← Back to Blog

The Sovereign AI Test: How to Check What a Vendor Is Actually Selling You

AD
Adrian Dunkley Founder and CEO, StarApple AI
Illuminated server racks and cabling inside a data centre, representing the question of where AI inference physically happens
Sovereignty is decided by which building the inference happens in, not by whose logo is on the login page. Photo: Unsplash

TL;DR

  • Sovereign AI has become a sales phrase across the Caribbean and Latin America, attached to products where every answer is generated by a foreign foundation model.
  • Three procurement categories carry three different risk profiles: sovereign AI, a self-hosted open-weight model, and a foreign model behind a local interface.
  • Seven checks separate them. Three can be defeated by a vendor who wants to defeat them, and the article says which three.
  • The decisive check is an egress-blocked demonstration. Run the product with outbound access to foreign model providers blocked. A local model keeps answering.
  • Six RFP questions and five contract clauses settle the matter in writing, which is where a regulator will eventually ask you to have settled it.
  • The purchase itself is often fine. Believing you bought a different thing is the part that costs money.

Every AI vendor selling into a Caribbean bank, ministry, insurer or utility in 2026 has learned which words open the door. Sovereign. Local. Regionally hosted. Trained on Caribbean data. I have spent this year on both sides of that meeting, as the person who builds these systems and as the person a board calls in the week before signature, and the same thing keeps happening. What is described as sovereign AI turns out to be an application layer, frequently well built by a capable local team, that sends every query to OpenAI, Anthropic, Google or a hosted open-weight service in North America or Europe.

Plenty of those products are worth buying. The difficulty is that directors approve them against assumptions the word creates: that the data stays in the region, that the vendor controls the system, that the regulatory exposure is contained. Those assumptions usually get tested for the first time during an audit, which is the most expensive place in the world to discover you were wrong.

Three Things a Buyer Might Be Purchasing

Sovereignty over a capability means you can decide, on your own terms, whether it keeps running and who sees what passes through it. Translated into a procurement decision, that resolves into three conditions that have to hold together. The party you contract with owns the model or licenses weights on terms it controls. Inference runs on hardware the vendor or the buyer operates. And the location of that hardware appears in the contract, because a regulator asking where customer data is processed is asking for a document rather than a reassurance.

7 checks Diagnostics a buyer can run before signature, listed below
3 gameable Of those checks a competent vendor can prepare for and defeat
1 decisive The egress-blocked demonstration, which cannot be talked around
5 clauses Contract terms that keep the answer true after the sales cycle ends
Attribute Sovereign AI Self-hosted open weights Foreign model, local interface
Where inference runs Vendor or buyer infrastructure, named location Your servers or your own cloud tenancy The foundation-model provider's data centres
Who can switch it off The vendor, under your contract You The provider, and the government that regulates it
Residency evidence Contractual and auditable Verifiable by inspection Governed by the provider's terms, not your vendor's
Pricing basis Compute, capacity or licence Hardware and operations Per token or per credit, with a margin added
What breaks it Vendor failure Your own operations Provider outage, policy change, export restriction, price move

The middle column deserves more attention than it gets in this region, mainly because nobody has a sales team selling it. Open-weight families such as Llama, Mistral, Qwen, DeepSeek and Gemma are downloadable, run on modest hardware once quantised, and settle the residency question by inspection, because the model sits on a machine somebody can walk up to.

Seven Checks, Ordered by What They Prove

Check 01

Ask the model what it is

Put the question to the product directly: which foundation model are you built on, what is your architecture, who trained you. Ask again in different words, and once more deep inside a long conversation, because guardrails are usually written for the obvious phrasing.

Evidentiary weight. A leak is strong. A model that names GPT, Claude or Gemini has answered the question. A denial proves almost nothing, because a system prompt can instruct a model to deny it and because models misidentify themselves routinely. I have watched a self-hosted open-weight model insist it was built by OpenAI, which was false and would have condemned an honest vendor. Use this to catch carelessness, never as a clearance.

Check 02

Watch the network during a query

Have IT record the calls a client makes while the product answers a prompt, or use a free proxy tool such as HTTP Toolkit. Look for api.openai.com, api.anthropic.com, generativelanguage.googleapis.com and the common hosted-inference endpoints.

