AI sovereignty: why renting intelligence from a frontier lab is a strategic mistake

The risk in enterprise AI is not the science-fiction one. It is alpha leakage: every prompt you send a frontier lab shows them where the value sits in your industry, and several labs have now launched products into their own customers' categories. The economics have flipped, open-weight models running on infrastructure you control are now materially cheaper, and the hardest part is no longer capability but convenience. The practical answer is a staged path from experiment to protect to own.

Where this is being written from

I started using Claude Code in December 2025, a few months after it was released and right as the buzz online started to build into something that looked like a signal. The point was not to find a better coding tool. The point was to get ahead of the curve, on the theory that the fastest way to understand where a technology is going is to live inside it before the consensus forms, alongside the small group of heavy users who always get there first.

The seven months since have been steeper than expected. Capability jumps that used to take a year now take a quarter. Claude Fable 5 reset what a reasonable baseline looks like, and OpenAI's GPT-5.6 Sol overtook it within weeks. More telling than either model was how Sol arrived: OpenAI opened it on 26 June as a limited preview available only to selected partners, at the request of the US government, before releasing it publicly on 9 July.

Sit with that for a moment. The release schedule of a commercial software product is now something a national government has views about. Whatever else that signals, it tells you these systems are no longer being treated as productivity tools by the people who regulate them.

But the change that has mattered most is not in the models. It is in the conversation around them.

Since roughly the first quarter of this year, three ideas that were fringe concerns have moved steadily towards the centre: data sovereignty, owning your own alpha, and independence from the frontier labs. You can hear it in enterprise procurement. You can see it in what large vendors have started building. What you cannot yet see is much evidence that the average business understands what it means for them specifically, which is the gap this article is trying to close.

Here is the part I should be honest about, because the argument is weaker without it.

I use these tools every day. I know that a portion of what I put into them contributes to the capability of the companies that make them. I have made a deliberate calculation that being early is worth that cost, and I would make the same call again. But I have also had the experience of asking a model something genuinely hard and watching it hand my own framing back to me, sometimes close to verbatim, because it had nothing better to offer than the structure I had just given it.

That is a small moment, and it sharpens the question considerably. If my thinking goes in and comes back out wearing the model's clothes, whose is it now?

The honest answer is that most of us do not know yet. Which leaves the real question, the one worth building a strategy around: can you get far enough ahead using these tools to still be standing when the wave you are riding arrives?

The partner problem

Consider what happened to Figma.

In April 2026, Anthropic launched Claude Design, a tool that turns a prompt into slides, prototypes and marketing collateral. Figma had been asked weeks earlier to be a launch partner. Anthropic's chief product officer, Mike Krieger, had sat on Figma's board and resigned three days before the launch. Figma's chief executive Dylan Field later said Anthropic "were not consistently candid in their communications."

Figma's shares fell around 7% on the day. Across the first half of 2026 they lost roughly 52%, and that happened while the business itself was performing well: revenue up 46% year on year, net dollar retention at 139%. The market was not repricing Figma's execution. It was repricing Figma's position.

This is the part worth sitting with. Figma did not lose a bake-off. It did not get out-shipped by a startup. It gave a supplier a clear view of a category, and the supplier entered it.

Claude Design was not an isolated case. The pattern runs through Claude Code, which arrived after Cursor, one of Anthropic's own largest customers, demonstrated the category existed. It runs through vertical products aimed at science, security, legal and financial workflows, and through collaborative work tools. It will keep running, because the mechanism producing it is not a strategy anyone has to choose.

Your usage is the market research

There is nothing conspiratorial here, which is exactly why it will continue.

When you push work through a model provider's API, you are not just buying tokens. You are showing the provider what problems in your industry are worth solving, what a good answer looks like, which workflows people pay for, and where the friction sits. Aggregate that across thousands of customers and you have the best product roadmap in the market, assembled for free, updated continuously, and paid for by the companies it will eventually be used against.

The uncomfortable version: the more useful you find these tools, and the more enthusiastically your team adopts them, the more precisely you are mapping your own industry's pockets of value for someone with the capital and distribution to go after them.

This is a well-worn pattern, not a new one. Microsoft used control of Windows to move into applications, and Lotus 1-2-3 and WordPerfect did not survive it. Google moved from indexing the web to answering directly on its own properties, and the traffic that used to leave never came back. Platform providers move up the stack towards the margin. They almost always do.

