What AI Sovereignty Means for a Small Country

On the evening of September 26, 2025, technicians at South Korea’s National Information Resources Service in Daejeon were relocating lithium-ion batteries from the building’s backup power system. The batteries caught fire. The blaze disrupted 647 government services and destroyed 96 core systems. One of them was G-Drive, the government’s own cloud storage and the designated place for civil servants to keep their work files. About 125,000 officials used it, and it held 858 terabytes. An official told the Chosun Ilbo that G-Drive had no backup because it was too large. Those files could not be recovered.

Every byte had been stored in a government building, run by a government agency, inside the country. By the definition of sovereignty many governments now use, that was the safest possible arrangement.

Ukraine learned the opposite lesson three years earlier. Its law had required much of the state’s important data to stay on servers inside the country. On February 17, 2022, a week before Russia’s full-scale invasion, parliament passed a cloud services law that opened the way to moving it. Within weeks, rugged AWS storage devices were carrying government data out of range of Russian missiles. By December, the government said about 100 state registries and critical databases were running in Amazon’s cloud, and that they kept working through shelling and power cuts.

Location alone decided neither outcome. Korea’s files were beyond the reach of any foreign government and were lost to a battery fire. Ukraine’s registries were safer abroad than at home. What mattered was who held authority over the data, how many places it existed, and whether anyone had tested the way back.

For many governments, AI sovereignty means a map: our data, our models and our servers, inside our borders. For some things that instinct is right. For others it is dangerous. A small state has fewer buildings, fewer engineers and less money to spread its systems across than a large one, so keeping everything at home also concentrates the risk at home.

Almost no country can own the whole stack of chips, frontier models and global cloud platforms. Every country can decide who holds authority over the systems its people depend on. For a small state, that is the useful definition of AI sovereignty: the ability to keep protecting and serving its people when a supplier, a model or a building fails, and the freedom to change suppliers without asking anyone’s permission.

The practical way to apply it starts with one question. If a major technology provider withdrew tomorrow, what absolutely has to keep working?

Not every application has to survive. If a government chatbot goes down for a day, people are inconvenienced. If citizens cannot prove who they are, reach emergency services or exercise their basic legal rights, the state has failed at its job.

For nearly every country, six functions belong on that list:

1. Digital identity and access. Citizen identity, government logins, digital signatures and encryption keys. Almost every other public service depends on them.

2. Life and physical safety. Emergency calls and dispatch, essential hospital operations, and the safe operation of electricity, water, telecommunications and critical transport.

3. Defense. Command authority, secure communications, intelligence access, and the ability to keep working with allies if a commercial satellite or communications service fails.

4. Public finances. Treasury operations, pensions, benefits, essential tax functions and critical payments.

5. Legal identity and ownership. Population and ID registers, land records, company registries and civil records.

6. Democratic continuity. Courts, official communications, public warnings and election administration.

Keeping these running does not always mean uninterrupted service. Emergency dispatch and the power grid need to run continuously or fall back to a safe degraded mode. For a land registry, it may be enough to guarantee that no record can be altered and that access can be restored within a set number of days. Being precise about the standard for each function is what makes it testable.

Take benefits. Suppose the company that runs a ministry’s staff logins disables the ministry’s account at nine on a Tuesday. Can caseworkers still sign in? Will Friday’s payment run go out? Who has the authority to switch to the backup, and has anyone ever done it? If the answers live in a binder nobody has opened, there is no plan.

Some things belong under national control, and often on national soil. The first is authority: who can issue and revoke a digital identity, who can sign on the state’s behalf, who holds the encryption keys, which copy of a record is legally authoritative, and who can order a national response. Classified defense information belongs here too. A country can buy the hardware and software for these systems abroad and still keep that authority, provided its own officials can act and have practiced acting during an outage.

The second is AI that has to understand a country’s languages and culture. In 2023, a Singapore government-led initiative released SEA-LION, a family of open models built for Southeast Asian languages. At launch, those languages made up 13 percent of its training data, compared with 0.5 percent for Meta’s Llama 2. The gap matters for safety as well as fluency. Most global models are safety-tuned in English, and AI Singapore says that writing a harmful request in a Southeast Asian language is a common way around those protections. Its response was a guardrail model trained to recognize toxicity and self-harm in a Southeast Asian context. A government that wants to protect its citizens from AI has to be able to test it in the languages they speak.

