AI sovereignty: what a small business actually needs to own

Palantir and NVIDIA announced a partnership in June 2026 to build AI for the US government where the agencies keep the hardware, the data and the model weights. A day later Palantir posted a nine-point “AI sovereignty” manifesto, and one line of it travels well beyond defence: data retention is your treasure, transfer it at your peril.

That logic scales down further than anyone selling it admits, and some of it lands squarely on a business your size. Not the data centre. The question: how much of what makes your business valuable are you handing to companies that might end up competing with you, and what would you do if the terms changed? Here’s how to think it through, and the practical moves at each level.

1. Translate the jargon: sovereignty is a dial, not a data centre

AI sovereignty means keeping control of three things: your data, your working knowledge, and your ability to change models without your business breaking. That’s it. IBM, McKinsey and Bain dress it up in stack diagrams because they’re writing for governments and banks, but strip the enterprise wank and that’s the whole idea.

The mistake at both ends is treating it as a switch. Full sovereignty, training your own model on your own hardware, is a nation-state game; BCG’s take on nations is that it’s an illusion even for most countries, and resilience is the real prize. The same holds a thousand times smaller. Zero sovereignty, pasting your client files into a free chatbot and building every process inside one vendor’s app, is the other failure, and it’s the common one.

Where your dial should sit depends on what your business actually is. A cafe needs almost none of this. A trades business needs a little. An accountancy practice, a law firm, a consultancy, an agency, anyone whose product is their know-how, needs quite a lot, because their entire margin is the thing being handed over.

2. Know what you’re handing over every time you paste

Every prompt is a disclosure to a company, under that company’s terms, and the terms split cleanly down one line: consumer versus business.

On the consumer side, training on your chats is the default. ChatGPT Free, Plus and Pro use your conversations to improve OpenAI’s models unless you opt out. Claude’s Free, Pro and Max plans have worked the same way since Anthropic’s August 2025 terms change, with retention up to five years if you’re opted in. Consumer Gemini chats can be human-reviewed and used for training too. On the business side it flips: ChatGPT Business and Enterprise, Claude for Work, the APIs, and Gemini in paid Workspace don’t train on your data by default, and they’ll sign a data processing agreement, which is jargon for a contract that says what they can and can’t do with what you send.

Most small businesses are on the wrong side of that line without knowing it. Cyberhaven’s 2026 report found nearly 40% of what employees feed AI tools is sensitive data, and roughly a third of AI use runs through personal accounts. For Claude specifically, 58% of workplace use went through personal accounts.

The law has started weighing in, and the first big ruling turned on exactly this split. In United States v. Heppner, Judge Jed Rakoff ruled in February 2026 that documents a defendant created with consumer Claude weren’t protected by attorney-client privilege: an AI tool is not a lawyer, and, the part that matters here, you can’t claim an expectation of confidentiality in a tool whose own terms say your inputs may train its models. The court explicitly noted that enterprise tools with no-training contracts might come out differently. That’s a federal judge drawing the consumer-versus-business line for you. The Australian professional bodies have drawn it too: CPA Australia says client data doesn’t belong in public AI tools, the Law Society of NSW’s January 2026 guidance calls putting client information into a public chatbot “akin to putting it into the public domain”, and Ahpra has the healthcare version. If your industry has a body, it has probably already told you which side of the line to stand on.

Opting out is not a contract. Ticking the no-training toggle on a consumer plan doesn’t make it a business tool: you’ve still got no agreement, thin retention guarantees, and carve-outs you haven’t read. Anthropic’s own privacy policy, updated effective July 2026, uses safety-flagged conversations to train its safety classifiers regardless of your setting, with flagged content held up to two years. Narrow scope, but it makes the point: the toggle is a courtesy, a DPA is a contract. Know which one you’re relying on.

3. Take the second risk seriously: your landlord is opening shops

Data leakage is the risk everyone names. The quieter one: the AI labs watch where value gets built on top of their models, then move into it themselves.

