AI sovereignty, minus the data centre
You can't own a frontier model, and you don't need to. For a business your size, sovereignty means owning everything around the model: your data, your know-how, and a tested way out to the open models, which are now good enough to catch you if the terms ever change.
In June 2026 Palantir and NVIDIA announced a deal to build AI for the US government in which the agencies keep the hardware, the data and the model weights. A day later Palantir published a nine-point “AI sovereignty” manifesto. Most of it is about defence, but one line travels a long way: data retention is your treasure, transfer it at your peril.
I don’t run a defence agency, and I’m guessing you don’t either. But that line scales down further than the people selling it let on. Leave the data centres to governments. The question for the rest of us is smaller and more personal. How much of what makes your business valuable are you handing to companies that might one day compete with you, and what would you do if the terms changed tomorrow?
It’s a dial, not a data centre
Strip away the consulting diagrams and the enterprise wank, and AI sovereignty means keeping control of three things: your data, your know-how, and your ability to switch models without the business falling over. That’s it.
The mistake at both ends is treating it as a switch. Full sovereignty, your own model on your own hardware, is a nation-state game, and BCG reckons it’s an illusion even for most countries. Zero sovereignty, pasting client files into a free chatbot and building every process inside one vendor’s app, is the other failure, and it’s the common one.
Where your dial sits depends on what you sell. A cafe needs almost none of this. A trades business needs a little. An accountant, a lawyer, a consultant, a designer, anyone whose product is what they know, needs a lot, because the thing they’d be handing over is their margin.
Every paste is a disclosure
Every prompt you send is a disclosure to a company, under that company’s terms, and those terms split along one clean line: consumer versus business.
On the consumer plans, training on your chats is the default. ChatGPT Free, Plus and Pro use your conversations to improve OpenAI’s models unless you opt out, and Claude’s Free, Pro and Max plans have done the same since Anthropic changed its terms in August 2025, keeping chats for up to five years if you’re opted in. The business plans flip it. ChatGPT Business and Enterprise, Claude for Work, the developer platforms and Gemini in paid Workspace don’t train on your data by default, and they’ll sign a data processing agreement, which is simply a contract saying what they can and can’t do with what you send.
Most small businesses are on the wrong side of that line without knowing it. Cyberhaven’s 2026 report found nearly 40% of what employees feed AI tools is sensitive, and about a third of AI use at work runs through personal accounts. For Claude it was 58%.
The courts have started drawing the same line. In February 2026, in United States v. Heppner, Judge Jed Rakoff ruled that documents a defendant made with consumer Claude weren’t protected by legal privilege. His reasoning is the useful part: you can’t expect confidentiality from a tool whose own terms say your inputs may be used for training. He noted that business tools with no-training contracts might come out differently. Closer to home, the Law Society of NSW’s January 2026 guidance says putting client information into a public chatbot is “akin to putting it into the public domain”.
Opting out is not a contract. Ticking the no-training box on a consumer plan doesn’t turn it into a business tool. You still have no agreement, thin promises about how long they keep things, and exceptions you haven’t read. Anthropic’s own privacy policy, from July 2026, uses conversations flagged for safety to train its safety systems whatever your setting, and keeps them for up to two years. It’s a narrow exception, but it makes the point. The toggle is a courtesy. A contract is a contract.
Your landlord is opening shops
Data leaking is the risk everyone talks about. The quieter one is that the AI companies watch where people build valuable things on top of their models, and then build those things themselves.
It’s a pattern now. Anthropic has launched Claude for Financial Services and, in May 2026, Claude for Legal, each landing in a market where other companies had built on Anthropic’s own models. When it launched Claude Design in April 2026, Figma’s shares fell 7% in a day. Anthropic’s chief product officer had left Figma’s board three days earlier. OpenAI has connected ChatGPT to people’s bank accounts, is building a jobs platform pointed squarely at LinkedIn, and hired the founder of the contracts platform Ironclad to lead a push into legal. And when it really matters, access itself becomes the weapon. Anthropic cut the coding startup Windsurf off from Claude in the middle of its acquisition talks with OpenAI, and the $3 billion deal fell apart weeks later.