Evidentiary weight. A hit settles it. A clean trace settles nothing, because any competent product calls the provider from its own backend, so the client only ever speaks to the vendor's domain. What the trace still gives you is where the vendor's endpoint resolves and how long the round trip takes. Time to first token consistent with a North American round trip, measured from Kingston or Bridgetown, belongs in a written question to the vendor.

Check 03

Which weights are loaded, and under what licence

A team running its own model answers this in a sentence. They name a base model and a licence, or they describe their own architecture and training approach at a level that survives a follow-up. A team reselling API access answers with capability language about accuracy, speed and accuracy again.

Evidentiary weight. High, and difficult to fake in front of anyone technical. Bring an engineer to this meeting. Organisations without one in the room are the reason the AI Officer role exists.

Check 04

Read the sub-processor schedule

Every serious vendor publishes, or will supply on request, the list of third parties processing customer data on its behalf, normally as a schedule to the data processing agreement. Read it for names, then read the surrounding clause for how changes get notified.

Evidentiary weight. The most useful of the paperwork checks, because it is contractual rather than technical. A foundation-model provider listed as a sub-processor for inference closes the question. So does the absence of any list, or a clause reserving the right to change sub-processors at the vendor's discretion without notice, which tells you the answer while keeping the right to change it later.

Check 05

Lay the outage history against the status pages

OpenAI, Anthropic and Google Cloud publish incident histories at status.openai.com, status.anthropic.com and status.cloud.google.com. Take the dates of the vendor's last several outages and compare.

Evidentiary weight. Matching dates are good evidence of dependency. Non-matching dates prove less than they look, because a well-built wrapper fails over between two or three foreign providers and survives any single one going down. That design is genuinely more resilient than a single dependency, and it still leaves your prompts landing at whichever provider the router picked that hour, which is its own question for the data protection file.

Check 06

Look at what the invoice counts

Ask for an actual invoice rather than a rate card. Sovereign and self-hosted systems price on capacity: GPU hours, node hours, throughput, seats tied to provisioned hardware. Resold products price on tokens, requests or credits, because that is the shape their own costs arrive in.

Evidentiary weight. Moderate, and easily disguised by credit bundles and seat pricing. The sharper form of the question is what the bill does if usage triples, and whether the vendor will commit in writing to a fixed price at that volume. A vendor whose costs scale with your tokens cannot make that commitment, and the explanation of why will answer your original question.

Check 07

Block the outside world and see what still answers

Ask the vendor to run the product on a network where outbound traffic to the major foreign model providers is blocked at the firewall, or to deploy into your own cloud tenancy or your own rack where you control egress. Give notice. Let them prepare properly, because the point is not to ambush anyone.

Evidentiary weight. Everything the other six were reaching for. A model running on infrastructure you control keeps answering with the outside world cut off. A rebranded product returns an error or falls back to a canned response, and no architecture diagram changes that outcome. Most vendors will try to convert this into a written assurance instead, and the negotiation over that substitution is itself informative.

Where This Diagnostic Breaks

Publishing a test degrades it. Any vendor reading this page can now write a system prompt that defeats Check 1 and rehearse an answer to Check 3 that sounds fluent to a non-technical buyer. I think the trade is worth making, because the buyers who need this have no framework at all today, while the vendors who would game it were already ahead of those buyers.

What survives is the part that costs money to fake. Nobody fakes an egress-blocked demonstration. Nobody fakes a sub-processor schedule their own lawyers signed, because misrepresenting sub-processors in a data processing agreement is a contractual breach with consequences rather than a marketing exaggeration. If a buyer only has appetite for two checks, take 4 and 7.

The bigger limitation is that this whole framework treats sovereignty as a property of one vendor relationship, when the real exposure is the accumulation. An organisation with a genuinely local core system, an unlogged foreign transcription tool, a browser extension three people in finance installed, and a customer service bot from a fourth supplier has one good contract and an unmapped surface. Working with Caribbean institutions this year, the AI inventory has usually not existed before we sat down and built it, and the length of the finished list is normally the first surprise of the engagement.

What to Put in the RFP

Six questions, scored before anyone sees a demo, because a demo is designed to be persuasive and a written answer is designed to be checked.

A vendor who answers all six cleanly has just saved your risk function a quarter of work, and that responsiveness is worth scoring on its own. A vendor who treats the sixth as an insult has told you something before the evaluation starts.

What to Put in the Contract

An RFP answer is a statement made during a sales process. The contract is what remains when the account manager changes.