The pattern is now long enough to call a pattern. Anthropic ships a growing slate of industry products, Claude for Financial Services and, since May 2026, Claude for Legal, each landing in a category where companies had built on Anthropic’s own models. In April 2026 it launched Claude Design and Figma’s stock dropped 7% in a day; Anthropic’s chief product officer, Mike Krieger, resigned from Figma’s board three days before the launch. OpenAI has wired ChatGPT into personal bank accounts through Plaid, is building a jobs platform aimed at LinkedIn’s territory, and hired the founder of contracts platform Ironclad to lead a push into legal. And when the stakes get high enough, access itself becomes a weapon: Anthropic cut coding startup Windsurf’s Claude access in the middle of its acquisition talks with OpenAI, and the $3 billion deal fell apart weeks later. Your supplier can turn off the tap, and has.

Now connect that to your prompts. If you’re an accountant, every clever workflow you build inside a lab’s product is a live demonstration of what accountants do, how they price it, and which parts automate cleanly. You spent twenty years building that know-how. Handed over as training data or product telemetry, it’s market research for whoever decides to ship “AI for accountants” next quarter.

Keep the scale straight, though. The labs are not coming for your plumbing business or your cafe; they hunt big markets with high margins, and the risk concentrates on knowledge businesses: accounting, law, consulting, design, agencies, bookkeeping, anything where the know-how is the product. And the fear is survivable even there: Harvey, the legal AI startup building squarely in Anthropic and OpenAI’s path, raised at an $11 billion valuation in March 2026, and Cursor thrived against the labs’ own coding tools by running its own models alongside every vendor’s. The businesses that survive their landlord run exactly the playbook in the rest of this page: deep workflows, multiple models, nothing critical trapped in one vendor. There’s a subtler cost even if no lab ever enters your niche: if you and every competitor use the same model with the same generic prompts, you all converge on the same output. Renting identical intelligence from the same landlord is how your edge becomes the industry baseline.

4. Sort your crown jewels from the commodity work

Before touching any tools, spend thirty minutes with two lists. This one exercise sets your whole dial.

List one, the crown jewels: the things that make your business worth more than a competitor’s. Your pricing logic. Your methodology. Client lists and histories. Templates refined over years. The judgment calls in how you scope, quote and deliver. Proprietary data nobody else has.

List two, the commodity work: everything any business does. Drafting emails, summarising documents, first-pass research, meeting notes, generic marketing copy, tidying spreadsheets.

The rule that falls out: commodity work can go to any capable model on any decent tier, chase price and convenience. Crown-jewel work only ever touches tools where you have a contract, and the most concentrated of it, the full methodology, the complete client dataset, the entire playbook of how you operate, deserves a genuine think about whether it belongs in any third-party system at all.

The jewels leak in dribs, not heists. No one uploads “our entire competitive advantage.pdf”. They paste one scope, one pricing decision, one clever clause at a time, into a personal account, for years. The classification only works if your whole team knows which list is which.

M1 Fix the defaults Business tiers, a DPA on file, one-page rule. An afternoon.

M2 Taste the open models Three real tasks through two open models. An afternoon.

M3 Own your know-how Prompts and SOPs in your files, plus a ten-task eval.

M4 Local hardware Only when data cannot leave the building.

5. Fix the defaults on the tools you already use

The proven, boring rung, and it beats what a third of employees are currently doing. One afternoon:

1. Move work off personal accounts. ChatGPT Business, Claude for Work or paid Workspace with Gemini. This is the single biggest move; it flips you from “training data by default” to “contract by default”.
2. Check the toggles anyway. In any consumer account anyone still uses, turn training off: ChatGPT Settings → Data Controls; Claude Settings → Privacy. Assume anything pasted before the change is gone.
3. Get the DPA. Business tiers include one; actually have it on file. If a client ever asks how you handle their data with AI, “here’s the agreement” ends the conversation, and the asking has started: in one 2025 survey, 59% of corporate legal departments didn’t know whether their own law firms use AI on their matters, which means the ones who care are starting to write it into contracts instead. The insurance world is moving the same way: US insurers began attaching generative-AI exclusions to standard business policies in January 2026, and Australian medical indemnity insurer Avant warns that accepting a broad indemnity clause in an AI vendor’s terms can void your cover. Read what you agree to.
4. Write the one-page rule. Which tools are approved, which list from step 4 goes where, and what never goes in. One page, taped up, done.

