^62,65,63

Put national models on the same approved list. The governed layer treats them like any other provider, with the same keys, logs and tests, as Chapter 1 argues. Routing, not ownership, decides which model handles which work.

The same logic applies to chips. Serving software such as vLLM lists NVIDIA, AMD and Intel accelerators, and routes others through plugins. AMD's ROCm and Intel's Gaudi plugin show that a second vendor is possible. Whether it matches the first on speed and effort is not established in our sources.^66,67,68

Lock-in has a price, but public figures are scarce. We found no measured cost of leaving a hyperscaler. The EU Data Act ends switching charges, including egress fees, from 12 Jan 2027. Moves between regions of one provider may still be billed.^32,69

This page describes a design, not a result. HAQQ Sovereign AI is designed to be the governed orchestration layer this paper describes. It sits above infrastructure and models. It does not replace either. Caesar® connects AI to the information and systems an institution is responsible for.

• Access is designed to run through single sign-on, multi-factor authentication and role-based access.
• Rules are designed to apply to data before any call to an outside model, and the institution can review what a provider would receive.
• Calls are designed to route only to models the institution approves, with bring-your-own-key.
• National and local models are designed to be first-class providers: the approved list can hold a national model beside open-weight and frontier models, with routing set by policy.
• Every action is designed to be logged and attributed, with human review points where a workflow needs a person.
• It is designed to run in Sovereign Cloud, with environments in the EU, US and Middle East, or on the institution's own infrastructure. Hosting and model access are separate choices.

Restricted workloads are designed to use locally hosted models only.

Your data meets more than one legal system. Local law may demand that it stays, and foreign law may still reach the chips, the models and the training text. Jurisdiction is the sixth layer, and it binds the other five.

Read the EU timeline closely. Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved the high-risk dates but left general-purpose model duties and transparency duties on schedule for 2 August 2026.^79,80

Treat training sets as regulated data. The facts we hold show no rule written for training sets. Transfer and localisation rules still apply to any personal data inside one. Courts disagree on training text: Munich found infringement, while a US court called training on lawfully acquired books fair use.^81,82

This page describes laws as reported in the cited sources. It is not legal advice. Check current text with counsel.

A model that cannot read your language cannot serve your citizens. The web it learns from is mostly English.

Measure the gap. In Common Crawl's latest crawl, English is the main language of 41.9% of pages. Arabic is the main language of 0.67%. African languages together make about 0.05%, by our own sum of per-language rows. A 2025 preprint from African Languages Lab says 88% of African languages are severely underrepresented in computational linguistics.^83,4,84,85

Know the regional models. Jais 2 covers Modern Standard Arabic, dialects and English under Apache 2.0. Indosat and GoTo launched a 70-billion-parameter Sahabat-AI on 2 June 2025 for Indonesian, Javanese, Sundanese, Balinese and Batak. Nigeria's N-ATLaS covers Yoruba, Hausa, Igbo and Nigerian English, but sits on a foreign base model, Llama-3. Each is a candidate for the approved list in Chapter 1, tested on your own language before it is trusted.^64,86,5

Train on dialects and local values. A ministry assistant that misreads the dialect people write in will fail at the counter. Local data also carries local norms, such as how courts, health services and tax offices speak.

Admit the evaluation gap. The facts we hold contain no shared benchmark across Arabic, African and Asian languages. Developers' own benchmark claims are not independent.⁸⁷

Start with open weights. Qwen3.5 is Apache 2.0 and supports 201 languages and dialects. Fine-tune such a model on curated local data inside your perimeter, so data and weights never leave. Local language capability built this way stays a national asset.⁵⁸

Chips can arrive in months. Grids, cooling and skilled staff take years. Plan them first.

