TL;DR
- Sovereign AI has become a sales phrase across the Caribbean and Latin America, attached to products where every answer is generated by a foreign foundation model.
- Three procurement categories carry three different risk profiles: sovereign AI, a self-hosted open-weight model, and a foreign model behind a local interface.
- Seven checks separate them. Three can be defeated by a vendor who wants to defeat them, and the article says which three.
- The decisive check is an egress-blocked demonstration. Run the product with outbound access to foreign model providers blocked. A local model keeps answering.
- Six RFP questions and five contract clauses settle the matter in writing, which is where a regulator will eventually ask you to have settled it.
- The purchase itself is often fine. Believing you bought a different thing is the part that costs money.
Every AI vendor selling into a Caribbean bank, ministry, insurer or utility in 2026 has learned which words open the door. Sovereign. Local. Regionally hosted. Trained on Caribbean data. I have spent this year on both sides of that meeting, as the person who builds these systems and as the person a board calls in the week before signature, and the same thing keeps happening. What is described as sovereign AI turns out to be an application layer, frequently well built by a capable local team, that sends every query to OpenAI, Anthropic, Google or a hosted open-weight service in North America or Europe.
Plenty of those products are worth buying. The difficulty is that directors approve them against assumptions the word creates: that the data stays in the region, that the vendor controls the system, that the regulatory exposure is contained. Those assumptions usually get tested for the first time during an audit, which is the most expensive place in the world to discover you were wrong.
Three Things a Buyer Might Be Purchasing
Sovereignty over a capability means you can decide, on your own terms, whether it keeps running and who sees what passes through it. Translated into a procurement decision, that resolves into three conditions that have to hold together. The party you contract with owns the model or licenses weights on terms it controls. Inference runs on hardware the vendor or the buyer operates. And the location of that hardware appears in the contract, because a regulator asking where customer data is processed is asking for a document rather than a reassurance.
| Attribute | Sovereign AI | Self-hosted open weights | Foreign model, local interface |
|---|---|---|---|
| Where inference runs | Vendor or buyer infrastructure, named location | Your servers or your own cloud tenancy | The foundation-model provider's data centres |
| Who can switch it off | The vendor, under your contract | You | The provider, and the government that regulates it |
| Residency evidence | Contractual and auditable | Verifiable by inspection | Governed by the provider's terms, not your vendor's |
| Pricing basis | Compute, capacity or licence | Hardware and operations | Per token or per credit, with a margin added |
| What breaks it | Vendor failure | Your own operations | Provider outage, policy change, export restriction, price move |
The middle column deserves more attention than it gets in this region, mainly because nobody has a sales team selling it. Open-weight families such as Llama, Mistral, Qwen, DeepSeek and Gemma are downloadable, run on modest hardware once quantised, and settle the residency question by inspection, because the model sits on a machine somebody can walk up to.
Seven Checks, Ordered by What They Prove
Check 01
Ask the model what it is
Put the question to the product directly: which foundation model are you built on, what is your architecture, who trained you. Ask again in different words, and once more deep inside a long conversation, because guardrails are usually written for the obvious phrasing.
Evidentiary weight. A leak is strong. A model that names GPT, Claude or Gemini has answered the question. A denial proves almost nothing, because a system prompt can instruct a model to deny it and because models misidentify themselves routinely. I have watched a self-hosted open-weight model insist it was built by OpenAI, which was false and would have condemned an honest vendor. Use this to catch carelessness, never as a clearance.
Check 02
Watch the network during a query
Have IT record the calls a client makes while the product answers a prompt, or use a free proxy tool such as HTTP Toolkit. Look for api.openai.com, api.anthropic.com, generativelanguage.googleapis.com and the common hosted-inference endpoints.
Evidentiary weight. A hit settles it. A clean trace settles nothing, because any competent product calls the provider from its own backend, so the client only ever speaks to the vendor's domain. What the trace still gives you is where the vendor's endpoint resolves and how long the round trip takes. Time to first token consistent with a North American round trip, measured from Kingston or Bridgetown, belongs in a written question to the vendor.
Check 03
Which weights are loaded, and under what licence
A team running its own model answers this in a sentence. They name a base model and a licence, or they describe their own architecture and training approach at a level that survives a follow-up. A team reselling API access answers with capability language about accuracy, speed and accuracy again.
Evidentiary weight. High, and difficult to fake in front of anyone technical. Bring an engineer to this meeting. Organisations without one in the room are the reason the AI Officer role exists.
