Octopi / Guides / What is sovereign AI?
Guide
What is sovereign AI? A practical guide for businesses
Sovereign AI means keeping control of the AI your work depends on: where your data is processed, which model runs, who operates the hardware, which laws apply, and whether you can switch providers. There is no single legal definition.
Sovereign AI meaning: two different senses
The term is used in two ways.
A country’s own AI capability
Governments use it for a country building and controlling its own AI capability — computing power, models and skills — rather than relying on another country’s.
A company’s control over its AI
For a business, it means controlling the data, models and infrastructure its AI depends on, so a vendor’s decision or a foreign law can’t quietly change what happens to its information.
This guide is about the organizational sense: the one that matters when you decide whether client files or contact lists can go into an AI tool.
The five things you control — or don’t
Ask these of any AI setup. The more often you can answer “we do”, the more sovereign it is.
Where your data is processed
Where prompts, files and results are processed and stored — your device, your servers or a provider’s data center — and in which country. This is what “AI data residency” usually means.
Who controls the model weights
The weights are the trained model itself. With an open-weight model you can keep a copy and run that exact version. A model behind an API can be changed or retired by its provider.
Who runs the hardware
Your laptop, a server you operate, or a provider’s cloud. Whoever runs the machines decides when they are available and, depending on the setup, may have access to what they process.
Which laws apply
The rules that apply can depend on where data is processed and on where the provider is based. A data center in your country doesn’t settle the question if its operator answers to another country’s laws.
Whether you can leave
Can you export your data in standard formats, swap the model or change provider without starting over? If you can’t leave, you don’t fully control the terms.
Why sovereign AI matters now
Data-protection law. The EU’s GDPR applies to processing personal data of people in the EU. Its key ideas include a lawful basis, data minimization, purpose limitation, a processor agreement (Article 28) when a vendor processes personal data for you, rules for transfers outside the EEA, and impact assessments (DPIAs) for high-risk processing. Switzerland has its own law, the revised Federal Act on Data Protection (revFADP, or nDSG), which has applied since 1 September 2023.
The EU AI Act. It entered into force on 1 August 2024, with obligations phasing in over several years. If you build or use AI in the EU, keep track of which of them apply to you.
Foreign access to data. Under the US CLOUD Act (2018), US authorities can require US-based providers to disclose data in their control, including data stored abroad. That is one reason some organizations prefer non-US or self-hosted processing for sensitive work.
Lock-in and price changes. AI services can change their prices, models and terms. If your workflows depend on one provider, every change lands on you.
Client confidentiality. Contracts, NDAs and professional rules often limit where client information may go. You need to know where an AI tool processes it before a client asks.
This is general information, not legal advice.
A sovereignty checklist for any AI tool
Use these for any AI assistant, AI feature or API, and ask for the answers in writing.
| Question to ask | A sovereign answer | What to watch for |
|---|---|---|
| Where are my prompts and files processed and stored? | On your own device or servers, or in a named country and region you chose. | Residency that covers storage but not processing; unnamed sub-processors. |
| Is my data used to train models? | No — or only if you opt in. | An opt-out you have to hunt for; defaults that differ by plan. |
| Which model runs, and can I keep a copy? | A named model and version; ideally open weights you can run yourself. | An unnamed “our AI”; models swapped without notice. |
| Who operates the hardware, and under which laws? | You, or a provider you contract with directly, based in a jurisdiction that suits you and with a stated policy on government data requests. | A local data center run by a company subject to foreign disclosure laws. |
| Is there a processor agreement? | A data processing agreement (GDPR Article 28) and a published sub-processor list — or no processor, because the step runs on your machine. | No agreement offered, or terms that can change without notice. |
| What else leaves the machine? | A documented list of telemetry, logs and error reports, and a way to switch them off. | “Diagnostics” that can include content, or that can’t be turned off. |
| Can I leave? | Exports in standard formats (CSV, XLSX, JSON), a swappable model, workflows you could rebuild elsewhere. | Proprietary formats, export fees, workflows tied to one vendor’s hosted model. |
No tool scores perfectly; the aim is to know the answers before you commit.
How to get sovereign AI: four setups
None suits everyone; the trade-off is usually capability and convenience against control.
Run the model on your own computer
An open-weight model runs on a laptop or desktop through a local engine such as Ollama, LM Studio or llama.cpp. Data stays on the device, with no per-use fees. The limits: the model must fit in memory, and smaller models are less capable on hard reasoning.