None of this is sovereignty yet. It’s stopping the bleeding, and for a lot of businesses reading this it’s the highest-value hour in the whole piece.

6. Spend an afternoon tasting the open models

Here’s the part almost nobody at small-business scale has caught up on: the open models got good. Not “good for free”, good.

Quick jargon flag: an open-weight model is one whose brain you can download as a file. The file can’t phone home; whoever runs the computer it sits on controls the data. That distinction does a lot of work in a minute.

The current crop, as of mid 2026: Kimi K2.5 from Moonshot, DeepSeek’s V4 line, which is competitive with the frontier on serious coding benchmarks while still trailing on long agentic work, GLM from Zhipu, Qwen from Alibaba, and NVIDIA’s Nemotron family, the same open models in the Palantir deal. Yes, mostly Chinese labs. Which brings the fear worth defusing properly.

The fear conflates the model with the service. Use Kimi through kimi.com or Moonshot’s own API and your data routes through Chinese infrastructure under Chinese terms; DeepSeek’s first-party API is the same story, with terms that permit training on what you send. But take the identical downloadable weights and run them on a Western host and the data never goes near China. OpenRouter puts 400-plus models behind one account and lets you filter hosts by data policy, down to zero-data-retention only. Groq (US chip company, no relation to Musk’s Grok) serves open models at extreme speed and doesn’t train on your data. AWS Bedrock runs Kimi K2.5 and DeepSeek V3.2 fully managed inside the same infrastructure your other business software already trusts. Same brain, different landlord, different rules. One catch worth knowing: the same open model varies by host. Moonshot’s own vendor verifier found tool-calling accuracy ranging from 100% on the official API down to 83% on some cut-price hosts, so test the host you’ll actually use, not the leaderboard.

For Australians the residency map has a twist. Anthropic has no Australian data residency (its Sydney office opened in March 2026; residency is “being explored”), OpenAI will store your data here but still processes prompts offshore, Azure has no Australian data zone, and Google’s commitments cover the US and EU. The one place an Australian business can run serious models with prompts processed onshore is AWS Bedrock’s Sydney region, where the managed line-up includes Kimi K2.5 and DeepSeek V3.2. Sit with that: the most sovereign AI an Australian small business can rent in 2026 is a Chinese model on American infrastructure in Sydney.

Then there’s the price. Claude Opus 4.8 costs $5 in and $25 out per million tokens; GPT-5.5 runs $5 and $30. Kimi K2.5 is about $0.60 and $3. Call it eight to ten times cheaper, and for repetitive volume work that’s the difference between “AI line item” and “AI rounding error”. One honest counterweight: big enterprises went the other way last year, with open-model share of enterprise workloads falling from 19% to 11%, because they pay up for support and compliance. Your maths is different, simpler workloads and real price sensitivity, but it tells you the switch isn’t free lunch.

So the actual homework: pick three real tasks from your commodity list, run them through your frontier tool and through two open models on a few dollars of OpenRouter credit, and compare like a buyer instead of a believer. Most operators discover the open models handle 80% of their routine work indistinguishably. That discovery, more than any tool, is the sovereignty moment: the day you know you have an exit, the relationship with your main vendor changes from dependence to choice.

7. Keep your know-how in files you own, not in a vendor’s memory

Switching models is only painless if your working knowledge isn’t trapped inside one vendor’s app. This is the most neglected move in the whole piece, and it’s free.

Look at what actually leaves with you if you go today. ChatGPT’s export gives you your conversations; your memory, custom instructions, Projects and custom GPTs are not in the file, even on OpenAI’s own account-transfer tool. Claude’s export is a JSON dump with no way to import it anywhere. Everything the vendor’s memory learned about your business is knowledge you’ll pay to keep accessing. One tactic worth doing this week while you’re still inside: ask the model to write out everything it knows about you, your business and your preferences into a single document, and file it with your own docs. That’s your memory, extracted.

