Sovereign AI Infrastructure¶

Public administrations face rising demand with limited staff, and much of their officials’ time goes to routine work: explaining requirements, checking documents, preparing case files, and routing requests. AI can take on much of that work, but a state that adopts it has to keep control of three things: the data citizens entrust to it, the models that process that data, and the decisions that affect people’s rights.

Our view is that AI in government should work as an AI workforce that answers to officials: AI agents prepare the work inside workflows the government defines, and accountable officials decide. Sovereign AI Infrastructure is our reference design for that workforce, built on five principles:

• Government Control: The government approves the models, hosting, access rights, knowledge sources, and updates.

• Sovereign Hosting: Sensitive and core workflows run on government-approved open-weight models hosted on national infrastructure.

• Source Grounding: Every released answer cites an approved, versioned official source.

• Human Authority: A draft becomes an action only through an approved workflow in which an authorized person confirms, changes, or rejects it.

• Accountability: Every case carries a reviewable decision record of the sources, model and rule versions, consent, reviewer, and final action.

Sign AI: Supervised Intelligence for Governing Nations¶

Sign AI is the workflow and control layer between AI models and the people and systems they serve (Figure 12). The model interprets requests and drafts answers or cases. Sign AI decides what the model may see and do, manages approval steps, and records case history. Authorized officials approve sources, resolve exceptions, and make every decision.

Sign AI works behind the channels a government already runs, such as service portals, call centers, and staff workbenches. National Digital Identity establishes who is asking. Each data flow runs under a lawful basis that the government records, and consent is kept for optional steps such as pre-filling a form. Access checks then limit each user, and each model call, to the data that the role and the approved task require, and official guidance stays separate from personal case records. Every case has a status, an assigned owner, and an escalation path: missing or conflicting information goes to a person, and handoffs between citizens and staff keep the case context. Sign AI reads government data only through the DataHub, which can use the country’s existing government data exchange, where there is one, as its connector, and is limited to the fields and actions each task is authorized for.

Model Hosting and Data Sovereignty¶

Deployment matches the sensitivity of the work. Sensitive and core workflows use open-weight models hosted in a national data center, government cloud, or ministry infrastructure, so prompts and outputs stay in the country. Open-weight models, such as the Llama, gpt-oss, Qwen, and Mistral families, have published weights, so they can run on infrastructure the government approves. Where government policy allows, other work can use an external service running the most capable commercial models, known as frontier models, under terms that prohibit training on customer content. Retrieval, document preparation, and permission checks still run inside the government environment. Before a prompt leaves, a government-approved gateway in that environment removes biometric data and replaces names, identity numbers, and other fields the government designates as sensitive with placeholders (Figure 12). When the answer returns, the gateway puts the real values back, so the external provider does not receive the names and identifiers in a case. Masking cannot strip every identifying detail from free text, so the most sensitive workflows stay on in-country models. Each workflow runs on a model version the government has approved, and a model can be replaced without rebuilding the workflows. Model selection includes evaluation in the national language before any pilot, and every external service is listed in the processing register (Privacy and Data Control).

The two options can be staged. A program can start with the external service for citizen-facing information that involves no personal data, such as a national assistant that answers questions from official sources across agencies, because it is the most capable option and needs no investment in GPUs, the specialized chips that run AI models. The gateway sends no personal data by default. A government can choose to let services that handle personal data but are not designated sensitive use it through the gateway at first, after a transfer assessment and the data protection authority’s sign-off. As national compute comes online, they move to in-country open-weight models, together with services that call government systems. Self-hosting costs GPUs and national skills in running and updating models in production (MLOps), and open-weight models trail the frontier by some months. In return, the weights and data stay inside the national perimeter, can run air-gapped, cut off from outside networks, for defense and interior ministries, and keep working whatever the original developer later decides, because no external provider can rate-limit, change, or switch them off.

In-Country AI Infrastructure¶

Our reference design runs the whole AI service inside a national boundary. Citizen and officer channels, Sign AI workflows, local models, agency systems, identity and keys, and case records and security logs all stay in the country, and external AI is an optional connection through the approved gateway. Control is written into both the system and the operating agreement: the government decides where records, prompts, outputs, and backups are kept, approves the models and their updates, holds the encryption keys and authorizes privileged access, and names the operator and approves changes.

A country can host the service in three ways: dedicated AI equipment in an approved government data center, dedicated equipment at a contracted domestic hosting provider under national key custody, or a new modular or purpose-built national facility, which is designed to be delivered with qualified facility partners as one program covering the building, the equipment, and the AI service. The same Sign AI platform runs on each. Capacity grows with use, from a pilot that proves one or two services, to a production installation that runs the first shared government services, to further blocks of computing capacity, each tested before use, as agencies join (Table 10). Recovery also stays in the country: a second domestic site holds prepared models, applications, protected data, and local keys, and an independent immutable backup is kept apart from both sites.

A national operator runs the service day to day under government authority. We lead delivery, integrate AI and security, train the operators, and support the platform, while specialist partners handle facility works and equipment support. Security is enforced at every layer, from facility access and separated network zones to national keys, recorded operator sessions, and scoped permissions for AI agents. Independent assurance is agreed with the government. Our targets are ISO/IEC 27001 certification for information security, ISO/IEC 27701 for privacy management, ISO 22301 for business continuity, a SOC 2 Type II examination, and independent security testing. ISO/IEC 42001 is the framework for managing AI risk, and we specify hardware security modules certified to FIPS 140-3 Level 3 or Common Criteria. Essential work can run with external connections disabled, either behind a gateway that permits only approved external requests or in a fully isolated environment that receives updates through an approved transfer process. The government accepts the service only on evidence that the data boundary, authorization, performance, power and cooling, recovery, and operator procedures behave as agreed.

