Sovereign, Decentralized, or Private Perimeter AI? Govern the Decision Before You Pick the Plumbing

Who I am, and why these three words keep coming up

I've been writing software for more than 25 years, mostly in education technology, behavioral analytics and data science. I recently started my tenth company as technical founder. I'm also co-founder and chairman of Saigon A.I., a doctoral researcher at the University of St Andrews working between educational psychology and artificial intelligence with a focus on self-regulated learning (SRL), and the builder of QCoda, an AI governance platform focused on governing AI-assisted software engineering.

QCoda started with a pattern I kept running into, in my own teams and in teams I advised. We'd make a dozen consequential decisions while planning an AI feature. Which model. Which data. Where it runs. Who gets to see the prompts. Nobody wrote any of it down. Months later an auditor (or a customer's security team, or a regulator) would ask why we did it that way, and the honest answer was that nobody really decided. It just happened.

Governance showed up after the mistake, as punishment.

That's the lens I bring here. Almost every AI architecture conversation I have now includes one of three words: sovereign, decentralized or private perimeter. People use them interchangeably. They shouldn't. Each one answers a different question and protects a different party, and none of them answers the question that actually gets teams in trouble. I'll get to that.

---

Three terms, three different questions

	Sovereign AI	Decentralized AI	Private perimeter AI
Core question	Which jurisdiction controls the compute, data and models?	Can AI run without a single owner?	Does this workload stay inside my trust boundary?
Unit of control	A nation or bloc	A network of independent operators	An organization
Who pays	Governments and national champions	Token holders, node operators, users	The organization itself
Typical example	National AI compute programs	Distributed GPU networks, community-trained models	Self-hosted open-weight models, air-gapped deployments

Look at the first row. All three are mostly answers about where AI runs and who controls the plumbing.

There's also a fourth option that never makes the conference slides, because it's the default: rent it. Call a public API, run on a hyperscaler, let someone else worry about the GPUs. That's where most AI actually runs today, and it's where the money is. Amazon, Microsoft, Alphabet and Meta plan to spend roughly $725 billion on capital expenditure in 2026, most of it on AI data centers. All three alternatives in the table are really defined against that default. Keep it in mind, because it's where teams end up when they stop deciding.

---

Sovereign AI and the digital divide

The loudest voice for sovereign AI also happens to sell the shovels. At the World Governments Summit in Dubai in February 2024, NVIDIA's Jensen Huang told a room of national leaders that every country should own the production of its own intelligence, and that building the infrastructure is cheaper and easier than they think. You can roll your eyes at the source (I did) and still take the argument seriously, because the problem underneath it is real.

That problem is the AI divide. The United Nations High-Level Advisory Body on AI put closing it at the center of its 2024 Governing AI for Humanity report, recommending funding for developing countries to build local compute, datasets and talent. In 2026 the UN's new Independent International Scientific Panel on AI went further in its preliminary report, warning that capability and compute are concentrated in a small number of firms and countries, mostly the United States and China. The line of thinking I find most useful in that report: countries that lean entirely on foreign models and cloud may gain access to AI while losing real control over its safeguards and how well it fits local needs.

In theory, sovereign AI levels that field. In practice, the biggest programs so far are in places that can afford them: the UK, the European Union, the Gulf states, and large economies like India, which has backed 20 homegrown models and sanctioned millions of subsidized GPU hours through its IndiaAI Mission. Most of the Global South can't fund anything close. In September 2026, UN Secretary-General António Guterres warned that the AI divide will widen every other divide, sovereignty included. So the democratizing promise is real but unproven, and it depends on the countries building sovereign AI sharing what they build.

Where it's already paying off is education and research.

The United Kingdom's AI Opportunities Action Plan committed to expanding the public AI Research Resource at least twentyfold by 2030, and set up a Sovereign AI Unit with up to £500 million. Some of its first commitments supported university research, including sovereign compute for a Cambridge materials-discovery model. Delivery has been uneven, though: a year in, the new supercomputers were running while most of the Sovereign AI Unit's money was still in the pipeline. The European Union followed in June 2026 with the proposed Cloud and AI Development Act (CADA), which aims to triple EU data centre capacity within five to seven years and creates a single framework for deciding whether a cloud or AI service is protected from foreign control.

A university running serious models on publicly funded, in-jurisdiction compute doesn't have to trade research ambition against its obligations to students' data.

Sovereign AI protects citizens and institutions whose data would otherwise sit under someone else's legal regime, along with states worried about supply dependency. It benefits governments, national champions and publicly funded research, and education downstream of all of it.

What it costs is money, and a lot of it.

Whoever pays for the infrastructure calls the shots.

Sovereignty can protect domestic incumbents just as easily as it protects citizens. It settles jurisdiction, and it can buy you models that understand your language and culture (that was Huang's whole pitch). What it can't tell you is whether the decisions made on top of that sovereign compute were any good.

---

Decentralized AI (if the compute shows up)

Decentralized AI borrows most of its credibility from open source, and open source has earned it.

Mark Zuckerberg made the commercial case in his 2024 letter Open Source AI Is the Path Forward, arguing that open models protect developers from vendor lock-in and that startups, universities and small businesses lose out when the best models stay closed. DeepSeek made the case in practice with R1 in January 2025, releasing frontier-class reasoning weights under the MIT license along with a detailed write-up of how they trained it. Once weights are open, a lab in Ho Chi Minh City starts from the same weights as a lab in Palo Alto (the GPUs are another story).

The awkward part is that the open-weight models people actually run (Llama, DeepSeek, Qwen) were trained by centralized labs on centralized compute. Open weights mostly power self-hosting, which is perimeter AI, not decentralized AI. And openness lasts exactly as long as the payer wants it to. In July 2025 Zuckerberg himself said Meta would be careful about what it open-sources as it chases superintelligence.