The habit from there: everything you’d need to get a new model productive lives in plain files in your own storage. Your prompt library as text files, not scattered chat histories, and definitely not locked inside custom GPTs and Projects, which are the least portable copy you can keep. Your SOPs and methodology docs, written down and current. Your reference data in open formats. When a model needs context, you hand it the file. When you change models, nothing is lost, because the new one reads the same folder.

Then build the small thing that makes switching an evidence-based decision instead of a leap: an eval. Easily waved off as jargon, but it’s just a folder of your ten most common real tasks with a known good answer for each. New model comes out, you run the ten, you score it pass or fail in a spreadsheet. That’s not a toy version of what the professionals do; the people who do evals for a living recommend exactly this, real tasks, binary scoring, a spreadsheet, over any platform. Twenty minutes, and you’ve replaced “the internet says this model is amazing” with “it beat our current setup on seven of ten and costs a tenth as much”. It’s the same discipline we apply in the AI tool shortlist, pointed at models instead of products.

Why bother? Because the record says terms change, just not the way people expect. Prices have mostly fallen. What changes is everything else: OpenAI removed GPT-4o and seven other models overnight in August 2025 and had to restore them after the backlash, Anthropic added weekly rate limits to Claude Code the same month, Cursor’s “unlimited” plan quietly became metered mid-2025, and API models are retired on 60 days’ notice at Anthropic and as little as two weeks for previews at OpenAI. Portable know-how plus a tested eval is what makes any of that a Tuesday instead of a crisis. Everything above this rung is optional. This rung isn’t.

8. Know what the top of the ladder looks like, and whether you need it

The full version, your own model on your own hardware, deserves a straight sketch, mostly so you know it exists and can tell when it’s justified. This is the experimental end for a small business: it works today, it’s fiddly, and it’s the point where getting someone to build it becomes the realistic path, which is its own decision we cover in how to choose an AI automation agency.

Running open models locally is genuinely accessible now, and for a worked example of the whole idea, our private transcription build runs speech-to-text on a laptop with nothing leaving the machine. Free tools like Ollama and LM Studio turn a capable machine into a private AI server: a $500 graphics card runs the small models, a $1,500 to $2,000 machine runs surprisingly capable mid-size ones, and NVIDIA’s DGX Spark puts 128GB of AI-dedicated memory on a desk for $4,699, up from $3,999 at launch after memory prices bit. Nothing leaves the building; the sovereignty is total. Go in with the right expectations: local models trail the frontier and the hosted open models, heavily compressed versions get noticeably dumber at tool use, and hosted open models are now so cheap that a local box rarely pays for itself on economics alone. It’s a privacy play, not a savings play, and someone has to care for the setup.

A rung above that sits fine-tuning: training an open model further on your own documents and methods, so the thing that knows your business is a file you own, Palantir-style at desk scale. Real, increasingly documented, and firmly in bring-in-a-builder territory.

Who actually needs this floor of the ladder? Businesses where data legally or contractually can’t leave the premises: health records, legal matter files, some government adjacent work. Businesses whose entire product is a proprietary dataset. And knowledge businesses that decided, after step 3, that their methodology is never becoming anyone’s telemetry. For everyone else it’s cosplay, and the money is better spent on rungs 5 through 7.

Rent the frontier, own the exit

The frontier labs are your cheapest R&D department: the strongest models, the smoothest tools, the fastest way to learn what AI can do for your business, and on a business tier with training off they’re fine for most work. Use them. But use them like a tenant with options, not a lifer: commodity work goes wherever it’s cheapest and best, crown jewels only ever touch contracts, your know-how lives in files you own, and once a quarter you spend an hour running your eval against the open alternatives so your exit stays real rather than theoretical.

Steps 5, 6 and 7 are a few afternoons of work, all of it proven, none of it requiring a developer. The local-hardware rung is there when the stakes justify it, and it’s the one place worth bringing in help. What you’re buying with those afternoons isn’t paranoia, it’s posture: the difference between a business that hopes its AI supplier stays friendly and one that doesn’t have to care.