The questions to ask before you believe the word "sovereign"

We just got back from GITEX Europe in Berlin, and we are still turning one thing over in our heads.

Two days on the show floor, dozens of conversations, a stand at the Austrian Pavilion, a panel, a lot of coffee. It was one of the better events we have been to. The energy in the halls was real, the questions from visitors were sharp, and it was genuinely good to stand next to other European companies building things that matter. If you came by and talked with us, thank you. Those conversations are the reason we go.

But something kept coming up, over and over, and it is worth saying out loud.

Everyone was selling sovereignty. Almost nobody meant the same thing by it.

"Sovereign AI" was on banners the size of buildings. "Sovereign cloud." "Infrastructure built in the EU, for the EU." "AI you can trust." The word was everywhere. And the more we heard it, the clearer it became that it had been stretched to mean almost anything.

Here is the pattern we saw most often, and it is the one that bothers us.

A company would say their solution is "self-hosted." Sounds perfect for a regulated customer. But when you asked one more question, it turned out they meant they host it, on their infrastructure, somewhere you cannot see. Not that the customer hosts it inside their own walls. Those are two completely different things, and the language quietly slides from one to the other.

"Self-hosted" should mean the software runs on your hardware, in your building, under your control. When it actually means "we run it for you and call it self-hosted," the word has been turned inside out. A customer hears "the data stays with me" and the reality is "the data sits with a vendor who used a comforting word." That is not a small distinction. For a bank, a hospital, a law firm, or a public body, it is the whole point.

"AI you can trust" is a promise. Trust is not.

The other line we saw everywhere was some version of "AI you can trust."

It is a good slogan. But trust is not a slogan, it is a structure. So the honest question is: trust based on what?

If your AI runs on infrastructure that belongs to someone else, in a jurisdiction that is not yours, then the trust you are being sold is a promise that nothing will change. And promises can be withdrawn. Access can be switched off from one day to the next. Terms change. Jurisdictions assert themselves. A region on a map is a location, not a guarantee of control.

For a regulated organisation, "trust me, it will always be here and no one will ever compel me to hand over your data" is not something you can put in a compliance file. Trust that can be unplugged is not trust. It is dependency with better marketing.

Sovereignty has to live inside the company

This is where we land, and it is why we built Xinity the way we did.

There is sovereignty by contract, and there is sovereignty by architecture. Sovereignty by contract means you are trusting a promise: a clause, a data-residency commitment, a vendor's word that the servers happen to sit in Frankfurt this year. Sovereignty by architecture means the answer is structural. The data cannot leave, because the model runs on your hardware, in your building, on infrastructure you control. There is no switch someone else can flip, because there is no one else in the loop.

That is the difference between a location and control. Between a promise and a guarantee. Between "we host it for you" and "you host it, fully, and nothing leaves your walls."

We think the market is going to sort this out over the next couple of years, because regulated customers are already asking the second and third questions at the booth, not just the first. They are learning to hear the difference between "sovereign" as a badge and sovereignty as an architecture. GITEX made us more sure of that, not less.

So if you are evaluating anything that calls itself sovereign, self-hosted, or trustworthy, ask the boring follow-up questions. Where does the data physically live? Who owns the hardware? Who can be compelled, and under whose law? Who can turn it off? The answers separate the slogan from the substance very quickly.

We came home tired and glad we went. And more convinced than ever that for the customers we serve, sovereignty is not a word you put on a banner. It is something that has to live inside the company, in the walls, on the hardware, where no one else can reach it.

See you next year GITEX.