A public institution considering a national language model needs to answer a harder question before it funds training: which decisions must it be able to make without another organisation's permission?
The answer might concern access to essential services during disruption, the treatment of sensitive records, the representation of local languages, or the ability to change a system when policy changes. Each objective points towards different investments. Training a model could serve one of them while leaving the others dependent on external suppliers.
WCAI's position is to define sovereignty through specific capabilities and rights, then choose the technology that provides them. A domestic model can be valuable. Its origin alone cannot establish control over the application, the infrastructure or the institution's ability to keep operating.
Start with the service the country needs
National and institutional objectives overlap, but they are not identical. A government might invest in research talent, language resources and compute capacity because it wants capabilities available across its economy. An individual bank needs its own systems to meet service, security and supervisory requirements. Buying local services may support the first objective without satisfying the second; buying international technology may satisfy a workload requirement without building domestic research capability.
Singapore's May 2026 update to its National AI Strategy makes these complementary investments visible. It describes applied research, workforce readiness, governed access to datasets, compute availability and efficiency, and international partnerships. The update sets priorities and intended actions. It does not certify that a nationally independent AI supply chain has been achieved.
For a decision-maker, this is a useful distinction. A country's AI strategy can combine local capability with open exchange. An institution can similarly combine local operating responsibility with procured technology. The practical issue is whether that combination preserves the rights and capabilities required for its particular service.
Consider an illustrative public-service document assistant. Its requirements could include handling two local languages, keeping confidential records within an approved environment, and allowing staff to retrieve authoritative documents if AI generation becomes unavailable. A locally developed model would not, by itself, establish those three conditions. The deployment, data access and fallback arrangements need separate evidence.
Separate the layers of control
The word sovereignty conceals several decisions. Use the following distinctions before comparing a national model programme, an international cloud arrangement and a locally operated deployment.
| Layer | Capability or right to establish | Evidence to inspect |
|---|---|---|
| Data and knowledge | Decide which records enter the system, who accesses them and how they are retained | Data flows, access records, retention terms and deletion tests |
| Models | Run an approved version, assess its behaviour and make permitted modifications | Model files or service terms, licence, version policy and local evaluation |
| Compute and facilities | Obtain usable capacity and maintain a service when demand or supply changes | Allocated capacity, equipment support, power arrangements and recovery plan |
| Cloud and services | Understand the provider's operating role and the institution's retained responsibilities | Service-specific architecture, contractual rights, subcontractors and control boundaries |
| Operational authority | Restrict actions, change policy, pause the system and recover records | Permissions, approval paths, logs, trained operators and tested procedures |
| Continued access | Move or replace components within the disruption the service can tolerate | Export rights, replacement dependencies, migration test and approved fallback |
These are decision categories, not a validated sovereignty index. Different services need different levels of control. A general research assistant and an essential benefits-processing workflow should not receive the same requirements merely because both use a language model.
Buying domestic hardware can improve physical access and maintenance options. It does not remove upstream dependencies on chips, manufacturing, firmware or replacement parts. NVIDIA's 2025 annual report, for example, describes its use of external foundries and manufacturing partners. This is one supplier's disclosure, rather than a complete map of semiconductor supply. It illustrates why the ownership of a server and the independence of its supply chain are separate questions.
Policy can also affect access. In May 2025, the US Bureau of Industry and Security announced that it would rescind the AI Diffusion Rule, instructed officials not to enforce that rule, and announced additional chip-related guidance. The notice said a regulation formalising rescission was planned. It is an example of policy change, not permission to assume that a particular shipment or service is unrestricted today. Procurement needs an assessment of the actual product, parties and rules at the time of the transaction.
A model can be local in more than one sense
Local relevance is a substantive reason to invest in models. A system serving residents or employees needs to handle their languages, documents and contexts. Those requirements may be poorly represented in a generic evaluation.
