Who possesses intelligence? Where does sovereignty reside?

Deciding where data, models, and computing power are located has become a strategic autonomy choice for businesses and the public sector.

Key points:

Until a few years ago, the question “Who owns an organization’s intelligence?” had a simple answer: the organization itself, as the custodian of its data, processes, and people’s expertise. With generative models, the nature of the question changes. A growing portion of cognitive work is handled by algorithms trained elsewhere and run on third-party servers—algorithms that, however, draw on corporate knowledge. Every request sent to a model carries with it a fragment of that information assets: a contract, a project, or a production data point.

The relationship between digital sovereignty and artificial intelligence is often framed in geopolitical terms, as a contest between nations and major platforms. For an organization, however, the issue is much more concrete and concerns control over three distinct forms of intelligence, none of which is sufficient on its own. Value arises when they are combined, and it is precisely there—at the point where they intersect—that risk is also concentrated: the risk of losing control over one’s own knowledge, because data is processed on third-party infrastructure, under different jurisdictions, or within services from which it becomes difficult to exit.

Three Types of Intelligence Within the Same Company

In the age of AI, three forms of intelligence coexist: the artificial intelligence of the models, the intelligence of the enterprise—composed of data and expertise—and the intelligence of the infrastructure that connects them. Sovereignty lies in governing the point where they converge.

• Artificial Intelligence: Models, Algorithms, and the Computing Power Required to Run Them.
• Business Intelligence: business data, intellectual property, decision-making processes, and internal expertise.
• Infrastructure Intelligence: data centers, fiber connectivity, security, and business continuity.

The first is the most obvious, the most visible: language models, machine learning, agents, and analysis and automation tools. It is powerful and versatile, but it knows nothing about the company where it is implemented. It knows a great deal about the world and almost nothing about the products, customers, or business logic of those who use it.

The second aspect is less visible and concerns infrastructure: data centers, the cloud, networks, storage, computing accelerators, orchestration platforms, and security. For years, we’ve viewed this as an IT department issue—something that just has to work. Yet it is the infrastructure that determines where data is processed, who can access it, which services can be used, and how difficult it will be, in the future, to move what has been built elsewhere. In short, it, too, helps distribute technological power, even if it is rarely discussed.

The third is business intelligence. It consists of data, of course, but also of experience, expertise, relationships, and a record of past decisions. Having a lot of data doesn’t automatically mean knowing a lot: the value lies in the ability to transform it into knowledge and then into decisions. It is in this step that AI can make a difference—provided it has something to work with.

Why does sovereignty also apply to a company’s information assets?

None of the three is sufficient on its own. Value arises when they are combined, and that is precisely where the risk lies. A generic model becomes useful only when it is applied to the data and processes of a specific organization: whoever controls the point where these elements converge also controls part of the competitive advantage. This is the essence of sovereign AI: the ability to choose and control where and how the models and the data that feed them are executed, without irreversible dependencies on a single provider.

Where They Meet: Inference, RAG, and Fine-Tuning

Every AI project in a company, even the simplest one, has one thing in common: at some point, the data leaves the systems where it was generated and reaches the infrastructure on which the model runs. This can occur in three different ways, which vary in complexity and the level of exposure they entail.

The most direct approach isinference: each request sends text, data, or files to the model, and the volume of data grows as usage increases. RAG (Retrieval-Augmented Generation) enriches each request with internal documents: a search system queries an index of the corporate archive and passes only relevant content to the model. The index thus becomes a searchable copy of a significant portion of the information assets, and knowing where it is located is crucial. Finally, fine-tuning trains the model on company data, which is incorporated into its parameters: this data can no longer be removed without retraining, and in some cases, the model may reproduce fragments of it.

• Inference: Each request sends text, data, or files to the model, with volumes increasing as adoption grows.
• RAG: The internal document index contains a representation of the entire information assets.
• Fine-tuning: The training data becomes part of the model’s parameters and can no longer be separated from it.

What types of business data pass through the infrastructure of an AI model?

In production, these systems process contracts, customer and supplier data, technical projects, financial information, and—in the public sector—citizen data. Indexes and logs keep track of this information. If the infrastructure belongs to a third party, it is essential to know where it is located, which jurisdiction it falls under, and what data it stores. The first practical step is to classify use cases based on data sensitivity, even before selecting a platform and provider.

