Sovereign AI: hosting under your own jurisdiction

What “sovereign” means

An AI infrastructure is sovereign when the data, the models and the computations remain subject to the law of the country that entrusts them, and to that law alone. Three questions make it possible to check: where are the servers physically, who operates them, and under which jurisdiction does the operator fall? If one of the answers points to another country, a foreign authority may, in some cases, demand access.

Why AI makes the question more pressing

Training or querying a model means entrusting it with data: administrative records, health data, financial information, industrial know-how. The model itself becomes a sensitive asset, since it condenses what it has learned. For a state, a bank or a hospital, knowing under which law all of this is hosted is no longer a technical detail.

The frameworks of the six Gulf countries

Each Gulf country has its own framework, and all of them regulate, in one way or another, data leaving the country. Here are the broad lines; they are no substitute for legal advice.

• United Arab Emirates: Federal Decree-Law No. 45 of 2021 protects personal data and regulates its transfer abroad. The financial free zones of Dubai (DIFC) and Abu Dhabi (ADGM) apply their own rules.
• Saudi Arabia: the Personal Data Protection Law (PDPL) allows transfers outside the Kingdom under conditions, and sector rules add requirements for government and financial data.
• Qatar: Law No. 13 of 2016 protects the privacy of personal data; the Qatar Financial Centre has its own regime.
• Kuwait: there is no general law; rules come from the telecommunications regulator (CITRA) and from national data classification requirements.
• Bahrain: Law No. 30 of 2018 regulates transfers, and Legislative Decree No. 56 of 2018 provides that data of foreign customers hosted in designated data centres remains subject to the law of their home country.
• Oman: the Personal Data Protection Law (Royal Decree 6/2022) allows transfers abroad under conditions.

What this means for a campus

The simplest answer to these frameworks is geographic: place the compute capacity in the country the data belongs to. The infrastructure still has to allow it. Dedicated rather than shared capacity keeps sensitive workloads from sitting alongside others. Transparent operations, in which the client sees access, logs and indicators, let it prove to its regulator what is actually happening.

Sovereignty also means not depending on a single outside point to keep running. A campus that generates its electricity on site and consumes no water goes on computing when the surrounding networks are under strain.

Questions to ask a hosting provider

• In which country, and on which site, are the data and the models hosted?
• Who operates the infrastructure, and under which jurisdiction does the operator fall?
• Is the capacity dedicated or shared?
• Which access logs can the client consult for itself?