AI Singapore describes SEA-LION as a family of language models intended to understand Southeast Asian contexts, languages and cultures, anchored by AI Singapore and associated with Singapore's National Multi-Modal LLM Project. Its stated purpose includes under-represented groups and low-resource languages. That provides a concrete example of a regional capability objective. The project's purpose is not evidence that a particular model performs adequately in a bank's Indonesian complaints process or a Singapore agency's bilingual service.
An institution should evaluate the actual version against its own documents, language combinations and failure consequences. Local relevance can come from regional models, adaptation of another model, better retrieval of authoritative material, or changes to the workflow. Compare these approaches before assuming that training from scratch is required.
That comparison should include what the institution expects to maintain. Training creates a continuing obligation to curate data, evaluate releases, address vulnerabilities and retain expertise. Adapting a model also requires stewardship. Purchasing a service leaves those technical functions partly with a supplier, while the institution still needs to evaluate the application and control its use.
Open models provide options, with conditions
Access to model weights can make local deployment possible and reduce dependence on a remote model service. The institution can retain an approved version, inspect available material and choose a hosting environment, subject to its rights and technical capability. These options matter even when it has no ambition to build a frontier model.
However, downloadable weights do not establish the right to use the model for every purpose, reproduce its training or redistribute a modified system. The Open Source Initiative's Definition 1.0, released in October 2024, distinguishes the freedoms to use, study, modify and share, and specifies data information, code and parameters. It is an industry definition, not a legal finding about any particular model. Procurement should inspect the actual licence and available artefacts rather than rely on an “open” label.
The operating environment also remains part of the decision. A locally hosted model may need imported accelerators, particular software libraries and a team able to run them securely. The NIST Generative AI Profile identifies third-party datasets, pre-trained models and software libraries as components of the generative-AI value chain. Its guidance supports examining these dependencies; it does not assign sovereignty ratings.
There is also a case for buying more managed services. A capable provider may offer infrastructure protection and operational support that an institution cannot economically maintain itself. AWS's shared responsibility model explains how responsibilities vary with the services selected. Control therefore needs to be judged together with competence. Moving a task in-house without funding the people and operations needed to perform it can weaken the service the institution wanted to protect.
Residency is one requirement among several
A Singapore hosting location is a factual input to a data assessment. It does not describe every processor, support route, backup or service called by the application. Require a complete flow of records and access, including the model service and operational logs.
For Singapore organisations covered by the PDPA, section 26 addresses transfers outside Singapore through prescribed requirements for comparable protection. Public agencies are excluded from these obligations by section 4(1)(c); the public-service example requires assessment against its applicable public-sector rules. The PDPC's April 2026 cross-border guide provides methods and contractual resources, including guidance on adapting ASEAN Model Contractual Clauses. This is not a general requirement that every AI workload stay in Singapore, nor an approval for every cross-border architecture.
A Malaysian or Indonesian entity needs its own assessment. The Singapore headquarters' approval cannot settle another entity's obligations. Use the per-entity rollout workbook to record actual data categories, processing routes, local requirements and approving owners. Keep legal access, privacy compliance and operational continuity as related but distinct decisions.
Fund the capability that closes the gap
Before approving a sovereignty programme, write a one-page decision record containing five answers:
- Essential service: what must continue, for whom, and under which disruption?
- Required authority: which rights or decisions must remain with the institution or state?
- Current gap: which dependency prevents that authority being exercised, with what evidence?
- Proposed investment: how will models, infrastructure, people or contracts close the gap?
- Acceptance test: what demonstration will establish that the required capability exists, and who will maintain it?
Compare the proposed investment with at least one alternative that achieves the same requirement through a different mix of ownership and partnership. Include the ongoing operating cost and the risk introduced by taking on new responsibilities. For Singapore, that assessment should also reflect the national strategy's explicit attention to compute efficiency and sustainability.
The next budget decision should name the capability being bought. “We can operate this approved service during a defined provider disruption” is a testable outcome. “We have our own model” describes an asset whose value still depends on the service, rights and operating arrangements around it.
Read our editorial principles for evidence, contribution and correction standards.