Approved Sources and Policy Insight¶

Officials control the knowledge the AI uses. Approved sources such as regulations, service requirements, and forms are versioned, each change is evaluated before release, and a previous edition can be restored. In production, an answer without a current official source is blocked and the question goes to a person. Sign AI is also designed to watch official sources for changes to laws and forms, rerun its checks when one changes, and release the update once officials approve it, so that one current rule can apply across every office, channel, and language. Operators see demand by topic and region, unresolved cases, and knowledge gaps, and improve the sources where citizens struggle.

The same controls let AI turn government data into insight. Agencies that standardize their data and share it under the law give policy makers a view that no single agency has. Sign AI reaches this data through the DataHub, under the same permission and purpose checks as staff. With access approved by the government and limited to de-identified, aggregated data, Sign AI can show where benefits fail to reach eligible people, which services cause the longest delays and why, how demand shifts by region and season, and where patterns that suggest fraud appear. Insight stays de-identified; finding individuals for investigation is a separate purpose that needs its own legal basis and the data protection authority’s review. It is also designed to estimate how a proposed rule change would affect the people and budgets it touches before the change is made. Each insight cites the datasets and methods behind it, and officials decide what to do with it.

From Request to Decision¶

Each case follows a supervised workflow (Figure 13). Sign AI proposes a service pathway for the request, consults the approved requirements, identifies missing information, and assembles a draft case, which a qualified official reviews. The sources, the review, and the final action are recorded.

Decision records serve oversight, incident review, and service improvement. They can be anchored through the DataHub as Sign Protocol attestations (Shared Data and Evidence Layer), so an auditor can verify that an AI-assisted case followed its approved workflow without seeing the personal data in it.

Risk Classes and the Right to Contest¶

Each use of AI is classified by risk before its pilot, following the risk-based approach of the EU AI Act and the OECD AI Principles. Answering questions from published sources is low risk; benefit eligibility and fraud flags are high risk and get the strictest controls. High-risk uses are tested for bias across regions, languages, and population groups before a pilot and monitored after release. No benefit is suspended, reduced, recovered, or denied on an AI flag alone: a flag only starts a review by an official. Every resident can ask why their case was handled as it was, receive an explanation that cites the sources and rules applied, have the case reviewed by a person, and appeal through the ordinary administrative procedure.

Citizen Services and the Staff Workspace¶

Take a tax deduction. A parent asks whether a child’s university tuition can be deducted, and Sign AI checks the question against the current tax rule. The parent signs in through the national identity service, so Sign AI never handles the parent’s credentials. With the parent’s agreement to pre-fill the claim, it requests the identity, birth, income, and tax records the claim needs through the DataHub, calculates the deduction, and attaches only the documents the application needs. The result is a complete claim with cited sources, which the parent submits and an officer approves, amends, or rejects, with the officer’s name on the record. Officers receive files that are already complete and pre-checked, and the agency sees demand, escalation rates, and the effect on its own operations. Other services follow the same pattern.

Civil servants use Sign AI in a separate staff workspace. The assistant drafts letters, decisions, notices, and reports on the agency’s own templates, sorts case queues and flags likely duplicates and incomplete files before review. Legal research questions are answered from current law, precedent, and internal regulations with every source cited, and documents, forms, and correspondence are translated between the national languages and English. In procurement, tender documents are checked against the rules and exceptions go to a person to decide. Answers can also come from the agency’s own archive, so knowledge stays when staff leave. Everything the assistant does goes into the same audit log as citizen cases.

The same components apply across government: eligibility checks, referrals, and claims review in healthcare; subsidy applications, land records, and advisory support in agriculture; enrollment and record verification in education; tariff classification and pre-declaration checks at customs; eligibility, appeals, and case follow-up in social protection; outage triage and connection requests in energy and utilities; permits, licenses, and complaint routing in municipal services; and logistics and document sorting in defense, on air-gapped models. Every deployment reuses the same control layer, audit layer, and support for each national language.

Safety Gates and the First Pilot¶

A workflow scales only after it passes three safety gates: every released answer cites its approved sources, every decision is taken by an authorized official, and no sensitive data leaves the approved environment without authorization.

A program starts with a short joint diagnostic that sets baseline measures and targets, then a prototype built on public sources and synthetic cases, followed by a supervised pilot at a few sites that ends in a decision to scale or stop. The pilot is judged against a baseline on operational measures: cost and staff time per completed case, completeness and routing accuracy, rework, completion time and access across sites, reliability and incident handling, and the experience of citizens and staff.

Healthcare referral suits this pattern because its administrative burden is high and the line between administration and clinical judgment is clear. A patient in a rural district asks, in their own language, what a specialist referral requires. The AI explains the approved requirements, notices that a laboratory result is missing, and prepares the referral file. A health worker reviews the draft against the records and cited requirements, then confirms, changes, or rejects it. Diagnosis, prescribing, medication dosing, denial of care, and other clinical decisions are outside the AI’s scope and remain with qualified professionals.

Direction: An AI Workforce Across Government¶

Our direction is for AI workflows to run across agencies. Where agencies share the same identity and evidence layers, a case prepared in one agency could carry verified identity, consent, and attested records to the next, and a citizen would not have to prove the same facts again. The design is also built to extend from preparation to execution: once an authorized official decides, an AI-prepared case such as a benefit award would be paid through the public services platform in Sign CBDC or a stablecoin, with the payment linked to its decision record. Regulators would apply the same controls to supervision (Real-Time Supervision). Over time, new administrative domains would enter the same way, through a supervised pilot and the same safety gates.