What the Data Says About Adoption in Italy

The adoption of AI in Italy has doubled in one year and now exceeds half of all large companies. The main obstacles are not technological: there is a lack of skills, regulatory clarity, and data of adequate quality.

According to Istat (Businesses and ICT, December 2025), 16.4% of companies with at least 10 employees use artificial intelligence, up from 8.2% in 2024, and the share rises to 53.1% among large companies. Adoption is outpacing the ability to manage it.

It is more interesting to look at those who have evaluated AI without adopting it. 58.6% cite insufficient expertise, 47.3% cite unclear regulations, 45.2% cite scarce or low-quality data, and 43.2% cite concerns about privacy and data protection. These are obstacles related to the governance of enterprise intelligence rather than access to the technology itself, and they largely involve infrastructure: knowing where data is stored, who can access it, and what safeguards are in place reduces regulatory uncertainty and simplifies compliance assessments.

Intelligent Infrastructure for AI

An artificial intelligence infrastructure requires high-density computing, advanced cooling, low latency, and redundant connectivity. Keeping processing close to the data reduces costs, response times, and exposure risks.

AI workloads have physical characteristics that are very different from those of traditional applications. Servers equipped with accelerators concentrate in a single rack the computing power that used to require an entire data center, and the heat generated necessitates liquid-cooling solutions. A system that queries databases distributed across multiple locations relies on low-latency fiber connectivity and redundant paths. The infrastructure thus becomes the system’s third layer of intelligence: it determines performance, continuity, and the legal location of the data.

• Power density: AI racks require tens of kW, compared to just a few kW for traditional racks.
• Liquid cooling: necessary for handling the most demanding workloads in an energy-efficient manner.
• Latency and connectivity: fiber-optic backbones and direct connections between offices, data centers, and the cloud prevent bottlenecks and uncontrolled traffic.

Why is it beneficial to bring the computation closer to the data?

Bringing computing closer to the data is beneficial because moving large volumes of data to a remote cloud is costly, introduces latency, and increases the number of points of exposure. An inference run in a local data center—connected to the offices via fiber—keeps the data under a known jurisdiction.

According to IDC (Directions 2026, AI Factories), 86% of organizations want the freedom to choose platforms other than the public cloud for large-scale AI inference. By 2027, 75% of non-U.S. large enterprises in the Global 2000 will prioritize AI sovereignty.

Data sovereignty, digital sovereignty, sovereign AI: three different levels

Data sovereignty concerns where information is stored and who has access to it. Digital sovereignty extends control to the entire technology chain. Sovereign AI adds governance over where and how models process knowledge.

These three concepts are often used interchangeably, but they describe progressive levels of control. An organization may store its data in Italy while simultaneously sending it to a model running elsewhere, thereby losing control precisely where the data generates the most value. For this reason, corporate digital sovereignty today also extends to the realm of AI.

Level	What Is Checked	Key Question	Traditional Specialties
Data Sovereignty	Location, Access, Governing Law, Portability	Where is the data, and who can access it?	National data centers, encryption, key management
Digital Sovereignty	Infrastructure, network, software, expertise, suppliers	Is it possible to switch providers without interrupting operations?	Hybrid architectures, open standards, exit clauses
AI Reigns Supreme	Model Implementation, Document Indexes, Training Data	Where and by whom is corporate knowledge developed?	Inference in Dedicated Environments, Open Models, and Controlled Logs

Is a sovereign cloud enough to guarantee AI sovereignty?

A sovereign cloud alone is not enough to guarantee AI sovereignty, because it primarily ensures the location and jurisdiction of the data. It is also necessary to verify where the models are run, who manages indexes and logs, which subcontractors are involved, and how to opt out of the service.

The Regulatory Framework: The AI Act and Requirements for Businesses

Four regulations define the scope: the AI Act on artificial intelligence systems, the Data Act on cloud portability, the NIS2 Directive (Network and Information Security Directive 2) on the supply chain, and Italian Law 132/2025 on AI.

The European and Italian frameworks do not impose a blanket requirement to localize data and models. However, they make the choice of infrastructure a governance decision that must be documented and verifiable. With the Digital Omnibus package, the timeline for the AI Act has been revised, pushing back the deadlines for high-risk systems.

