Deciding where data, models, and computing power are located has become a strategic autonomy choice for businesses and the public sector.<\/p>\n\n
Key points:<\/p>\n\n
<\/p>\n\n
Until a few years ago, the question \u201cWho owns an organization\u2019s intelligence?\u201d<\/a> had a simple answer: the organization itself, as the custodian of its data, processes, and people\u2019s expertise. With generative models, the nature of the question changes. A growing portion of cognitive work is handled by algorithms trained elsewhere and run on third-party servers\u2014algorithms that, however, draw on corporate knowledge. Every request sent to a model carries with it a fragment of that information assets: a contract, a project, or a production data point. <\/p>\n\n The relationship between digital sovereignty and artificial intelligence is often framed in geopolitical terms, as a contest between nations and major platforms. For an organization, however, the issue is much more concrete and concerns control over three distinct forms of intelligence, none of which is sufficient on its own. Value arises when they are combined, and it is precisely there\u2014at the point where they intersect\u2014that risk is also concentrated: the risk of losing control over one\u2019s own knowledge, because data is processed on third-party infrastructure, under different jurisdictions, or within services from which it becomes difficult to exit. <\/p>\n\n In the age of AI, three forms of intelligence coexist: the artificial intelligence of the models, the intelligence of the enterprise\u2014composed of data and expertise\u2014and the intelligence of the infrastructure that connects them. Sovereignty lies in governing the point where they converge. <\/p>\n\n <\/p>\n\n The first is the most obvious, the most visible: language models, machine learning, agents, and analysis and automation tools. It is powerful and versatile, but it knows nothing about the company where it is implemented. It knows a great deal about the world and almost nothing about the products, customers, or business logic of those who use it. <\/p>\n\n The second aspect is less visible and concerns infrastructure: data centers, the cloud, networks, storage, computing accelerators, orchestration platforms, and security. For years, we\u2019ve viewed this as an IT department issue\u2014something that just has to work. Yet it is the infrastructure that determines where data is processed, who can access it, which services can be used, and how difficult it will be, in the future, to move what has been built elsewhere. In short, it, too, helps distribute technological power, even if it is rarely discussed. <\/p>\n\n The third is business intelligence. It consists of data, of course, but also of experience, expertise, relationships, and a record of past decisions. Having a lot of data doesn\u2019t automatically mean knowing a lot: the value lies in the ability to transform it into knowledge and then into decisions. It is in this step that AI can make a difference\u2014provided it has something to work with. <\/p>\n\n None of the three is sufficient on its own. Value arises when they are combined, and that is precisely where the risk lies. A generic model becomes useful only when it is applied to the data and processes of a specific organization: whoever controls the point where these elements converge also controls part of the competitive advantage. This is the essence of sovereign AI<\/strong>: the ability to choose and control where and how the models and the data that feed them are executed, without irreversible dependencies on a single provider. <\/p>\n\n Every AI project in a company, even the simplest one, has one thing in common: at some point, the data leaves the systems where it was generated and reaches the infrastructure on which the model runs. This can occur in three different ways, which vary in complexity and the level of exposure they entail. <\/p>\n\n The most direct approach isinference<\/strong>: each request sends text, data, or files to the model, and the volume of data grows as usage increases. RAG<\/strong> (Retrieval-Augmented Generation) enriches each request with internal documents: a search system queries an index of the corporate archive and passes only relevant content to the model. The index thus becomes a searchable copy of a significant portion of the information assets, and knowing where it is located is crucial. Finally, fine-tuning<\/strong> trains the model on company data, which is incorporated into its parameters: this data can no longer be removed without retraining, and in some cases, the model may reproduce fragments of it. <\/p>\n\n <\/p>\n\n In production, these systems process contracts, customer and supplier data, technical projects, financial information, and\u2014in the public sector\u2014citizen data. Indexes and logs keep track of this information. If the infrastructure belongs to a third party, it is essential to know where it is located, which jurisdiction it falls under, and what data it stores. The first practical step is to classify use cases based on data sensitivity, even before selecting a platform and provider. <\/p>\n\n The adoption of AI in Italy has doubled in one year and now exceeds half of all large companies. The main obstacles are not technological: there is a lack of skills, regulatory clarity, and data of adequate quality. <\/p>\n\nThree Types of Intelligence Within the Same Company<\/h2>\n\n
\n
Why does sovereignty also apply to a company’s information assets?<\/h3>\n\n
Where They Meet: Inference, RAG, and Fine-Tuning<\/h2>\n\n
\n
What types of business data pass through the infrastructure of an AI model?<\/h3>\n\n
What the Data Says About Adoption in Italy<\/h2>\n\n