Now think about what that means for your prompts. If you’re an accountant, every clever workflow you build inside one of these products is a live demonstration of what accountants do, how they price it and which parts automate cleanly. It took you twenty years to learn that. Sent over as training data, it’s free market research for whoever decides to launch “AI for accountants” next quarter.
Keep it in proportion. Nobody at OpenAI is coming for your plumbing business. They hunt big markets with fat margins, so the risk sits with knowledge businesses, and even there it’s survivable: Harvey, the legal AI startup building right in the labs’ path, raised money at an $11 billion valuation in March 2026. The businesses that survive their landlord do what the rest of this piece describes. Deep workflows, more than one model, nothing critical trapped with one vendor.
There’s a quieter cost too, even if no lab ever enters your niche. If you and every competitor use the same model with the same generic prompts, you all end up producing the same thing. Renting the same intelligence from the same landlord is a very efficient way to turn your edge into the industry average.
Sort the crown jewels from the chores
Before you touch any settings, spend half an hour on two lists.
The first is the crown jewels, the things that make your business worth more than a competitor’s: your pricing logic, your method, client lists and histories, templates you’ve refined for years, the judgement in how you scope and quote, and any data nobody else has. The second is the chores every business does: emails, summaries, first-pass research, meeting notes, generic marketing copy, tidying spreadsheets.
The rule falls straight out of it. Chores can go to any decent model on any decent plan, so chase price and convenience. Crown jewels only ever touch tools where you have a contract, and the most concentrated of them, the whole method or the entire client list, deserve a real think about whether they belong in anyone else’s system at all.
The jewels leak in dribs, not heists. Nobody uploads “our entire competitive advantage.pdf”. They paste one scope, one pricing decision, one clever clause at a time, into a personal account, for years. The two lists only work if the whole team knows which is which.
Fix the defaults first
The first rung is boring, it takes an afternoon, and it beats what most businesses are doing now. Move work off personal accounts and onto a business plan, which flips you from training data by default to a contract by default. Turn training off in any personal account that’s still in use (in ChatGPT it’s under Settings, then Data Controls; in Claude, Settings, then Privacy). Get the data agreement and keep it on file. And write a one-page rule: which tools are approved, which list goes where, and what never goes in.
That isn’t sovereignty yet. It’s stopping the bleeding. But clients are starting to ask. In one 2025 survey, 59% of corporate legal departments didn’t know whether their own law firms were using AI on their matters, and the ones who care are starting to write it into contracts. “Here’s our agreement” is a much better answer than a shrug.
The open models got good
This is the part most small businesses haven’t caught up on. The open models got good. Not good for free. Good.
An open model is one whose brain you can download as a file. A file can’t phone home, so whoever runs the computer it sits on decides where the data goes. Hold onto that, because it clears up the biggest fear. The current crop includes Kimi K2.5, DeepSeek’s V4 line, GLM, Qwen and NVIDIA’s Nemotron, and yes, most of them come from Chinese labs.
The fear mixes up the model and the service. Use Kimi through its maker’s own app and your data goes through Chinese infrastructure on Chinese terms. Run the identical downloaded model on a Western host and it never goes near China. OpenRouter puts more than 400 models behind one account and lets you filter the hosts by how they treat your data. Groq (a US chip company, no relation to Musk’s Grok) serves open models very fast and doesn’t train on what you send. AWS Bedrock runs Kimi K2.5 and DeepSeek V3.2 on infrastructure your other business software already trusts. One catch: the same model can behave differently depending on who hosts it. Kimi’s makers built a checker that found its accuracy at using tools ranged from 100% on their own service down to 83% on some cheap hosts, so test the host you’ll actually use.
