- Sovereign AI has become a sales label across the Caribbean and Latin America, applied to products where every answer is generated by a foreign foundation model.
- Three categories carry three different risk profiles: sovereign AI, a self-hosted open-weight model, and a foreign model behind a local interface.
- Seven tests separate them. Four are cheap and quick, and three of the popular ones can be defeated by a competent vendor who wants to defeat them.
- The test that cannot be talked around is a demonstration with outbound access to foreign model providers blocked. A local model keeps answering. A wrapper stops.
- Buying a rebranded foreign model is often a sensible decision. Believing you bought something else is the part that costs you, in residency evidence you cannot produce and continuity you do not hold.
A vendor selling into a Caribbean bank, ministry or insurer in 2026 has learned which words open the door. Sovereign. Local. Regionally hosted. Trained on Caribbean data. I have sat on both sides of that conversation for years, as the person building AI systems and as the person a board calls in the week before they sign, and the pattern is consistent enough now to write down. In most of those rooms, what is described to me as sovereign AI turns out to be an application layer, built locally and often built well, that sends every query to OpenAI, Anthropic, Google or a hosted open-weight service in North America or Europe.
Many of those products are good. The trouble is the description, because directors approve these purchases against the assumptions the description creates: that the data stays here, that the vendor controls the system, that the regulatory exposure is contained. When those assumptions turn out to be wrong, they turn out to be wrong in an audit, which is the most expensive place to find out.
What the word is supposed to mean
Sovereignty over a capability means you can decide, on your own terms, whether it keeps running and who sees what passes through it. Applied to an AI system, that resolves into three conditions that have to hold together rather than separately.
The party you contract with owns the model or licenses weights on terms it controls, which means it can keep serving you if the original supplier changes its mind. Inference runs on hardware that the vendor or you operate, in a place either of you can name. And that place appears in the contract, not in a slide, because a regulator asking where customer data is processed is asking for a document.
Two things people treat as sovereignty are not. A local interface over a foreign model is a product decision, not a sovereignty position, and the branding on the login page has no bearing on where the tokens are processed. Fine-tuning a hosted foreign model on your own data moves you further from sovereignty rather than closer to it, because you have now sent the training data across as well, and the resulting weights sit with the provider.
| Attribute | Sovereign AI | Self-hosted open-weight model | Foreign model, local interface |
|---|---|---|---|
| Where inference runs | Vendor or buyer infrastructure, named location | Your own servers or your own cloud tenancy | The foundation-model provider's data centres |
| Who can switch it off | The vendor, under your contract | You | The provider, and the government that regulates it |
| Data residency evidence | Contractual and auditable | Verifiable by inspection | Governed by the provider's terms, not the vendor's |
| How it is priced | Compute, capacity or licence | Hardware and operations | Per token, with a margin added |
| What breaks it | Vendor failure | Your own operations | Provider outage, policy change, export restriction, price move |
The middle column is where most serious Caribbean deployments should probably sit, and it gets the least airtime because nobody has a sales team selling it. Open-weight families are downloadable, run on modest hardware once quantised, and put the residency question beyond argument, because the model is on a machine you can walk up to.
The wrapper business, and why it exists
Building an application on top of a frontier model is legitimate work. Someone has to design the workflow, connect the systems, handle the edge cases and answer the phone when it breaks at eleven at night, and a local firm that does that well is worth paying. The wrapper business exists because it is a reasonable business.
What has changed is the vocabulary. Two years ago these products were sold as AI-powered. Now the same products are sold as sovereign, because governments across the region started asking about data residency and the word tested well. The engineering stayed where it was while the label moved, and a label describing something the product does not do is where a commercial claim turns into a governance problem.
There is a second, uglier reason to care. Investment fraud in this region has learned the same vocabulary. The Trinidad and Tobago Securities and Exchange Commission has issued repeated public investor alerts about schemes using AI-generated deepfake videos of public figures to sell fake products, and proprietary AI is a standard part of the pitch. When sovereign AI becomes a phrase that means nothing in particular, it becomes free cover for people whose product is a spreadsheet and a Telegram group.
Testing a vendor in an afternoon
These are the checks I actually run. They are ordered from cheapest to most decisive, and I have marked what each one proves, because a test that produces a false clearance is worse than no test at all.
