Almost every AI tool available today — from Microsoft Copilot to ChatGPT Enterprise to Google Gemini — processes your data on infrastructure owned and operated by a foreign technology company. For many organisations, this is an acceptable trade-off. For New Zealand community organisations, iwi authorities, and government-adjacent bodies, it often is not.
What is AI sovereignty?
AI sovereignty is the principle that an organisation retains full control over the AI systems it uses — including where those systems run, what data they can access, and how their outputs are governed.
A sovereign AI deployment has three defining characteristics:
Infrastructure control
The AI runs inside the organisation's own environment — on-premises servers, a private cloud, or a dedicated NZ-hosted instance. No computation happens on shared external infrastructure.
Data containment
Organisational data never leaves the controlled environment without explicit, auditable authorisation. The AI reads your documents and knowledge bases; it does not export them.
Governance ownership
The organisation sets the rules for what the AI can and cannot do, what it can access, and who can use it. These rules are enforced technically, not just contractually.
Data sovereignty vs AI sovereignty
These terms are related but not identical, and the distinction matters for organisations evaluating AI tools.
Data Sovereignty
Concerns where data is stored and which legal jurisdiction governs it. NZ organisations can achieve data sovereignty by ensuring data is stored on NZ-based servers.
AI Sovereignty
Concerns where AI computation happens. An organisation can have data sovereignty (NZ-stored data) and still lose AI sovereignty if that data is sent to an offshore AI model for processing.
The critical insight: an organisation can store all its data in New Zealand and still have no AI sovereignty if it uses a tool like Microsoft Copilot, which sends that data to Microsoft's global AI infrastructure for processing. Data at rest is sovereign; data in use is not.
Why AI sovereignty matters for NZ organisations
For most commercial organisations, cloud AI tools are appropriate. The risk profile is acceptable; the contractual protections are sufficient; the productivity gains outweigh the data residency concerns.
For certain NZ organisations, this calculus is different. The following factors make AI sovereignty a non-negotiable requirement rather than a preference:
Cultural data obligations
Iwi authorities, Māori trusts, and Pacific organisations often hold data — genealogies, land records, community health information — that carries cultural and spiritual weight beyond legal compliance. The concept of data sovereignty in te ao Māori is grounded in tino rangatiratanga: the right of communities to govern their own information. Sending this data to a foreign AI model for processing contradicts that principle regardless of contractual protections.
NZ Privacy Act 2020 cross-border rules
Principle 12 of the Privacy Act restricts the disclosure of personal information to overseas recipients unless those recipients have equivalent privacy protections. Using cloud AI that processes personal information on overseas servers may engage this principle, requiring disclosure analysis and potentially consent from the individuals concerned.
Community trust requirements
NGOs and community service providers operate on the trust of the communities they serve. A data breach or inappropriate use of community data — even without legal liability — can permanently damage that trust. Sovereign AI architecture reduces this risk by eliminating the external infrastructure attack surface entirely.
Government and procurement requirements
Government-adjacent entities and publicly funded organisations face increasing pressure to demonstrate how AI systems they use handle sensitive data. NZ government procurement guidelines are evolving rapidly, and organisations with sovereign AI deployments are better positioned to meet emerging standards.
How Sovata implements sovereign AI
Every Sovata deployment is built around a 5-layer sovereign architecture. Your data remains inside your own infrastructure. AI models connect only with explicit, auditable authorisation. Governance controls and audit trails are standard, not optional.
See the architecture →Frequently asked questions
What is the difference between data sovereignty and AI sovereignty?
Data sovereignty focuses on where data is stored and who has jurisdiction over it. AI sovereignty is broader — it concerns where AI computation happens, which models can access which data, and who governs AI behaviour and outputs. You can have data sovereignty (data stored in NZ) without AI sovereignty (AI processing that data on a foreign cloud provider's infrastructure).
Can Microsoft Copilot or ChatGPT Enterprise meet NZ sovereignty requirements?
Both tools offer strong contractual privacy protections and commit not to train their models on your data. However, both process your data on their own cloud infrastructure. For organisations with architectural sovereignty requirements — iwi, government-adjacent bodies, or those holding sensitive community data — this may be unacceptable regardless of contractual commitments. The distinction is between contractual privacy and architectural sovereignty.
What infrastructure does sovereign AI require?
Sovereign AI can run on on-premises servers, a dedicated private cloud instance, or an NZ-hosted private cloud environment. It does not require building your own data centre. Sovata designs deployments around your existing infrastructure and budget, from small on-premise setups to larger hybrid private cloud architectures.
Is sovereign AI more expensive than cloud AI?
The infrastructure cost of sovereign AI is higher than per-seat cloud subscriptions. The relevant comparison is: infrastructure cost + managed operations (which Sovata provides) versus the total risk cost of a cloud AI deployment — including breach liability, community trust damage, and regulatory exposure. For most NZ community organisations with sovereignty obligations, the risk-adjusted cost favours sovereign deployment.
Assess your AI sovereignty requirements
Book a free Discovery Call to understand whether sovereign AI is the right approach for your organisation — and what it would take to implement.
Book a free Discovery CallFree · 1 hour · New Zealand-based team