This is now a live concern in enterprise procurement rather than a theoretical one. The questions being asked of AI vendors have shifted over the past two quarters from what the model can do to what the vendor retains, and buyers who could not have defined a model weight a year ago are now asking who owns them.

The corollary is worth stating plainly, because it runs against instinct. Generous commercial terms from a platform provider are not evidence of goodwill. Free credits, unusually cheap enterprise tiers and enthusiastic integration support are all cheapest at exactly the moment a provider is learning the most from your usage. The cost is deferred, not absent.

You do not have to accept a hostile reading of any of this to act on it. Assume good faith from every AI vendor you deal with. The incentive still points the same way.

Redefining AI safety for a business owner

Most public debate about AI safety is about catastrophic misuse. That is a real conversation, and it is not your conversation.

The safety question for a business owner is narrower and far more immediate: do you control your compute, your models, your data, and your alpha?

Alpha is the useful word. It is the part of your business your competitors cannot copy from your website: your pricing judgement, your quoting logic, your underwriting rules of thumb, your account-management playbook, the accumulated pattern-recognition of people who have done the work for fifteen years. It is the reason customers choose you over a competitor with similar marketing.

Palantir's Alex Karp put this bluntly on CNBC on 1 July, in an interview that was notable less for what he was selling than for how precisely it described what large organisations now say privately. What customers want, he argued, is "control over their compute, their models, their data stack and their alpha," adding that "they want to know they own the means of production. It's not being transferred to someone else."

Strip away the salesmanship and the underlying fear is recognisable at any size. It is not that AI will fail them. It is that they will get modest value from tokens while handing over the thing that made them defensible in the first place. They want the intelligence. They do not want to pay for it with their IP.

When you route your judgement through a shared external model, two things happen. The first is the disclosure risk everyone worries about, and it is genuinely the smaller one, because enterprise agreements and contractual protections address a reasonable portion of it.

The second has not been priced at all, and it has nothing to do with leaks. Shared intelligence produces shared conclusions. If you and your three closest competitors use the same model, prompted in broadly the same way, against broadly similar data, you converge on broadly the same answers. Everybody gets better. Nobody gets ahead. You will have spent real money to eliminate your own differentiation, and whatever efficiency you gained is competed away within a quarter because your competitors bought the identical gain from the identical shop.

That is the part worth dwelling on, because it inverts how most businesses evaluate this. The question is not whether AI makes you faster. It almost certainly does. The question is whether it makes you faster in a way anyone can buy, because a capability your competitor can purchase on the same terms is an operating cost, not an advantage.

Palantir made the same argument the day before Karp's interview, in a nine-point manifesto posted to X: data retention is your treasure, and transferring it hands over both your existing winning plays and the means of producing new ones. Self-interested, given what they sell. Also correct.

The economics flipped, and most people have not noticed

Until recently the counter-argument was straightforward: frontier models are so much better that control is a luxury. That was defensible. It is now much weaker.

On 29 June 2026, Palantir and Nvidia launched a joint engine for training and deploying Nvidia's open Nemotron models inside sovereign, classified and air-gapped environments. The pitch is precise: agencies run customised models on their own infrastructure, train on their own data, and retain ownership of the resulting weights. Weights are the trained parameters of a model, the artefact that encodes what it has actually learned. Owning them is the difference between owning an asset and renting a service.

That is a serious pairing of vendors building for a market that did not visibly exist eighteen months ago. McKinsey has put the potential sovereign AI market at around 600 billion dollars by 2030.

The cost picture has moved too. Current comparisons put good open-weight models at roughly 90% of frontier quality, and running them through specialist hosting providers costs somewhere between 50% and 90% less than equivalent frontier API access. The gap that justified paying the premium has narrowed to the point where, for most routine work, you are paying a substantial margin for capability you are not using.

Here is where I want to be careful, because this is the point at which articles like this usually oversell.

Running models on your own hardware is not automatically cheaper. The published break-even for self-hosting sits somewhere above 600 million to 1.2 billion tokens per month, and it assumes you employ someone who genuinely knows how to run inference infrastructure — a role that costs 250,000 to 360,000 dollars a year fully loaded in the current market. Below that volume, a business that rips out its API subscriptions to build its own stack will spend more, not less, and will spend it on salary rather than software.

For most Australian SMEs, that means the honest answer is not "self-host everything." It is: use open-weight models through a provider that keeps your data in the jurisdiction you need, on the workloads where your differentiation actually lives, and keep paying frontier prices where frontier capability genuinely earns it. Hybrid is what mature operators actually run, and it is the sensible destination for almost everyone reading this.