Other things become more dangerous the more tightly they are held at home. Concentration is the first danger: in Korea, one fire in one building disrupted 647 services. Proximity is the second. Ukraine’s registries became safe only once they were out of range. Estonia, which shares a border with Russia, agreed in 2017 to host copies of its data and information systems in Luxembourg, the world’s first data embassy.

The third danger is that a government hosting everything itself must also defend everything itself. In April 2022, the Conti ransomware group broke into Costa Rica’s Ministry of Finance, disabled its tax and customs platforms, and went on to hit nearly 30 public institutions. The new president declared a national emergency on his first day in office.

The fourth is capability. A model that speaks the local language well may still reason less well than the best commercial systems, and SEA-LION’s developers acknowledged that GPT-4 outscored it on BHASA, a Southeast Asian language benchmark. Requiring a domestic model for every use, including the medical or legal information citizens rely on, could leave people with worse answers in the name of protecting them.

Control also does nothing to protect people from a system the state builds badly. In 2013, the Dutch tax authority introduced a self-learning risk model to flag fraud in childcare benefit claims. According to Amnesty International, it used Dutch nationality as a risk factor, so applicants without Dutch citizenship received higher risk scores. Thousands of families were wrongly accused and pursued for repayment. In January 2021 the entire cabinet resigned after a parliamentary inquiry called it an unprecedented injustice. The Dutch state owned the system outright, and that ownership did nothing for the families it harmed. Protecting people requires the capacity to test AI for discrimination and error, whether it was built at home or bought abroad.

Singapore shows what a deliberate split looks like. In 2018 it set a goal of moving 70 percent of its eligible, less sensitive government systems to commercial clouds by 2023, and by 2024 it had passed 80 percent. Highly sensitive and confidential systems can stay on premises. One obstacle, GovTech’s architects reported, was that agencies tended to over-classify their systems, so the government wrote guidance on classifying them correctly. The same government that moved most eligible systems to commercial clouds also paid to build SEA-LION. Each decision came from asking what a particular system needed.

Every essential function can be split across three levels of control. Level 1 is what the country must be able to sustain on its own. Level 2 is infrastructure it can share with trusted allies and neighbors, such as data embassies, backup sites and joint cybersecurity teams. Level 3 is commercial technology it can afford to replace or lose for a while, bought with a credible way out: the agency can export its data in a usable format, move to another provider, retrieve its logs and get practical help when a contract ends.

Essential function	Level 1: keep national control	Level 2: share with trusted partners	Level 3: buy commercially, with an exit
Digital identity and access	Identity records, authentication, signing authority, encryption keys	Backup and recovery sites abroad	Identity-assistance apps
Life and physical safety	Emergency dispatch; safe operation of power, water and transport	Redundant networks, allied cybersecurity support	Scheduling, routine analytics, service optimization
Defense	Command authority, classified information, secure command continuity	Alliance communications, shared satellite and intelligence capabilities	Support tools for noncritical tasks
Public finances	Treasury, public payments, pensions and benefits	Regional banking and settlement infrastructure, redundant payment networks	Financial analytics, administrative software
Legal identity and ownership	Authoritative population, land, company and civil registers	Data embassies, cross-border backup and disaster recovery	Citizen-facing assistants
Democratic continuity	Legal records, election authority, essential court operations, official communications	Shared hosting, backup communications, cybersecurity cooperation	Office software, translation, drafting assistants

Defense shows how the levels work together. A country must keep command authority and the ability to operate if a supplier withdraws. It can share satellite and communications capacity with allies. It can use commercial AI for supporting work that is not mission-critical. Each function needs a national core, and almost none needs a domestic version of every technology underneath it.

The hardest case is a supplier whose own government orders it to stop. In February 2025, the United States sanctioned Karim Khan, chief prosecutor of the International Criminal Court in The Hague. In May, the Associated Press reported that Microsoft had cancelled his email address and that he had moved to Proton Mail, a Swiss provider. Microsoft says it never stopped serving the court itself. Dutch press later reported that Microsoft told the court the sanctions required cutting Khan off, and that the ICC suspended his account to keep service for everyone else. In October, the court confirmed it would move its internal work environment from Microsoft Office to openDesk, open-source software developed by a German government-owned company.