Run it on your own servers
The same open-weight models on servers you operate, in your office or a data center you choose. A team can share one installation and run larger models. You take on the hardware, security and upkeep.
Use a provider based where your rules require
A cloud AI service operated, and legally based, in your jurisdiction. Nothing to run and no hardware limits, but your inputs go to a third party under its terms, so for personal data you need a processor agreement — and answers to the checklist.
Local by default, cloud by consent
Everyday work runs locally. A cloud model is used only for specific tasks, only once someone turns it on, and only with what that task needs. It works when each cloud feature says exactly what it sends.
Our guides to local AI vs cloud AI and running AI locally on a Mac go deeper.
Common misconceptions about sovereign AI
“Sovereign means offline”
No. A sovereign setup can still search the web, use your CRM or call a cloud model. What matters is that you decide what leaves, and can see it happen.
“Open weights means open source”
Not automatically. Open-weight means the trained weights can be downloaded; the license may still restrict use, and training data and code are often not released. The Open Source Initiative’s Open Source AI Definition 1.0 (October 2024) asks for the freedom to use, study, modify and share, with the code, the weights and enough information about the training data. See open source vs open-weight AI.
“Local AI has no data-protection duties”
Running a step on your own device means no third-party processor is involved for that step. Your own duties as the organization processing the data remain. See AI, the GDPR and customer data.
Where Octopi fits
This guide is published by Octopi, so here is how our own app answers the checklist — facts only. Octopi is a free Mac app (macOS 13 or later, Apple silicon, no account) that turns a plain-English task into a finished spreadsheet, researching in a real browser and working with Salesforce, HubSpot and Pipedrive.
| Question | Octopi’s answer |
|---|---|
| Data | The AI model runs on your Mac. Chat attachments are read on your Mac, never uploaded; results go into your own xlsx or csv files. |
| Model | Open weights, downloaded once and kept on your disk. The default, Qwen2.5-7B-Instruct, is published under the Apache 2.0 license; Llama 3.1, Mistral and Gemma 2 are offered too (licenses vary). |
| Compute | Your Mac, through Ollama, the open-source engine that serves the model — or an Ollama server you run on another computer. The chat refuses models Ollama runs in its own cloud. |
| Exit | Results live in standard spreadsheet files; any model already installed in your Ollama can be used. |
| Cloud AI | Off unless you turn it on, each feature with its own consent screen: Claude can plan your task (it receives your task sentence and column names, not your rows) and read public web pages for you in a private, signed-out browser. Your CRM and the sites you sign in to are always handled on your Mac. |
| What goes online | Web searches and page reads you ask for, your signed-in CRMs, the one-time model download, update checks (GitHub), and usage statistics and scrubbed error reports — on by default, linked to your download email; switch them off in Settings ▸ Privacy. |
Sovereign doesn’t mean offline: Octopi goes online to do what you ask. Full detail of what runs where: Sovereign AI on your Mac.
Questions
What is sovereign AI in simple terms?
AI you control: your data is processed where you decide, you know which model runs and can keep it, you know who runs the hardware and which laws apply, and you can switch providers. There is no single legal definition.
What is the difference between data residency and data sovereignty?
Data residency is where data is stored and processed. Data sovereignty is broader: which laws apply to it and who can be required to hand it over. Under the US CLOUD Act, for example, US authorities can require US-based providers to disclose data they store abroad.
Is sovereign AI only for governments?
No. Governments use the term for national AI capability, while businesses use it for control over the data, models and infrastructure their own AI depends on.
Does running AI locally make me GDPR compliant?
Not by itself. Processing on your own device means no third-party processor is involved for that step, but your own duties remain, such as having a lawful basis, data minimization and purpose limitation. This is general information, not legal advice.
Can a small business have sovereign AI?
Often, yes. Free tools such as Ollama run open-weight models on your own computer with no per-use fees; check each model’s license for business use. The model must fit in memory, and smaller models are less capable on hard reasoning.
Does Octopi send my data to an AI company?
Not by default: the AI model runs on your Mac. Only if you turn on the optional Claude features is anything sent to Anthropic, and each has its own consent screen saying what. Octopi does go online for the searches, page reads and CRM work you ask for.
Related
Try local-first AI on your own Mac
Octopi runs an open-weight model on your Mac to research, chat and fill spreadsheets — free, no account, and cloud AI off unless you turn it on.
Download Octopi free