Check 04
Read the sub-processor schedule
Every serious vendor publishes, or will supply on request, the list of third parties processing customer data on its behalf, normally as a schedule to the data processing agreement. Read it for names, then read the surrounding clause for how changes get notified.
Evidentiary weight. The most useful of the paperwork checks, because it is contractual rather than technical. A foundation-model provider listed as a sub-processor for inference closes the question. So does the absence of any list, or a clause reserving the right to change sub-processors at the vendor's discretion without notice, which tells you the answer while keeping the right to change it later.
Check 05
Lay the outage history against the status pages
OpenAI, Anthropic and Google Cloud publish incident histories at status.openai.com, status.anthropic.com and status.cloud.google.com. Take the dates of the vendor's last several outages and compare.
Evidentiary weight. Matching dates are good evidence of dependency. Non-matching dates prove less than they look, because a well-built wrapper fails over between two or three foreign providers and survives any single one going down. That design is genuinely more resilient than a single dependency, and it still leaves your prompts landing at whichever provider the router picked that hour, which is its own question for the data protection file.
Check 06
Look at what the invoice counts
Ask for an actual invoice rather than a rate card. Sovereign and self-hosted systems price on capacity: GPU hours, node hours, throughput, seats tied to provisioned hardware. Resold products price on tokens, requests or credits, because that is the shape their own costs arrive in.
Evidentiary weight. Moderate, and easily disguised by credit bundles and seat pricing. The sharper form of the question is what the bill does if usage triples, and whether the vendor will commit in writing to a fixed price at that volume. A vendor whose costs scale with your tokens cannot make that commitment, and the explanation of why will answer your original question.
Check 07
Block the outside world and see what still answers
Ask the vendor to run the product on a network where outbound traffic to the major foreign model providers is blocked at the firewall, or to deploy into your own cloud tenancy or your own rack where you control egress. Give notice. Let them prepare properly, because the point is not to ambush anyone.
Evidentiary weight. Everything the other six were reaching for. A model running on infrastructure you control keeps answering with the outside world cut off. A rebranded product returns an error or falls back to a canned response, and no architecture diagram changes that outcome. Most vendors will try to convert this into a written assurance instead, and the negotiation over that substitution is itself informative.
Where This Diagnostic Breaks
Publishing a test degrades it. Any vendor reading this page can now write a system prompt that defeats Check 1 and rehearse an answer to Check 3 that sounds fluent to a non-technical buyer. I think the trade is worth making, because the buyers who need this have no framework at all today, while the vendors who would game it were already ahead of those buyers.
What survives is the part that costs money to fake. Nobody fakes an egress-blocked demonstration. Nobody fakes a sub-processor schedule their own lawyers signed, because misrepresenting sub-processors in a data processing agreement is a contractual breach with consequences rather than a marketing exaggeration. If a buyer only has appetite for two checks, take 4 and 7.
The bigger limitation is that this whole framework treats sovereignty as a property of one vendor relationship, when the real exposure is the accumulation. An organisation with a genuinely local core system, an unlogged foreign transcription tool, a browser extension three people in finance installed, and a customer service bot from a fourth supplier has one good contract and an unmapped surface. Working with Caribbean institutions this year, the AI inventory has usually not existed before we sat down and built it, and the length of the finished list is normally the first surprise of the engagement.
What to Put in the RFP
Six questions, scored before anyone sees a demo, because a demo is designed to be persuasive and a written answer is designed to be checked.
- Model identification. Name the model or model family and the licence under which the weights are used.
- Inference location. Name the operator and the physical region where inference runs, and confirm it will appear in the contract.
- Sub-processors. Provide the complete current list, with the notice period for changes.
- Retention. State whether prompts, outputs or uploaded documents are retained by any third party, for how long, and whether they may be used for training or human review.
- Availability record. Provide the incident and outage history for the past twelve months, with causes.
- Verification. Confirm willingness to run an egress-blocked demonstration during evaluation.
A vendor who answers all six cleanly has just saved your risk function a quarter of work, and that responsiveness is worth scoring on its own. A vendor who treats the sixth as an insult has told you something before the evaluation starts.
What to Put in the Contract
An RFP answer is a statement made during a sales process. The contract is what remains when the account manager changes.
- Named inference location, with the operating entity and region written into the agreement rather than referenced in an appendix that the vendor can revise.
