Sovereign AI: Why Should Your Company's Intelligence Live on Someone Else's Server?

Not all of it has to live on someone else's server, and not all of it should come back in-house either. For a company, sovereign AI comes down to control over three things. The first is where your prompts, documents and outputs are stored and processed. The second is whose law can reach them. The third is who decides when the model you depend on changes or disappears. Cloud AI services from OpenAI, Anthropic, Google and Microsoft give you strong contractual protections on training and retention. As of 5 Nov 2026, though, none of them offers Singapore in-country processing for its flagship business AI product. A deskside system such as the NVIDIA DGX Station GB300, with 748GB of coherent memory, can run large open-weight models entirely on your premises. That does not make it the right home for every workload. The sensible question is which workloads need sovereignty, and what you give up to get it.

What does sovereign AI mean for a company rather than a country?

The term comes from national policy. NVIDIA defines sovereign AI as "a nation's capabilities to produce artificial intelligence using its own infrastructure, data, workforce and business networks." Gartner's January 2026 definition of AI sovereignty explicitly includes organisations: "the ability of a nation or organization to independently control how AI is developed, deployed, and used." Gartner also predicts that by 2027, 35% of countries will be locked into region-specific AI platforms.

For a business, it helps to split "control" into layers. The table compares a typical cloud AI API with a model you host yourself.

Sources: OpenAI "Your data" guide; Anthropic data residency and retention docs; Microsoft 365 Copilot privacy page and in-country processing announcement (4 Nov 2025, revised 3 Apr 2026); Gartner press release (29 Jan 2026); NVIDIA blog. All accessed 5 Nov 2026. Vendor terms change, so check the current pages before relying on them.

Why does it matter where the model runs, not just where data is stored?

Because the prompt has to be decrypted and processed somewhere. OpenAI's data residency in Asia, launched on 7 May 2025, lets eligible ChatGPT Enterprise, Edu and API customers store data at rest in Singapore. OpenAI's own documentation says regional processing is available only in the US, Europe and the UAE. Anthropic's API lets customers choose inference in the "us" or "global" geography, with storage at rest in the US only. Google's Gemini Enterprise Agent Platform (formerly Vertex AI) keeps machine-learning processing within the chosen jurisdiction when you use a regional endpoint, but its "global" endpoints "don't provide any data residency guarantees". Microsoft says customers outside the EU "may have their queries processed in the US, EU, or other regions."

Jurisdiction is a separate layer. The US CLOUD Act (18 U.S.C. §2713, 2018) requires US providers to disclose data in their "possession, custody, or control" whether it is stored inside or outside the United States. A Singapore-region bucket run by a US provider therefore has residency, but it is not beyond US legal process. Our post on data residency vs data sovereignty looks at this distinction in detail.

Residency tells you where your data sits. Sovereignty tells you who can reach it and who decides what happens to the model you rely on.

Is a company's "intelligence" really at risk on a public AI service?

The risk is less about vendors misusing data, which their business terms forbid, and more about dependence. Three examples from the past 18 months:

• Models retire. OpenAI retired GPT-4o and several other models from ChatGPT on 13 Feb 2026, and GPT-4o and GPT-4.1 leave the API on 14 Jan 2027. Anthropic gives at least 60 days' notice; Claude 3.5 Sonnet went from deprecation to retirement in about 11 weeks. Prompts, evaluations and workflows tuned to one model have a shelf life.
• Services go down. OpenAI had errors lasting more than 10 hours on 10 Jun 2025. Google Cloud's 12 Jun 2025 incident affected Vertex AI, with the Singapore region among the slower to recover. Anthropic reported elevated errors for at least 7.5 hours on 2 Mar 2026.
• Prices and plans change. Google's pricing page shows Gemini 4 Argon rising from $2/$10 to $4/$20 per million input/output tokens on 1 Dec 2026. Our token inflation post covers this in more depth.

