A sovereign estate with no external dependency

The shape of the requirement

A national digital agency writes a brief that is unusually strict, and unusually clear: the capability has to keep working if every foreign vendor — including us — becomes unavailable overnight.

Not "data stays in the country". Not "hosted in a local region". The whole thing: weights, training corpora, evaluation suites, orchestration, operational runbooks and the skills to run them, all inside the national estate, with no callback to anything outside it.

Why most answers do not meet it

It rules out every API-based frontier model. It rules out any control plane that phones home for licensing, telemetry or model updates. It rules out the standard managed operating model, in which the vendor monitors the estate continuously from its own operations centres.

What it does not rule out is a platform designed to be handed over. That is a property you either build in from the start or retrofit badly.

The design

An air-gapped control plane

The full control plane runs inside the agency's facility with no egress. Licensing is offline. Model updates arrive on physical media through the agency's own import process, and are promoted only after the agency's evaluation suite clears them — a process the agency runs, not the vendor.

An open-weight model estate, tuned in-country

Built on open-weight foundation models, further trained on the agency's governed corpora inside the facility. No dependency on a model anybody can withdraw.

Not everything needs to be a large model. Narrow, well-specified services are frequently served better by a small domain-tuned model, which matters when the compute budget is finite because you cannot rent elasticity.

Cleared personnel, and a transfer plan from week one

On-site engineering with the relevant national clearances is the deployment model. It is not the destination.

The contract should specify a capability transfer: every runbook, every evaluation suite, every training pipeline, and a named agency counterpart for each vendor role, with dates. The measure of success is the vendor's people being on call and on the roadmap rather than on the rota.

An exit plan, written before the first deployment

The agency holds the weights, the corpora, the evaluation suites, the pipeline definitions and the runbooks. If the relationship ends, the estate keeps running. Write what that transition looks like in the first month, before there is anything to transition.

Vendors do not usually volunteer this. It is the entire point of the product.

What it costs

Expect a capability gap against hosted frontier models at deployment, narrowing as domain training compounds. Expect compute costs meaningfully above an elastic public-cloud equivalent, because you are buying peak rather than renting it. Expect the operating model to be the longest lead item — clearances and capability transfer take longer than hardware.

The part that generalises

Almost every enterprise asks a version of the sovereign question eventually, even with no government in the picture: what happens to us if you go away?

For most vendors the honest answer is "you start over". Designing for this one means answering it in writing, in advance, with a mechanism behind it. There was never a good reason that should be reserved for the customers with a flag.