The International Energy Agency (IEA) estimates that data centres used about 415 TWh in 2024, about 1.5% of global electricity. A terawatt-hour (TWh) is a billion kilowatt-hours. In its Base Case, demand reaches about 945 TWh by 2030. For 2035 its scenarios run from about 700 TWh to over 1,700 TWh.^3,88

Grids are the bottleneck. The IEA says grid limits could put about 20% of planned data-centre projects at risk of delay, and new transmission takes four to eight years in advanced economies. Trade sources report waits of about 128 weeks for large power transformers. The IEA gives no grid figure for emerging markets, where Chapter 2 shows capacity is thinnest.^89,90

Racks draw far more power than before. An analyst estimate from SemiAnalysis (2024, not an NVIDIA specification) puts a GB200 NVL72 rack at about 120 kW, against about 40 kW for a dense air-cooled H100 rack. Racks at that density need liquid cooling, so check the site before you order the chips.⁹¹

Water is an open gap. Berkeley Lab, as cited by AIhub, estimated that US data centres directly used about 64 billion litres of water in 2023. Water figures for emerging markets are not in our evidence.⁹²

Sovereignty does not mean building your own GPU cluster. The economically rational architecture is usually hybrid. The decision is about control, not about owning every server.

Build cost per MW in the UAE, 2026 to 2030, shell and power only⁹³

$11m

Build cost per MW in Saudi Arabia, same basis⁹³

$13m

Sovereign cloud IaaS spending forecast for 2026 (Gartner)⁹⁴

~US$80bn

Building is the expensive end of the spectrum. 451 Research, cited by S&P, puts 2026 to 2030 build costs at about $11 million per MW in the UAE and $13 million in Saudi Arabia. That covers the shell and power, not the GPUs. Public capex versus opex comparisons are scarce in our evidence, so the full cost ladder is an open gap. Renting is growing: Gartner forecasts sovereign cloud spending of about US$80 billion in 2026, up 35.6% from 2025.^93,94

Right-size the model. Qwen3-235B-A22B is licensed Apache 2.0 and has 235B total but 22B active parameters, so each request uses a fraction of the model. Lelapa AI's InkubaLM has 0.4 billion parameters and covers five African languages, as reported in 2024. A small model you can run locally keeps more control than a large one you can only rent.^95,96

Price the exit with the entry. Rented capacity is only cheap if you can leave it. Write egress fees, notice periods and data return into every cloud and model contract, and keep the governed layer yours so that moving a workload is a routing change, not a rebuild.

National AI platforms are tempting and slow. The faster path is one constrained, valuable workflow that sets the pattern for everything after it.

Pick the workflow. Ask the people who own the work: which tasks would you give to AI today if you were allowed to put the data in? Then ask what stops you: residency, confidentiality, the law, infrastructure, accuracy or procurement. Choose one task that is valuable, bounded and owned by someone who wants it. The answers also set its level on the maturity model.

Set the pattern on it. The first workflow decides the security model, the deployment level, the approved models, the logs and the approval route. Get those right once. Then expand horizontally. The next workflow reuses the same gateway, keys, logs and partner route, so it is a change, not a new programme.

Test inside your boundary. Run evaluations and red-team exercises (adversarial testing by your own staff) on your own hardware. The AI Act requires providers of systemic-risk general-purpose models to run adversarial testing, a sound minimum to copy. Test against the OWASP Top 10 for LLM Applications 2025 and the NIST generative AI profile, and rerun a fixed test set on a schedule to catch drift.^97,56,98

A government sets the rules every buyer in the country follows. Four steps turn a strategy into rules that can be checked.

• Set a required level per data class. Place each class (personal, health, financial, state) on the five-level model. Saudi Arabia shows the legal base: SDAIA issued a regulation on transfers outside the Kingdom in August 2024, with safeguards such as standard contractual clauses.^71,99
• Write procurement rules that test, not trust. The Commission's framework grades suppliers from SEAL-0 to SEAL-4. Bidders must reach a minimum per objective, and a sovereignty score counts as an award criterion. Copy the structure and set your own minimums.^16,18
• Ask for exit rights, model choice and evidence. Ask for migration without lock-in, local operators, customer-only key control and evidence mapped to a public control set such as the CSA AI Controls Matrix. Read model licences: Gemma's terms let Google restrict usage remotely, while Qwen3.5 uses Apache 2.0.^{100,101,102,65,58}
• Create the institutions that enforce it. India's November 2025 guidelines created an AI Governance Group, an expert committee and an AI Safety Institute. Malaysia launched a National AI Office in December 2024. South Africa's draft policy prefers existing authorities to a single AI regulator.^103,104,105

Name the seven seats before you start

A sponsor is not a buyer. A minister can back a project and still buy nothing, and a security office can stop one that everyone else wants. If fewer than five seats are named, the project is not ready to start.

