AI You Own, on Data You Can Finally Use

Picture a fraud analyst at a bank on a Monday morning. He has customer tables, transaction histories, and a folder of case files, and for the first time he also has a capable model running on his company’s own GPUs. He wants to ask it one question: which client has an open AML (anti-money laundering) issue, and what should we do about it? He cannot. He is not cleared to see the data the model would need to read, and neither is the model. The project that was supposed to prove the value of AI on the company’s most sensitive data dies in a review meeting, like most of them do.

Sovereign AI promises a way out: run the intelligence on infrastructure, models, and data that you control. Travis Oliphant, the creator of NumPy and founder of OpenTeams, breaks the AI stack into three layers a leader has to understand—the code, the weights, and the data—and his warning is blunt: organizations without sovereign data and sovereign AI are, in his words, “essentially giving up their identity, their ability to define themselves.” Two of those three layers are largely solved problems. The third is where sovereign programs stall, because the most valuable data in the company is precisely the data nobody is allowed to touch.

Protegrity and OpenTeams built and recorded a working answer to both at once: protect the data the moment it lands, and let clearance, not the prompt, decide who sees the real values.

Sovereignty stalls at the data layer

The money is already moving. McKinsey estimates that 30 to 40 percent of AI spending could be influenced by sovereignty requirements, a market of some 500 to 600 billion dollars globally by 2030, and finds that nearly three quarters of enterprises have sovereign AI on their 2026 roadmaps, though few have concrete plans behind it. The pull is no longer only governmental: in June, PNC’s CEO Bill Demchak told investors the bank is building its own “AI factory,” with in-house models and data centers, precisely to stop depending on tech vendors for its intelligence. Regulation pushes in the same direction, with the EU AI Act’s obligations arriving in August 2026.

Yet the same McKinsey research finds many sovereign AI initiatives stalling, with sovereign cloud and AI migrations typically taking three to four years, timelines driven not by technology but by the organizational work of moving regulated workloads. And it names the trap in one sentence: “Localization keeps data ‘inside,’ but it does not automatically make data usable.”

That is the data layer talking. The code layer is solved: open-source platforms deploy governed data science environments onto any Kubernetes from a single configuration file. The weights layer is solved: open models run on your own GPUs and can be swapped at will. But when the workload touches names, national IDs, and account numbers, the traditional answer is restriction: lock it down, limit access, keep the model away. Restriction protects the data. It also idles the very AI program the organization just paid to build, which is why regulated workloads move last, if they move at all.

Protect at landing, reveal by clearance

The pattern Protegrity and OpenTeams demonstrated runs a complete financial-crimes investigation inside one sovereign zone. Nebari provides the governed platform, identity, workspaces, and one versioned environment the whole team shares; two open-weight models serve from the zone’s own GPU. Protegrity protects identifiers at landing, before any analyst ever sees them, in a form that still behaves like data: protected dates are still dates, protected card numbers still carry sixteen digits, and the protection is deterministic, so joins, aggregations, and referential integrity survive untouched.

On that foundation, a fraud analyst who is not cleared for personal data runs the whole investigation, and the model, reading only protected context, recommends enhanced due diligence and a suspicious activity report. When the cleared investigations lead runs the same code under his own login, the protection resolves and the real name appears. Same notebook, same data, same policy. The only variable is the identity.

The business case follows directly. McKinsey’s survey finds sovereign AI offerings perceived as 10 to 30 percent more expensive than global alternatives, and concludes that sovereignty becomes commercially relevant when it clearly reduces risk or enables deployment in regulated settings. Protection at landing is what does the enabling, and each mechanism is a line in the P&L. Every investigation, model, or analytics product blocked on data access is deferred revenue; protection at landing releases it. The GPUs and the platform are sunk cost whether or not regulated data flows through them, so every newly usable dataset raises the return on infrastructure already paid for.

Against migration timelines of three to four years, data that lands protected moves early, because the compliance argument is settled at ingestion rather than renegotiated per project. And one governed pattern scales from one analyst to a hundred, and eventually to agents, without a new security review each time.

Security that opens data up

This is security through architecture rather than good behavior. The model never holds an identity because it never receives one. The search index never holds an identity. The reveal is not a capability of the notebook; it is a property of the person running it. A semantic guardrail scores every prompt against a financial domain model before it reaches the model, so a hostile instruction is stopped where a legitimate question sails through. The layers are independent, and none of them depends on the question being well-behaved.

And this pattern is not a one-off. It is the third in a family of secure-AI architectures built on the same principle: protect below the model and let policy decide exposure. Ask Anything, Expose Nothing applies it to text-to-SQL, where a deterministic compiler validates what the model proposes, and A Zero Trust Framework for Safer, Enterprise-Ready LangGraph AI Pipelines applies it to agentic pipelines through a dual-gate design at ingress and egress. Different front doors, same rule: clearance, not the model, decides what is exposed.

That independence changes what security is for. Oliphant’s own case for sovereignty is that you should not have to trade independence for convenience: AI today, he argues, is a “wonderful tool to enhance humans,” not a black box you rent by sending your most sensitive data to a third party. The same logic applies inside the enterprise. Protection, done this way, stops being the department that says no and becomes the mechanism that turns the company’s most sensitive tables into revenue-producing inputs a whole team can finally put in front of a model.

And because every step in the flow is an API behind an identity, the same holds when nobody is typing: give an agent its own credentials and it can run the same investigation overnight, on protected data, behind the same gates, with the reveal still reserved for cleared humans. That is what a sovereign AI stack is for: not locking data down, opening it up. AI you own, on data you can finally use.

The full demonstration is recorded. Watch it here.