The Cost of a Wrong Label

Four exposures follow, and they arrive on different clocks. Residency you cannot evidence, which surfaces when your compliance officer is asked for a data flow diagram and the vendor cannot say where inference happens. Regulatory findings that follow the data, where the operative risk for a Caribbean institution is rarely the headline EU AI Act ceiling of €35 million or 7% of worldwide turnover and much more often a supervisory finding that governance over a material third party was undocumented. Continuity you do not hold, because a rebranded product inherits every decision made upstream, from a deprecated model version to a regional access restriction, and your vendor's service agreement will correctly describe the resulting outage as outside its control. And costs you cannot negotiate, because a vendor with no cushion upstream has nothing to argue with when the price moves.

None of that makes a foreign-model product a bad purchase. Renting a frontier model through a capable local integrator is frequently the right call for drafting, summarising and internal work, and the integrator earns their margin in workflow and support. The damage comes from a board approving that product while recording something else in its own governance file.

Put One Person in Charge of Asking

StarApple AI certifies AI Officers through a half-day programme for boards, executive teams and the AI leads they nominate. The vendor diagnostic in this article is one module of it. We also run AI readiness assessments and build custom and sovereign models for Caribbean governments and institutions, and clients are welcome to run all seven checks against us.

Certify Your AI Officer

Frequently Asked Questions

What counts as sovereign AI?

An AI system where the party you contract with controls the model and the hardware it runs on, and can name and evidence the jurisdiction where inference happens. The vendor owns the model or licenses weights on terms it controls, the inference runs on infrastructure the vendor or the buyer operates, and the location appears in the contract rather than in a sales conversation. All three have to hold together.

How do I know if a vendor is reselling a foreign model?

Ask for a demonstration on a network where outbound access to the major foreign model providers is blocked, run on your infrastructure or under your observation. A locally hosted model keeps answering. A rebranded product stops. Supporting checks include the sub-processor schedule, the licence under which the weights are used, the outage history against the providers' public status pages, and whether the vendor will hold a fixed price at three times your current volume.

Is it wrong to buy a product built on a foreign foundation model?

No. For marketing copy, internal drafting and summarising public documents, renting a frontier model through a capable local integrator is often the most sensible purchase available. The failure is the label rather than the architecture. A board approving a rebranded product in the belief that it is sovereign has accepted a residency, continuity and pricing profile it never assessed.

What should a Caribbean RFP ask for?

Name the model and the weight licence. Name the operator and region where inference runs. Supply the complete sub-processor list with a change-notification commitment. State retention of prompts, outputs and uploaded documents by any third party. Supply twelve months of incident history. Confirm willingness to run an egress-blocked demonstration. Score those answers before scoring the demo.

Which contract clauses matter most?

A named inference location. A sub-processor list with advance notice and a right to terminate without penalty. A verification right, by audit or independent attestation. Exit terms covering export of data, prompts, embeddings and fine-tuned artefacts. And a cap on pass-through price increases, or a right to leave when upstream pricing moves beyond an agreed band.

Does fine-tuning on Caribbean data make a foreign model sovereign?

No. Fine-tuning a hosted model sends the training data to the provider as well, and the resulting weights sit on their infrastructure, so residency, continuity and pricing exposure are unchanged. Fine-tuning open weights you can download and re-host is a different arrangement. The question that separates them is whether you can take the fine-tuned artefact with you when the contract ends.

Who inside an organisation should own this?

One named person with the standing to request a vendor's sub-processor schedule and the training to read the answer, sitting between procurement, risk and technology. In most Caribbean organisations that is a designated AI Officer rather than a committee, because committees produce minutes and this work produces a decision before a signature.

What does StarApple AI mean by a sovereign model build?

A model running on infrastructure the client or StarApple AI operates, in a location named in the contract, using weights the client can continue to run if the commercial relationship ends. StarApple AI has built custom and sovereign models for Caribbean governments and organisations since well before this year's infrastructure wave, and clients are welcome to run every check in this article against us.

About the Author

Adrian Dunkley is the founder and CEO of StarApple AI, the first AI company in the Caribbean, founded in 2016. He is President of the Caribbean AI Association, Chairman of the Caribbean AI Risk Management Council, and has run free weekly AI training for the region for more than nine years. His work spans AI consulting, custom and sovereign AI model development, and enterprise training across Jamaica, Trinidad and Tobago, Barbados, Guyana and the wider Caribbean. Full background at adriandunkley.net.