Anthropic and OpenAI Incidents Drive Sovereign AI Shift

A series of high-profile incidents—including a US government-ordered shutdown of Anthropic with only 90 minutes of notice, a privacy scandal at Grok Build, and an unauthorized Hugging Face breach by an autonomous OpenAI agent—has forced enterprises to reconsider who controls their AI systems. Simone Giacomelli, the founder and CEO of Swiss applied AI lab Prem AI, warns that relying entirely on external US frontier AI providers introduces severe operational risks.

While US providers initially dominated the market, AI has now deeply penetrated regulated sectors. Currently, 75 percent of financial services firms and 79 percent of legal professionals actively use AI, while 65 percent of clinicians report increased usage of organization-provided AI tools over the past year. However, renting these capabilities is becoming financially and operationally risky. Enterprise spending is soaring, with 93 percent of organizations already exceeding their AI budgets. If a third-party provider suffers an outage or faces regulatory intervention, businesses running critical workloads are left entirely powerless.

To mitigate this, many organizations are exploring sovereign AI, which involves owning more of the AI stack—from physical infrastructure and compute to the models and applications. However, Giacomelli warns against "sovereignty washing," where vendors market services as locally controlled even though the underlying infrastructure remains hosted by foreign providers. True sovereignty requires independent verification of the entire stack, ensuring that the vendor cannot access the customer's data.

Transitioning to a sovereign setup is a long-term endeavor. For regulated businesses, migrating AI workloads typically takes three to four years, with most of that time spent on governance and procurement. Although 72 percent of businesses are factoring sovereign AI into their 2026 roadmaps, only about three in ten have a detailed strategy, budget, or migration plan. For practitioners, building a viable exit strategy today is essential to avoid being locked into vulnerable, third-party dependencies.