There is a second-order effect that matters more than the headline saving, and it only shows up once you control the capacity. Metered pricing makes experimentation feel expensive, so people ration it, and the organisation learns slowly. Capacity you have already paid for makes experimentation feel free, so people try things that would never survive a cost-benefit conversation. Over two years, the organisation that let its people waste tokens is materially better at this than the one that counted them.

Two honest caveats. Open models still trail on the hardest reasoning work, so this is a workload-by-workload judgement rather than a blanket switch. And open weights are opaque artefacts that need security vetting like any other third-party dependency you would not install unexamined. Sovereignty is not carelessness.

The convenience gap is the real obstacle

Here is what I think most of the sovereignty conversation is currently missing, and it has nothing to do with capability.

The frontier labs have made their products effortless. You sign in with Google and you are inside a working environment in about eight seconds, with no procurement conversation, no configuration, and no one to ask. That frictionlessness is not a side benefit. It is the distribution strategy, and it is why shadow AI use inside organisations is far higher than any IT department's inventory suggests.

A sovereign model that requires a VPN, a ticket, and a five-minute wait will lose to that. It will lose even when it is cheaper, safer, and entirely adequate for the task, because staff under deadline pressure optimise for the path of least resistance and always will. Any sovereignty strategy that depends on people choosing the harder tool out of loyalty is not a strategy. It is a wish.

This is the part organisations have to solve for themselves, and it is genuinely solvable. Single sign-on with the credentials people already have. The model available where the work happens rather than behind a separate door. Sensible defaults so nobody has to think about which tool is approved for which data. Response times close enough that the difference does not register.

The organisations that get this right will find their data stops leaking almost as a side effect, because the internal option became the easiest option. The ones that treat sovereignty purely as a policy problem will write an excellent policy, and their staff will keep pasting client information into whatever consumer tool loads fastest.

Capability is no longer the hard part. Adoption is.

A ladder, not a cliff

None of this is an argument for ripping out your frontier subscriptions this quarter. Almost every business should be on a staged path.

Stage one: experiment. Use frontier APIs for what they are genuinely best at, on data that would not hurt you if it leaked. Public content, general research, drafting, code scaffolding, non-sensitive analysis. This stage builds capability and reveals where AI actually helps you, and frontier models remain the fastest way to learn that. The discipline is classification, not abstinence.

Stage two: protect. Move sensitive and differentiating workloads onto open-weight models running under your control, either on your own infrastructure or with an Australian hosting provider, behind a control plane you own. A control plane is the layer between your business and any model that routes requests, logs them, enforces policy, and lets you swap the underlying model without rewriting anything. This is the highest-leverage stage and where most Australian mid-market businesses should be aiming over the next twelve to eighteen months. It also preserves optionality: with a control plane, the model becomes a replaceable component rather than a dependency.

Stage three: own. Post-train or fine-tune a model on your proprietary data, running on hardware you control, so your accumulated judgement compounds inside your business rather than someone else's. Not where a fifty-person business starts. Increasingly where a five-hundred-person business ends up.

The likely end-state looks less like everyone leaving the cloud and more like a settled division of labour: a handful of very large players doing foundation-model development, a middle tier of enterprises training proprietary models on their own data, and a growing base of inference running close to the work — in a private cloud, on-premise, eventually on the machines people already have on their desks. Most compute stays in large data centres. The portion that carries genuine competitive weight moves closer to home.

You do not have to accept any particular forecast to plan against that direction. The cost of being wrong is asymmetric. If you build optionality and the frontier labs turn out to be benign partners forever, you have overpaid modestly for flexibility. If you build none and they do not, you have no move to make.

Why this is sharper in Australia

Everything above applies to a business in Ohio. Four things make it more pressing here, and one of them is three days old.

The policy direction changed this month. On 15 July the Prime Minister used a speech at the University of Sydney to set out a new national position on AI, and established an Office of AI inside the Department of the Prime Minister and Cabinet with effect from the same day. That office will draft a set of Australian Standards for AI, to be put to National Cabinet next month, with legislation flagged for introduction to Parliament in early 2027.