For Australians it gets stranger. Anthropic has no Australian data residency (it opened a Sydney office in March 2026 and says residency is “being explored”). OpenAI will store your data here but processes your prompts offshore. Azure has no Australian data zone, and Google’s commitments cover the US and EU. The one place an Australian business can run serious models with prompts processed onshore is AWS Bedrock in Sydney, running Kimi K2.5 and DeepSeek V3.2. Sit with that for a second. The most sovereign AI an Australian small business can rent in 2026 is a Chinese model, on American infrastructure, in Sydney.
Then there’s the price. Models are billed per million tokens, the chunks of text they read and write. Claude Opus 4.8 costs $5 per million going in and $25 coming out, GPT-5.5 costs $5 and $30, and Kimi K2.5 about $0.60 and $3. Call it eight to ten times cheaper, which for repetitive work is the difference between a line item and a rounding error. Big companies went the other way last year, with open models’ share of their workloads falling from 19% to 11%, because they’ll pay for support and compliance. Your maths is different, but it’s a reminder that switching isn’t free.
The homework takes an afternoon. Take three real chores, run them through your usual tool and through two open models on a few dollars of OpenRouter credit, and compare them like a buyer rather than a fan. For most routine work you’ll struggle to tell them apart. That’s the real sovereignty moment. The day you know you’ve got a way out, your main supplier stops being a dependency and becomes a choice.
Keep what you know in files you own
Switching is only painless if your know-how isn’t trapped inside one vendor’s app, and this is the most neglected move of all. It’s also free.
Look at what leaves with you if you go today. ChatGPT’s export gives you your conversations, but not your memory, custom instructions, Projects or custom GPTs. Claude’s export is a data dump you can’t import anywhere. Everything the tool has learned about your business is knowledge you’d be paying to keep visiting. One thing worth doing this week: ask the model to write out everything it knows about you, your business and how you like things done, and save that document with your own files. That’s your memory, extracted.
From there, keep everything a new model would need in plain files in your own storage: your prompts, your processes, your reference material. When a model needs context, hand it the file. When you switch, nothing’s lost, because the new one reads the same folder.
The ten-task test. What turns switching into a decision instead of a leap is a small test. It’s just a folder of your ten most common real tasks, each with a known good answer. When a new model comes out, run the ten and mark each one pass or fail in a spreadsheet. Twenty minutes, and “the internet says this model is amazing” becomes “it beat what we use on seven of ten and costs a tenth as much”.
Why bother? Because the terms do change, just not how you’d expect. Prices have mostly fallen. Everything else moves. OpenAI removed GPT-4o and seven other models overnight in August 2025 and had to bring them back after the backlash. Anthropic added weekly limits to Claude Code the same month. Cursor’s “unlimited” plan became metered. And models for developers get retired on 60 days’ notice at Anthropic and as little as two weeks for previews at OpenAI. With your know-how in your own files and a test you trust, any of that is a Tuesday rather than a crisis.
The top of the ladder
The full version, your own model on your own hardware, is real and more within reach than people think. Free tools like Ollama and LM Studio turn a capable machine into a private AI server. A $500 graphics card runs the small models, a $1,500 to $2,000 machine runs surprisingly capable ones, and NVIDIA’s DGX Spark puts 128GB of AI memory on a desk for $4,699. Nothing leaves the building.
Go in with the right expectations, though. Local models trail the best hosted ones, and hosted open models are now so cheap that a box of your own rarely pays for itself. You buy it for privacy, when data legally or contractually can’t leave your premises. For almost everyone else it’s cosplay. I’ve written separately about when running your own is worth it.
Rent the frontier, own the exit
None of this means stop using ChatGPT or Claude. They’re the cheapest research department you’ll ever have, and on a business plan with training off they’re fine for most work. Use them. Just use them like a tenant with options. Chores go wherever is cheapest and best, crown jewels only go where there’s a contract, your know-how lives in your own files, and every so often you run your test against the open alternatives so the way out stays real.
What a few afternoons buys you isn’t paranoia. It’s posture: the difference between a business that hopes its AI supplier stays friendly and one that doesn’t need to.