AI Act (EU Regulation 2024/1689): This is the European legislation that classifies artificial intelligence systems by risk level and, for each level, establishes rules regarding transparency, data management, human oversight, and documentation.

• AI Act: Transparency requirements take effect on August 2, 2026. For high-risk systems, the deadlines are later: December 2, 2027, for those listed in Annex III, and August 2, 2028, for those listed in Annex I. To determine which category a solution falls under, you can consult the European Commission’s framework.
• Data Act: Effective September 12, 2025; as of January 12, 2027, switching to another cloud provider must be free of charge, with a transition period of no more than 30 days.
• NIS2: Transposed into Italian law by Legislative Decree No. 138/2024, it requires security measures for the ICT supply chain;the National Cybersecurity Agency coordinates its implementation.
• Law No. 132 of 2025: Italy’s first law on artificial intelligence, effective as of October 10, 2025.

What does Italian law on AI stipulate for the public sector?

The Italian AI law allows the public administration to give preference, in its procurement, to solutions that ensure the localization and processing of strategic data, disaster recovery, and business continuity in domestic data centers. This is provided for in Article 5 of Law No. 132 of September 23, 2025.

The AI Act timeline has been revised several times: dates should be verified against official sources at the time of planning, particularly for high-risk systems.

Sovereignty as autonomy, not autarky

Sovereignty does not mean giving up on large global clouds, but rather retaining the freedom to choose: which workloads to keep in local, controlled environments, which to entrust to public platforms, and how to move them when necessary.

No single organization can develop models, chips, and platforms on its own. The goal is a hybrid architecture in which each workload resides in the location best suited to its sensitivity. The combination of digital sovereignty and artificial intelligence thus translates into a matter of choice: open models where control is needed, public services where scale matters, and localized infrastructure to hold the system together.

According to Gartner (February 2026), global spending on sovereign IaaS (Infrastructure as a Service) will reach $80 billion in 2026, representing a 35.6% increase. In Europe, the expected increase is 83%, and by 2027, European spending will exceed that of North America. Twenty percent of current workloads will shift from global clouds to local providers.

What Questions Should You Ask Before Choosing an AI Infrastructure?

Before choosing an AI infrastructure, there are five key considerations regarding data, models, contracts, and continuity—which are also useful for comparing different providers on a consistent basis.

• Where the data is stored: In which country and under which jurisdiction are the data, backups, indexes, and logs located?
• Where are the models trained: in a dedicated environment or on shared platforms outside the EU?
• Who has access: which subcontractors are involved and who manages the encryption keys.
• How to Manage Service Decommissioning: Timelines, Costs, and Formats for Migrating Data and Workloads.
• How to Ensure Continuity: SLA (Service Level Agreement), disaster recovery, and connectivity redundancy.

Sovereignty is also built through the choice of partners. To manage data, models, and connectivity, you need a provider that has its own infrastructure, understands the Italian and European regulatory frameworks, and has experience managing critical environments. Retelit supports enterprise organizations and public administrations with a proprietary fiber-optic network, dedicated connectivity between locations and the cloud, hybrid cloud solutions, and managed security services. In this way, the services of major hyperscalers are integrated with local control over data.

Who, then, possesses intelligence, and where does sovereignty reside?

The easiest answer would be “whoever owns the model.” But a model, on its own, knows nothing about the company that uses it. Value is created when it interacts with data, processes, and expertise, and that interaction always takes place in a specific location: a data center, a network, or a computing environment that someone manages and that operates according to certain rules. An organization’s intelligence therefore belongs to those who know how to manage it throughout the entire process. If the model is a black box, if the infrastructure prevents you from switching providers, or if the expertise needed to interpret the results lies entirely outside the organization, ownership of the data is worth less than it seems.

Sovereignty does not lie in a contract or a certification. It lies in that point of convergence—and in the concrete possibility of deciding where to place it, who can access it, and how to shift it. Every time you entrust a part of your knowledge to a model or a provider, you also entrust a part of your decision-making capacity along with it. The difference between dependence and autonomy lies entirely in knowing how much decision-making capacity you are relinquishing—and in being able to reclaim it when needed.

Frequently Asked Questions About Digital Sovereignty and AI

Edited by P. Annoni and T. Radojicic, *Digital Marketing*, Retelit