This is a genuine reversal. The December 2025 National AI Plan had settled on relying on existing laws and sector regulators, backed by voluntary guidance and an AI Safety Institute, and had explicitly declined to pursue a standalone AI Act or the mandatory guardrails proposed in 2024. Seven months later the government is moving towards a legislated, whole-of-government framework. If you built your AI governance posture on the assumption that Australia had chosen the light-touch path, that assumption expired this month.

The copyright question was settled against the labs. In the same speech, the Prime Minister ruled out a text-and-data-mining exception to the Copyright Act, saying no company should use Australian books, music, art or news to train AI without the creator's control over their work, and describing anything less as theft. This confirmed a position the Attorney-General had taken in October 2025 against sustained lobbying, and rejected the Productivity Commission's recommendation to create a fair dealing exception.

Read that through a sovereignty lens rather than a creative-industries one. Australia has now stated, at head-of-government level, that training a model on material you do not have rights to is not a technicality. That principle does not stop at song lyrics. If you are handing a vendor commercially sensitive material without knowing what rights you have granted, you are on the wrong side of a line the country has just drawn in public.

Privacy obligations continue to tighten. The first tranche of Privacy Act reforms is legislated and taking effect progressively, and from 10 December 2026 new Australian Privacy Principle obligations require organisations to disclose where personal information feeds automated decisions that significantly affect individuals. A second tranche covering broader AI transparency, a fair and reasonable test, and possible removal of the small business exemption remains a government commitment rather than law. Planning on the assumption that disclosure obligations tighten rather than loosen is now clearly the safer bet.

Procurement is moving faster than legislation. If you sell into government, health, financial services or critical infrastructure, data residency questions are already appearing in tenders and vendor assessments, well ahead of any statutory requirement. Being able to answer "our AI processing occurs entirely within Australia on infrastructure we control" is moving from differentiator to qualifier. With a legislated standards framework now signposted for 2027, that trend has only one direction. Retrofitting the answer under tender deadline is expensive. Building towards it deliberately is not.

Underneath all of it, the local capability now exists. Australia's first sovereign AI inference node went live in Sydney in January 2026, built specifically to meet data residency requirements, and large-scale AI campus capacity is under construction in western Sydney. The infrastructure gap that made this conversation theoretical here two years ago has narrowed considerably.

So for an Australian business, one architectural decision serves two purposes. Moving sensitive workloads onto open-weight models hosted in Australia is a competitive strategy and a compliance posture in a single move. Those two budgets are usually held by different people, which is precisely why the case is easier to fund than most people assume.

What to do about it

Five things, in order, none requiring a large budget to start.

Audit what currently leaves. Map every AI tool in use, including the ones nobody approved, and identify what data each receives. Most businesses that do this find at least one surprise, usually a departmental tool processing customer records that never went through procurement.

Classify workloads by sensitivity, not by department. Sort AI use into three tiers: fine on a frontier API, needs to stay under our control, must never leave our environment. This single exercise resolves most of the argument, because it turns an abstract debate into a specific list.

Pilot one open-weight model on one contained workload. Something high-volume, low-risk and measurable: document classification, extraction, internal search, first-draft generation. Measure cost, quality and speed against what you pay now. One real data point from your own business beats any benchmark in this article.

Put a control plane between your business and any model. Even at small scale, a single layer that routes, logs and governs model calls means you can change provider without changing your business. Vendor lock-in in AI is not primarily about contracts. It is about architecture.

Write ownership into your contracts. Ask any AI vendor directly: who owns the weights of any model trained or tuned on our data, what are your rights to use our data or usage patterns, and what happens if you launch a product competing with ours. The answers, and the hesitation, tell you what you need to know.

A useful signal on where this is heading: in recent weeks AWS committed one billion dollars and Microsoft 2.5 billion dollars and 6,000 people to units that embed engineers directly inside customer businesses. Read that carefully. Enormous sums are being spent to get closer to your operations at the exact moment the strategic argument runs towards more distance. Those engineers are competent and often genuinely useful. They also work for a company whose interests are not identical to yours.

That is the difference an independent advisor makes. We do not sell you compute, we do not sell you models, and we have no reason to prefer one vendor's architecture over another.

I opened by admitting that I use these tools daily while knowing what they cost me, and that the honest question is whether you can get far enough ahead to still be standing when the wave arrives. I think you can. But not by accident, and not by continuing to route everything that makes you good through infrastructure owned by companies who are learning from it.

If you want a clear-eyed view of what data is currently leaving your business, which workloads should move first, and what the staged path looks like in your situation, that conversation is more useful now than after the tender question arrives.