- Sub-processor control, meaning a complete list, advance notice of additions, and a right to terminate without penalty when a new one is added.
- Verification right, either a right to audit or a commitment to supply independent attestation of where processing occurs, in a form you can hand a regulator.
- Exit terms, covering export of your data, prompts, embeddings and any fine-tuned artefacts in a format usable elsewhere, within a defined window.
- Price protection, a cap on pass-through increases or a right to terminate when upstream pricing moves beyond an agreed band.
The Cost of a Wrong Label
Four exposures follow, and they arrive on different clocks. Residency you cannot evidence, which surfaces when your compliance officer is asked for a data flow diagram and the vendor cannot say where inference happens. Regulatory findings that follow the data, where the operative risk for a Caribbean institution is rarely the headline EU AI Act ceiling of €35 million or 7% of worldwide turnover and much more often a supervisory finding that governance over a material third party was undocumented. Continuity you do not hold, because a rebranded product inherits every decision made upstream, from a deprecated model version to a regional access restriction, and your vendor's service agreement will correctly describe the resulting outage as outside its control. And costs you cannot negotiate, because a vendor with no cushion upstream has nothing to argue with when the price moves.
None of that makes a foreign-model product a bad purchase. Renting a frontier model through a capable local integrator is frequently the right call for drafting, summarising and internal work, and the integrator earns their margin in workflow and support. The damage comes from a board approving that product while recording something else in its own governance file.
Put One Person in Charge of Asking
StarApple AI certifies AI Officers through a half-day programme for boards, executive teams and the AI leads they nominate. The vendor diagnostic in this article is one module of it. We also run AI readiness assessments and build custom and sovereign models for Caribbean governments and institutions, and clients are welcome to run all seven checks against us.
Certify Your AI OfficerFrequently Asked Questions
What counts as sovereign AI?
An AI system where the party you contract with controls the model and the hardware it runs on, and can name and evidence the jurisdiction where inference happens. The vendor owns the model or licenses weights on terms it controls, the inference runs on infrastructure the vendor or the buyer operates, and the location appears in the contract rather than in a sales conversation. All three have to hold together.
How do I know if a vendor is reselling a foreign model?
Ask for a demonstration on a network where outbound access to the major foreign model providers is blocked, run on your infrastructure or under your observation. A locally hosted model keeps answering. A rebranded product stops. Supporting checks include the sub-processor schedule, the licence under which the weights are used, the outage history against the providers' public status pages, and whether the vendor will hold a fixed price at three times your current volume.
Is it wrong to buy a product built on a foreign foundation model?
No. For marketing copy, internal drafting and summarising public documents, renting a frontier model through a capable local integrator is often the most sensible purchase available. The failure is the label rather than the architecture. A board approving a rebranded product in the belief that it is sovereign has accepted a residency, continuity and pricing profile it never assessed.
What should a Caribbean RFP ask for?
Name the model and the weight licence. Name the operator and region where inference runs. Supply the complete sub-processor list with a change-notification commitment. State retention of prompts, outputs and uploaded documents by any third party. Supply twelve months of incident history. Confirm willingness to run an egress-blocked demonstration. Score those answers before scoring the demo.
Which contract clauses matter most?
A named inference location. A sub-processor list with advance notice and a right to terminate without penalty. A verification right, by audit or independent attestation. Exit terms covering export of data, prompts, embeddings and fine-tuned artefacts. And a cap on pass-through price increases, or a right to leave when upstream pricing moves beyond an agreed band.
Does fine-tuning on Caribbean data make a foreign model sovereign?
No. Fine-tuning a hosted model sends the training data to the provider as well, and the resulting weights sit on their infrastructure, so residency, continuity and pricing exposure are unchanged. Fine-tuning open weights you can download and re-host is a different arrangement. The question that separates them is whether you can take the fine-tuned artefact with you when the contract ends.
Who inside an organisation should own this?
One named person with the standing to request a vendor's sub-processor schedule and the training to read the answer, sitting between procurement, risk and technology. In most Caribbean organisations that is a designated AI Officer rather than a committee, because committees produce minutes and this work produces a decision before a signature.
What does StarApple AI mean by a sovereign model build?
A model running on infrastructure the client or StarApple AI operates, in a location named in the contract, using weights the client can continue to run if the commercial relationship ends. StarApple AI has built custom and sovereign models for Caribbean governments and organisations since well before this year's infrastructure wave, and clients are welcome to run every check in this article against us.