Start from the five levels in Chapter 1. Each level gets its own contract terms and its own exit plan.

Contract clauses that matter

• Data location and key control: named countries, and keys you hold. Google's Data Boundary, for example, lets customers keep keys outside its infrastructure.¹¹
• Operator nationality and sub-processors: who may run the service, and your approval of every sub-processor. AWS says only EU residents operate its European Sovereign Cloud; write such claims into the contract so you can audit them.¹²
• Audit rights, switching and egress, incident notice: access logs, a priced and dated exit path, and a fixed time to tell you about incidents.

Use European dates as benchmarks for your notice clauses. Under the AI Act, serious incidents involving high-risk systems are reported within 15 days, 2 days for widespread infringements and 10 days where a person has died.¹⁰⁶

Evidence for a regulator or customer

• A data-flow map and hosting locations by workload class.
• Key-custody records, access logs and model-usage logs, the kind of auditability the Commission framework asks for.¹⁰¹
• The operator roster, the sub-processor list and the result of your last exit rehearsal.
• A control mapping to a public set, such as the NIST AI RMF.¹⁰⁷

Any provider can say "Sovereign". Ask these eight questions, which cover all six layers. Each answer should be a yes backed by a contract clause, a document or a test. Treat a no, or a yes without proof, as a gap.

• Data: keys. Do you alone hold the encryption keys, so the provider cannot read your data?
• Data: export. Can you export all data, prompts and tuned models in open formats, within a time the contract states?
• Compute: supply. If the provider's country restricts exports, does the contract keep your service running?
• Models: weights. Can you run approved model weights on your own hardware without the vendor?
• Orchestration: routing. Can you add, remove or replace a model provider without rebuilding your workflows?
• Orchestration: logs. Are logs kept in your jurisdiction, and can you read them?
• Operations: switch-off. Does the control plane run inside your jurisdiction, and is the provider unable to suspend your service from outside it?
• Jurisdiction: courts. Can only your courts compel the operator to hand over data?

Watch two open questions

• Alliances. The US AI Action Plan of July 2025 proposes exporting the full US AI stack to countries that join a US-aligned alliance. Whether emerging markets form their own blocs is unsettled.²⁵
• Localised edge AI. Small open models such as Nigeria's N-ATLaS, built on a Llama-3 8B base, could run close to users. We found no deployment evidence yet.⁵

This paper is built from public sources only. Every figure, date and law in it carries a number that points to a reference at the back.

How we gathered the evidence

• Research window. Sources were collected and read in October 2026. Nothing newer is included.
• Source types. Government and regulator pages, official strategies, standards bodies, company releases, and institutional reports first. Press and trade reports where no primary page could be opened.
• Attribution. When a figure comes from a secondary report, the text says whose report it is. Where sources disagree, the text says so.
• Older figures. Estimates from before 2024 are marked as older context and are not used as headline numbers.
• Second check. Every cited fact was re-read against its source page by a second reviewer in October 2026. Claims the page did not support were removed or reworded. Where a page could not be opened, the text attributes the claim to the outlet that reported it.

What this paper does not contain

• No benchmark, price or customer data from HAQQ, and no unpublished figure.
• No legal advice. Laws are described as reported in the sources and change quickly.
• No ranking of countries. The aim is to show different paths, not to score them.
• No sourced claim behind our own frameworks. The six layers, the Sovereignty Maturity Model, the partner layer and the seven seats are planning frames drawn from the evidence, not findings.

Known gaps

Several useful sources were not reachable when this paper was written, and some evidence does not exist in public form yet. The main gaps are: public cost per megawatt and capital versus operating cost for sovereign compute, emerging-market water use, AI talent data outside the United States and the United Kingdom, a shared benchmark for Arabic dialects and African languages, and cost-of-exit figures. Where a gap matters to a conclusion, the chapter says so.