Test 01
Ask the model what it is
Type the question into the product: what foundation model are you built on, what is your architecture, who trained you. Then ask it again in a different way, and once more inside a longer conversation, because guardrails are usually written for the obvious phrasing.
What it proves. A leak is strong evidence. A model that names GPT, Claude or Gemini has told you the answer. A denial proves very little, because a system prompt can instruct a model to deny it, and because models routinely misidentify themselves. I have seen a self-hosted open-weight model insist it was made by OpenAI, which was false and would have failed an honest vendor unfairly. Treat this as a way to catch carelessness, not as a clearance.
Test 02
Watch the traffic during a query
Ask your IT team, or use a free proxy tool such as HTTP Toolkit, to record the network calls a client makes while the product answers a prompt. Look for requests to api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, and the common hosted-inference endpoints.
What it proves. A hit is conclusive. A clean trace is close to meaningless, because any competent product calls the provider from its own backend, so the client only ever talks to the vendor's domain. What you can still learn from the trace is where the vendor's own endpoint resolves and how long the round trip takes. Time to first token that matches a North American round trip, from a client sitting in Kingston or Bridgetown, belongs in a written question to the vendor.
Test 03
Which weights are loaded, and under what licence
A team running its own model can answer this in one sentence. They will name a base model and a licence, or they will tell you it is their own architecture and describe the training approach at a level that survives a follow-up question. A team reselling API access will answer with capability language about accuracy and speed.
What it proves. A lot, quickly, and it is hard to fake in front of anyone technical. Bring an engineer to this meeting. If your organisation does not have one, this is the single strongest argument for having a trained AI Officer in the room before signature rather than after.
Test 04
Read the sub-processor list
Every serious vendor publishes, or will provide on request, the list of third parties that process customer data on its behalf, normally as a schedule to the data processing agreement. Read it for names, and read the surrounding clause for how changes are notified.
What it proves. This is the most useful of the paperwork tests, because it is contractual rather than technical. A foundation-model provider listed as a sub-processor for inference settles the question. So does the absence of any list, or a clause reserving the right to change sub-processors at the vendor's discretion without notice, which is a way of telling you the answer while retaining the right to change it.
Test 05
Correlate the outage history
OpenAI, Anthropic and Google Cloud publish incident histories at status.openai.com, status.anthropic.com and status.cloud.google.com. Pull the dates of your vendor's last several outages and lay them against those histories.
What it proves. Matching dates are good evidence of dependency. Non-matching dates prove less than they appear to, because a well-built wrapper fails over between two or three foreign providers and will therefore stay up through any single one of them. That architecture is genuinely more resilient than a single dependency. It is still not sovereign, and the failover itself is worth asking about, because it usually means your prompts can land at any of several providers depending on the hour.
Test 06
Look at what the invoice is counting
Pull an actual invoice rather than a rate card. Sovereign and self-hosted systems price on capacity: GPU hours, node hours, throughput, seats tied to provisioned hardware. Resold products price on tokens, requests or credits, because that is how their own costs arrive.
What it proves. Moderate evidence, easily disguised. Credits and seat bundles hide token pricing well. The sharper version of the question is what happens to your bill if usage triples, and whether the vendor will commit to a fixed price at that volume. A vendor whose costs scale with your tokens cannot make that commitment, and will explain why in language that answers the original question.
Test 07
Block the outside world and see what still answers
Ask the vendor to run the product for you on a network where outbound traffic to the major foreign model providers is blocked at the firewall, or to deploy into your own cloud tenancy or your own rack where you control egress. Give them notice. Let them prepare.
What it proves. Everything the other six were reaching for. A model running on infrastructure you control keeps answering with the internet cut off. A rebranded foreign product returns an error, or falls back to a canned response, and no amount of architecture diagramming changes that outcome. This is the test to run when the answer actually matters, and it is the test most vendors will try to renegotiate into a written assurance instead.
Where these tests fail, including mine
Publishing a diagnostic degrades it. Every vendor who reads this page can now write a system prompt that refuses Test 1, and can rehearse an answer to Test 3 that sounds fluent to a non-technical buyer. That is the cost of writing it down, and I think the trade is worth making, because the buyers who need this are the ones who currently have no framework at all, while the vendors who would game it were already ahead of them.
