Everyone in the boardroom is arguing about which model. The map is asking a harder question.

A few weeks ago I wrote about a conversation with a Dubai executive who, instead of asking me "which model?" or "which vendor?", asked something quieter and much harder: "How do we know we're doing this right?"

I'm coming back to that question, because there's a version of it almost nobody in the AI strategy conversation is asking:

"Where?"

Here's the assumption baked into most enterprise AI strategies right now: that AI is basically the same everywhere. Pick the best model, roll it out globally, hand the legal paperwork to someone in compliance. One strategy, one stack, one map of the world with exactly two countries on it.

That assumption is comfortable. It's also wrong.

And two recent pieces — one from HBR, one from MIT Sloan Management Review — pull it apart from opposite ends. Let me connect them.

Ask a room full of executives where the next wave of AI is coming from, and most will say the United States or China. It's not a crazy answer — roughly 70% of the leading AI models today originated in those two countries.

But "where the models are built" is not the same as "where AI capability lives."

Yasuhiro Yamakawa and Thomas Davenport made this case sharply in HBR: national AI capability is a blend of very different ingredients — venture capital, defense orientation, energy availability, university research, government posture, software depth, data access — and no country has the same mix.

Japan leads in robotics and socially-oriented AI (Nvidia and Fujitsu are building advanced robotic systems together; service robots are landing in Tokyo to fight labor shortages). Canada pioneered deep learning and now hosts 1,500+ AI startups. France gave the world Mistral and runs its data centers on surplus nuclear power. The UAE is buying its way to the frontier with sovereign wealth. Nigeria has some of the highest AI literacy and trust rates on the planet.

The map is not two countries. It's a patchwork — and each patch is good at something different.

Which leads to the uncomfortable HBR punchline: the companies that win won't have the most powerful algorithm. They'll have the most geographically and culturally relevant one.

Now flip to the other side of the same coin.

While HBR is telling you the map is bigger than you think, MIT Sloan (in a piece by Accenture's Mauro Macchi and colleagues) is telling you the map has rules — and they're multiplying.

This is sovereign AI: the growing body of country-specific requirements governing where your data lives, whose infrastructure trains and runs your models, and how algorithmic decisions get reviewed. The EU AI Act is in active enforcement as of this month. GDPR, NIS2, and DORA still apply on top. Saudi Arabia demands nationally-sensitive data stay onshore. Most major markets are now building their own frameworks.

And here's how most companies are responding: defensively.

Accenture surveyed 1,928 executives across 28 countries. The numbers tell a familiar story:

• 60% say rising geopolitical risk makes them more likely to pursue sovereign solutions.
• Only 15% have made AI sovereignty a CEO- or board-level priority.
• Fewer than 13% see it as a growth driver rather than a cost.

Most organizations hand sovereignty to their data/AI officer (37%) or compliance/risk officer (28%) and move on.

When sovereignty sits in legal and IT, it becomes a tax to minimize. When it sits in the C-suite, it becomes a source of advantage.

If that logic feels familiar, it's because it's the same trap I wrote about in AI Won't Make Your Projects Successful. There, the mistake was treating a leadership problem as a technology problem. Here, it's treating a strategic problem as a compliance problem.

Same disease. Different organ.

Here's the part nobody likes to say out loud: most of the sovereign-AI panic comes from a false binary.

You do not have to choose between "one global platform for everything" and "rebuild the entire stack in every country." That's a switch. Real sovereignty is a dial.

MIT Sloan frames it as a continuum, and where you set the dial depends on three things:

1. Industry risk. Defense, healthcare, energy, and financial services carry national-security and citizen-safety weight. Retail and tourism usually don't.
2. National context. China built a full China-for-China stack. Singapore optimizes for interoperability. The UK and much of Europe run hybrids. You design for variation, not uniformity.
3. Use case. A credit decision, a medical diagnosis, or grid optimization is not the same risk as a marketing email. High-stakes use cases earn high scrutiny. The rest can ride global platforms.

The cleanest example is AstraZeneca. Same company, two opposite decisions. In China, adverse-drug-reaction data must stay in-country, so they run local models on Alibaba Cloud's sovereign infrastructure. Outside China, for R&D, they run large-scale AI on AWS public cloud. That's not inconsistency — it's calibration.

BNP Paribas made a different bet entirely: a multi-year partnership with Mistral, on-premise, keeping sensitive data inside European jurisdiction — driven from the C-suite, with sovereignty as a headline consideration, not a footnote.

Sovereignty done well isn't full independence. It's knowing exactly which decisions you refuse to outsource.

Now the finding that should keep executives up at night.

When companies do apply sovereignty controls, MIT Sloan found they cover:

• 60% of the time → the data layer
• 46% → infrastructure
• Only 22% → the AI models themselves

We're guarding the vault and leaving the decision-maker unattended.

Because as AI turns agentic, the choices that matter most stop happening at the data layer and start happening at the model and agent layer — the exact layer most companies have left exposed. You can localize every byte of data and still hand your highest-stakes judgment to a system you neither control nor fully understand.

Don't pave the cow path. Localizing the easy layers while ignoring the decision layer is exactly that: motion that looks like progress and changes nothing about who's actually in control.

Five shifts. None are exotic. All are strategic — and all of them belong on the board agenda, not the IT backlog.

1. Put sovereignty on the C-suite table. This is a bet on geopolitics, capital allocation, and long-term competitiveness — not an architecture choice. If it lives in compliance, you'll get fragmented, market-by-market decisions and zero strategic upside. Own it at the top.

2. Trade the model question for the map question. Stop asking "which model?" and start asking "which capabilities, in which geographies, under which rules, for which use cases?" That is the strategy. The model is a downstream detail.

3. Set the dial deliberately, use case by use case. Don't sovereign-everything and don't sovereign-nothing. Match the level of control to industry risk, national context, and the stakes of the specific decision. Most workloads won't need it. The ones that do will need it badly.

4. Build hybrid, not pure. 55% of organizations already plan to mix global and local providers — hyperscalers for scale, national champions for trust, AI-native players for specialized compute. Full independence is a fantasy for almost everyone. Flexibility is the real sovereign capability.

5. Guard the model layer, not just the data. Extend sovereignty to where the autonomous decisions actually happen. In an agentic world, the model and agent layer is the crown jewel — protect it like one.

Here's what both articles are really saying, together.

AI is not a product you buy once and deploy everywhere. It's a strategic terrain — geographic, political, cultural — and the executives who treat it like a single global rollout are quietly ceding control of their most important decisions to whoever wrote the model and whoever wrote the rules.

The winners over the next few years won't be the companies with the biggest model or the most sovereign stack. They'll be the ones who looked at the map honestly, decided which decisions they would never let out of their own hands — and built exactly that much sovereignty. No more, no less.

The map has been redrawn.

The only question left is whether you're reading it — or still staring at two countries.

#SovereignAI #AIStrategy #DigitalSovereignty #Transformation #AILeadership #TheBridge