Sovereign AI is an architecture decision, not geopolitics

An IDC survey of 508 organizations, commissioned by Cohere, produced a counterintuitive result: 86% already use agents embedded in applications, yet only 12% say sovereign-AI risk is widely understood in their organization. The more structural finding: 420 organizations have assigned someone responsibility for sovereign AI, but only 8% say those roles are well-defined. Ownership is being assigned faster than it is being defined.

The official definition — and its architectural nature

IDC defines sovereign AI as the ability to exercise free choice and control over the design, development, deployment, accessibility, operation, maintenance and governance of AI systems and applications, as well as the underlying technology they depend on. Cohere's chief AI officer, Joelle Pineau, compresses it into a blunter sentence: "Sovereignty is fundamentally an architectural question. If AI is tied to a single provider or governed by terms that can change, you don't have control; you have dependency."

Cohere co-founder Nick Frosst makes the same point from the opposite direction: once AI is embedded deeply enough that losing access would disrupt other systems, "if access changes, your entire stack can be disrupted, and that is not a foundation you can build on." Sovereign AI is routinely filed under geopolitics; for enterprise decision-makers it is first a set of architectural choices about data, updates and deployment control.

Five truths from the data

Agent adoption is accelerating — and about to accelerate faster

13% of organizations currently use prebuilt or third-party agents; 67% expect to within 12 months, and internally developed agents are expected to jump from 5% to 44% over the same period. Agents are moving from text generation to accessing systems, invoking tools and taking direct action — yet concern about agent behavior lags well behind concern about data. That mismatch is exactly where the sovereign-AI conversation starts: once agents take actions, you must decide not only where the data lives, but what the agent is allowed to do.

Sovereignty does not replace governance

Cohere's position is that keeping AI inside an organization's own environment determines where data goes and who controls the underlying system — it does not determine what the agent should be allowed to do once it is there. As Pineau puts it: "Control has to be engineered into the system itself: how the model is built, how it's sized, and how it's deployed. True sovereignty requires a platform where privacy, security, and deployment choice are defaults, not add-ons."

Cohere's own answer: customers can run the complete platform on their own infrastructure, including fully air-gapped and classified environments. Licensing is offline with no phone-home; updates, patches and new model versions arrive as signed packages the customer transfers in, validates and deploys through its own process; environment changes are initiated only through client action. An external AI provider cannot push a new model or software update into your environment — what enters and when is the customer's decision.

Four judgments for your enterprise

References

• The New Stack: AI agents are spreading fast. Their rules are still catching up. (2026-08) — https://thenewstack.io/enterprise-ai-agent-governance/