What survives the gaming is the part that costs money to fake. A vendor cannot fake an egress-blocked demonstration. A vendor cannot fake a sub-processor schedule that its own lawyers have signed, because misrepresenting sub-processors in a data processing agreement is a contractual breach with consequences rather than a marketing exaggeration. Tests 4 and 7 are the ones I would keep if I had to keep only two.
There is a harder limitation, and it is mine. This framework treats sovereignty as a property of one vendor relationship, when the real exposure is usually the accumulation. An organisation with a genuinely local core system, a foreign transcription tool nobody logged, a browser extension three people in finance installed, and a customer service bot from a fourth supplier does not have a sovereignty position at all. It has one good contract and an unmapped surface. I have watched an institution pass every test on its flagship AI system and still route its most sensitive material through a note-taking app that joined meetings uninvited. Running the diagnostic on one vendor is necessary and it is not sufficient, because what protects you is the inventory, and in the organisations I have worked with over the past two years that inventory has usually not existed before we built it.
What it costs when the label is wrong
Four exposures follow from a misdescribed system, and they arrive on different timescales.
Data residency you cannot evidence. The moment a prompt containing customer records or board papers is sent to a foreign endpoint, a cross-border transfer has occurred. Jamaica's Data Protection Act, Barbados' Data Protection Act, and the equivalent statutes across CARICOM all treat that as a regulated act requiring a lawful basis and, in most cases, documentation. Your compliance officer will eventually be asked for a data flow diagram. If the vendor cannot say where inference happens, that diagram cannot be drawn, which is how a technical detail becomes an audit finding.
Regulatory exposure that follows the data. Any organisation serving EU customers, or supplying a client that does, sits inside the reach of the EU AI Act, where penalties for prohibited practices run to €35 million or 7% of worldwide annual turnover, and other breaches to €15 million or 3%. GDPR fines reach €20 million or 4%. Those ceilings are rarely the operative risk for a mid-sized Caribbean institution. The operative risk is a supervisory finding that your governance over a material third party was undocumented, which is a much cheaper thing to trigger and a much harder thing to explain to a board.
Continuity you do not hold. A rebranded product inherits every decision made at the provider level: deprecation of a model version, a change in acceptable use, a regional access restriction, an export control order. Any of those can land without notice, and your vendor's service agreement will describe the resulting outage as outside its control, because it is. If an AI system sits inside a process you cannot run manually, that dependency belongs in your business continuity plan under its own heading.
Costs you cannot negotiate. When the upstream price moves, your vendor has no cushion to absorb it and nothing to argue with. Multi-year AI budgets approved on per-token products carry a pass-through risk that nobody at the table has priced, and the vendor's inability to hold a price at volume is usually the first honest signal you will get about the architecture underneath.
If you are not buying this for an organisation
The same claim is now attached to consumer apps: local AI, private AI, runs on your device. Three checks cover most of it.
Read the privacy policy for names rather than adjectives, because a policy that promises security and encryption while naming no third parties has told you nothing about who sees your data. If an app says it runs on your device, put the phone in aeroplane mode and ask it a question, which takes ten seconds and settles it. And keep national identification numbers, medical detail and banking credentials out of any free assistant, on the working assumption that what you type may be retained and may be read by a human reviewer, because in many products it may be.
For anything involving money, treat proprietary AI and sovereign AI in an investment pitch as a warning rather than a credential. Regulators across the region have been issuing alerts about exactly this pattern, and the technology language is doing the same work in these schemes that offshore and hedge fund did in an earlier generation of them.
Before You Sign
- Named locationWrite the inference location, the operating entity and the region into the contract, not the proposal
- Sub-processor listComplete, with advance notice of changes and a right to exit without penalty when one is added
- Audit or attestationA right to verify where processing occurs, or an independent attestation you can hand a regulator
- Exit termsExport of your data, prompts, embeddings and any fine-tuned artefacts in a format you can use elsewhere
- Price protectionA cap on pass-through increases, or a right to terminate when upstream pricing moves beyond an agreed band
- Egress testA pre-signature demonstration with outbound access to foreign model providers blocked
What I would do on Monday
Start with the inventory, not the diagnostic. List every AI product in use across the organisation, including the ones nobody procured, and put a named owner against each. That list is almost always longer than the executive team expects, and its length is the finding.