The ICC is an international court, yet its problem is the one a small state should fear most, and it is the strongest argument for keeping everything at home. An exit clause means little when the provider is legally barred from honoring the contract.

Look at what the court needed once Khan’s account went dark: another place for his mail, a way for him to keep working, and eventually a plan to move the whole institution. Those are the Level 1 questions every state should already be testing: who controls identity, who holds the keys, which copy of the records is authoritative, and whether the fallback has ever been used. A battery fire, a ransomware gang and a sanctions order arrive for different reasons. The same tests show whether a government can keep working after any of them.

AI adds a dependency that clouds and office software do not: commercial models expire. On October 23, 2026, OpenAI shut off API access to the original GPT-4, six months after announcing its retirement. In 2023 I helped commercialize the new Bing, the first consumer product built on GPT-4. Even at Microsoft, the model at the center of that launch came from another company. Less than four years later, its maker retired it from its API on its own schedule.

A ministry that builds a caseworker assistant on one model version inherits its vendor’s retirement calendar. Each replacement also has to be retested in the country’s own languages and legal context, because a system that handled them well last year may behave differently after the switch. The defense is to build public services so the model underneath can be swapped, and to keep the capacity to test each new one before citizens meet it.

A small country can have a serious AI strategy without training a frontier model. The work is deciding where an open or locally adapted model is good enough, where it needs the best commercial systems, and which public functions must never depend on a single model. Switzerland and Estonia made different choices for different jobs. In September 2025, three Swiss public institutions released Apertus, a fully open model whose weights and training data anyone can inspect; 40 percent of its training data is in languages other than English, including Swiss German and Romansh. Estonia took the commercial route for its schools: its AI Leap program brought in OpenAI and Anthropic to give secondary students and teachers AI tools.

Either choice can be sound if the government knows which dependency it took on and can test, and if necessary replace, what it bought. That requires a small public team able to evaluate these systems in the country’s own languages and law. Neighbors can share that team and the standards it writes.

A government that wants this to be more than a slogan needs a national inventory of its essential services and the technology each one depends on. For every service, the inventory should answer four questions. What happens if our largest supplier withdraws access? How long can we keep operating? What is the alternative? Have we actually tested it?

The answers then have to become binding. Continuity requirements belong in the procurement rules for every critical system, so that no ministry can buy a service it has no way to leave or restore. Each essential function also needs one named official responsible for its continuity. Every minister should be able to answer a plain question: if a major foreign provider failed tonight, who is responsible for keeping pensions paid and registries readable tomorrow?

Small states can share much of this work. Neighbors can test the same AI systems, run joint outage exercises and host backups for one another, the way Luxembourg hosts Estonia’s data embassy.

Success should be measured by the essential functions a country can sustain on its own, how quickly it recovers from a disruption, and whether it still has real choices about its suppliers. The share of technology carrying a national label says very little about any of those.

A data center inside the country guarantees little if the software, accounts, keys or updates it depends on are managed from somewhere else. Duplicating every foreign platform to call it domestic wastes money a small state does not have, and so does requiring a local product for every task regardless of quality or cost. Multi-cloud is no cure either, because two providers can share the same identity system, network, contractor or software dependency. Until someone has switched from one to the other, nobody knows whether the second works as a backup.

Alternatives cost money and slow projects down, so a small country has to choose where to pay for them. It should spend most on the functions whose failure would threaten lives, legal rights, national command or the continuity of government. It can accept more dependence where an interruption is tolerable and switching is realistic. Done this way, sovereignty gives a small country more room to develop, because it can use the best technology available without betting the state on any one supplier.

South Korea owned the building that burned. Ukraine’s registries survived on servers it did not own. A small country’s AI strategy should be judged by whether its essential services keep working when a supplier, a model or a building fails. Its government should be able to show how it will recover, how it can change suppliers, and when it last tested both.

Sources

Want the next essay?

Get Liat’s essays on AI trends and the implications for governance and leadership as soon as she posts them.

Subscribe for more

Search Essays