None of these is a reason to abandon cloud AI. They are reasons to know which of your processes would stop if a vendor changed course. Your Company Owns the Data. But Does It Control the AI? turns that into a checklist.

What does hosting AI yourself actually give you?

Running an open-weight model locally gives you all three layers of control. Prompts and documents never leave your network. The weights you download keep working after the publisher releases a newer model. Your cost per request is mostly the electricity and staff time once the hardware is paid for. A DGX Station GB300 pairs 252GB of HBM3e with 496GB of LPDDR5X, enough for open-weight models in the 100B-plus range. StorageReview measured 9,280 output tokens per second with gpt-oss-120b at 128 concurrent requests on an ASUS ET900N G3. Singapore's own SEA-LION models, tuned for Southeast Asian languages, are also downloadable.

The trade-offs are real. On the Artificial Analysis Intelligence Index, the top model on its open-weights list scored 33, against 55 to 60 for the leading closed models, when accessed on 5 Nov 2026. You also become the operator: patching, monitoring, backups and access control are your job (see who manages a DGX Station). Local hosting also does not remove your PDPA duties. The Protection Obligation still requires reasonable security arrangements, and a breach affecting 500 or more people is still notifiable.

Which workloads should stay with cloud AI?

Plenty of them. Cloud services are usually the better choice when:

• the task needs the best reasoning or coding quality available, where frontier models still lead;
• volumes are low or irregular, so paying per token costs less than owning hardware;
• the data involved is already public or low-sensitivity;
• you have no one to run a server, or you need features like built-in collaboration and integrations.

A practical split for many companies is hybrid. Keep confidential documents, customer records and anything under contractual or sectoral restrictions on infrastructure you control. Send general drafting, research and public-data tasks to whichever cloud model does them best. A gateway in front of both lets staff use one interface while IT decides what goes where. Our Singapore-focused sovereign AI post looks at which industries lean most towards the local side.

How should you start?

1. List your AI use cases and classify the data each one touches: public, internal, confidential or regulated.
2. For each cloud service in use, record where prompts are processed, how long they are retained and the notice period for model retirement.
3. Identify the processes that would stop if that service went down or changed price.
4. Pilot the confidential workloads on local hardware with an open-weight model, and measure whether the answer quality is good enough.

For background on the data question, see where company data goes when using AI. For the dependency question, see are businesses too dependent on ChatGPT.

Buying in Singapore

SourceIT lists five DGX Station GB300 systems, all price on request: the HP ZGX Fury G1n, MSI XpertStation WS300, ASUS ExpertCenter Pro ET900N G3, GIGABYTE W775-V10-L01 and Supermicro ARS-511GD-NB-LCC. For a smaller private-AI pilot, the NVIDIA DGX Spark with 128GB of unified memory and a 4TB SSD is S$9,300 (listed 5 Nov 2026). Browse the DGX Spark and DGX Station collection or our AI workstations and servers. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is sovereign AI for a business? It is the ability to control where your AI workloads run, whose law applies to them and when the models you rely on change. Gartner's definition of AI sovereignty explicitly covers organisations as well as nations.

Do OpenAI, Anthropic or Google train on business customers' data? Not by default. Their business and API terms, as published on 5 Nov 2026, say customer inputs and outputs are not used for training unless the customer opts in or gives permission.

Can I keep AI processing inside Singapore with a cloud provider? It depends on the product. OpenAI offers Singapore storage at rest but lists regional processing only in the US, Europe and the UAE. Anthropic offers "us" or "global" inference. Google's regional endpoints keep processing within the chosen jurisdiction for supported models. Microsoft 365 Copilot's in-country processing list does not include Singapore.

Does running AI locally make my company PDPA compliant? No. It removes the overseas-transfer question for that workload and shortens the supplier chain, but the Protection Obligation, breach notification and your other PDPA duties still apply.

Is a DGX Station needed for sovereign AI? Not always. Smaller GB10 systems such as the DGX Spark can run mid-sized open models for a team. The DGX Station suits larger models, many concurrent users or several departments sharing one system.