Then run Test 4 across the whole list in a single afternoon by sending one email requesting each vendor's current sub-processor schedule. The replies, and the silences, will sort the list for you faster than any technical exercise. Reserve Test 7 for the systems that touch regulated data, because it takes real effort from both sides and should be spent where the answer changes a decision.
Someone in the organisation needs to own this permanently. That is the argument behind the AI Officer Programme I teach through StarApple AI: not that AI needs another committee, but that vendor claims of this kind need one person with the standing to ask for the sub-processor list and the training to read the answer. The Caribbean AI Risk Management Council has published the risk-register version of this diagnostic for boards that need it in the format their audit committee already uses, and the Caribbean AI Association has been arguing that the disclosure ought to be a regional procurement standard rather than a favour each buyer negotiates alone.
"I am not asking anyone to stop buying foreign models. I use them. I am asking buyers to know which one they bought, because the version of this that ends badly is not a bad product. It is a board that told its regulator the data stays here, in good faith, because that is what the brochure said."- Adrian Dunkley, AI Boss
The honest summary
Sovereign AI is a real category with real engineering behind it, and the Caribbean has good reasons to build in it. It has also become a word that costs a vendor nothing to say, which means the burden has shifted to buyers to check. Seven tests are set out above. Four of them can be worked around by a vendor who intends to work around them. Two of them cannot be worked around cheaply, and one of them cannot be worked around at all. Run that one on anything that touches your customers' data, and accept the answer you get.
Frequently Asked Questions
What is sovereign AI?
An AI system where the party you contract with controls the model and the hardware it runs on, and can name and evidence the jurisdiction where inference happens. All three conditions have to hold. The vendor owns or licenses the weights on terms it controls, the inference runs on infrastructure the vendor or the buyer operates, and the location appears in the contract rather than in a sales conversation.
What is a rebranded foreign model?
A product with a local interface, local branding and sometimes local fine-tuning, where every query is sent to a foreign foundation-model provider. The application can be genuinely good. The intelligence is rented, the data crosses a border to reach it, and the terms governing that data are set by the provider rather than by the vendor whose name is on your contract.
Does fine-tuning a foreign model on Caribbean data make it sovereign?
No. Fine-tuning a hosted model means you have sent your training data to the provider as well, and the resulting weights sit on their infrastructure. Residency, continuity and pricing exposure are unchanged. Fine-tuning open weights that you can download and re-host elsewhere is a materially different arrangement, which is why the question to ask is whether you can take the fine-tuned artefact with you when you leave.
How can I tell whether a product is running a foreign model?
Ask for a demonstration on a network where outbound access to the major foreign model providers is blocked, run on your infrastructure or under your observation. A local model keeps answering. A wrapper stops. Supporting checks include reading the sub-processor schedule, asking which weights are loaded and under what licence, correlating past outages against the providers' public status pages, and testing whether the vendor will hold a fixed price at triple your current volume.
Why does the location of inference matter?
Because it decides whose law applies to whatever is in the prompt. A prompt containing customer records, board papers or medical history becomes a cross-border data transfer the moment it is sent, and the retention terms, disclosure obligations and enforcement powers of the receiving jurisdiction attach to it. Data protection statutes across CARICOM treat that transfer as a regulated act requiring a lawful basis and documentation.
Is buying a rebranded foreign model always a mistake?
No. For marketing copy, internal drafting and summarising public documents, renting a frontier model through a capable local integrator is often the right call, and the integrator may add real value in workflow, support and accountability. The failure is the label. A board that approves a rebranded product believing it is sovereign has accepted a residency, continuity and pricing profile it never assessed, and has put something in its own governance record that is not accurate.
What should be in the contract?
A named inference location with the operating entity and region. A complete sub-processor list with advance notice of changes and a right to terminate without penalty. A right to audit or to receive independent attestation of where processing occurs. Exit terms covering export of your data, prompts, embeddings and fine-tuned artefacts in a usable format. And a cap on pass-through price increases, or a right to leave when upstream pricing moves beyond an agreed band.
What should an individual check before trusting an app that claims to be local?
Read the privacy policy for named third parties rather than reassuring adjectives. If the app claims to run on your device, switch off mobile data and wi-fi and see whether it still answers. Keep identification numbers, medical detail and banking credentials out of free assistants. And treat sovereign or proprietary AI in an investment pitch as a warning sign, because regional securities regulators have been issuing alerts about schemes built on precisely that language.