So decentralized AI without decentralized compute doesn't really make sense. Open weights running on one hyperscaler's GPUs are a different tenant in the same landlord's building. Decentralization only gets real when the compute is spread across independent operators.

Sharing models is the easy part. You publish the weights, people download them, done. Decentralizing the inference of those models is a different problem, and mostly an economic one. Inference is where the demand is heading: McKinsey projects that by 2030 inference will overtake training as the dominant AI workload in data centers, at more than half of all AI compute. That's why the world is going nuts building data centers right now. Data centers are about the most expensive, power-hungry resource in tech, and expensive resources don't decentralize easily.

Technically, inference is the friendlier workload to spread out, since each request can run on its own. The harder barriers are trust and privacy. You need some way to prove a stranger's GPU returned an honest answer, and your prompts are running on hardware you don't control, which is exactly what perimeter AI exists to prevent. Networks like Nosana, which matches GPU owners with teams that need inference capacity, are where those questions get tested in practice.

Training is the hardest case, and the most honest data point I've found there is Prime Intellect's INTELLECT-1. They trained a 10-billion-parameter model across three continents, with 30 independent compute providers joining and leaving mid-run, and kept compute utilization between 83% and 96%. Impressive. Their technical report is also refreshingly candid about why it was hard: bandwidth between nodes can be up to a thousand times lower than inside a data center, and nodes drop out whenever they feel like it.

Which leaves the question I'd ask any decentralized AI builder. How do you broker power across a network you don't own without wrecking reliability? For elastic, retry-tolerant work like batch inference or experimental training, the answer is increasingly "well enough." For a latency-sensitive production feature with an uptime guarantee in the contract, not yet.

My take: decentralized AI matters the way Bitcoin matters. It'll push innovation and give people a credible exit from the big platforms. I just don't see it becoming the default, because the people paying for the infrastructure tend to set the rules, and most of that money sits with hyperscalers and governments.

There's a security side to this that the enthusiasm tends to skip. Like any open network, a decentralized one is a constant threat surface. Someone can poison training data or model updates, flood the network with junk requests, or run malicious nodes that quietly return bad results. To be fair, none of these attacks are unique to decentralized networks. Anthropic, the UK AI Security Institute and the Alan Turing Institute showed in 2025 that about 250 poisoned documents can backdoor a model regardless of its size, and that applies to the biggest centralized labs too. Centralized shops also tend to overestimate their own defenses (more on that in the next section). The real difference is that perimeter and sovereign deployments at least have someone whose actual job is to notice and fix it at 3 a.m.

So who owns that job in a decentralized network? The protocol, or whoever happens to be awake? Until there's a real answer, these are problems that have to be folded into the decentralized model before we get to cash in its rewards.

Decentralized AI protects builders and users from single-vendor capture and silent policy changes. It benefits open source communities, independent researchers and cost-sensitive startups. The catch is accountability, and the security question above is just the sharpest version of it. "No single entity is in charge" is a tough sentence to say out loud to a regulator (or to a customer whose data just got poisoned).

---

Private perimeter AI (what the cautious actually deploy)

Want to know how the most security-paranoid organizations on earth approach AI? Look at what they deploy.

In May 2024 Microsoft announced GPT-4 running in an air-gapped Azure Government Top Secret cloud for United States defense and intelligence users. Physically disconnected from the internet, and static, so it can read the files analysts hand it without learning from them. Microsoft spent about 18 months building it.

For Washington, sovereignty comes free: it's an American company serving the American government. Everyone else has a problem. If you're a European defense ministry, running classified work inside a US hyperscaler's perimeter is the sovereignty issue. That's why France's Ministry of the Armed Forces signed a framework agreement with Mistral in January 2026, with deployment committed to France's own infrastructure. Governments don't pick perimeter over sovereign. They demand both. What they don't do is hand classified workloads to an open, permissionless network, and for military and intelligence work I don't see that changing.

Enterprises learned the same lesson the hard way. In 2023 Samsung engineers pasted internal source code into ChatGPT, and Samsung responded by banning generative AI tools on company devices while it worked on internal alternatives. Data sent to someone else's model is hard to claw back, and that alone is enough to make most legal teams nervous.

I run my own small version of this. LLMesh (github.com/qcoda-ai/llmesh) is an open-source project I use to run models across my own machines, so sensitive work never leaves hardware I control. It's a good example of why the vocabulary matters. LLMesh is distributed across several machines, but it isn't decentralized. It has exactly one owner, and that's the point.

Perimeter AI protects trade secrets and regulated records (student, patient, financial), plus anything covered by contractual confidentiality. It benefits enterprises, regulated industries and governments, and the people whose data those organizations hold. The cost is that you own all of it, including the blame.

That's exactly where perimeter AI tends to fall apart. I watched it happen to a startup I know. They started with a strict perimeter: self-hosted models, nothing leaving the network. Then they hit the wall most small teams hit. Not enough GPUs to move at the speed the market wanted. So they quietly dropped the perimeter and moved to public APIs, which is to say, the default. Nobody sat down and decided to accept that risk. It happened under deadline pressure, one shortcut at a time.

One story isn't a dataset, but the numbers suggest it's a common migration, and an expensive one. IBM's 2025 Cost of a Data Breach report found that one in five organizations it studied had a breach tied to "shadow AI" (unsanctioned AI use), and organizations with a lot of shadow AI paid about $670,000 more per breach than those with little or none. Among organizations that reported AI-related breaches, 97% had no proper AI access controls.

It's a warning for decentralized AI too. If decentralized networks can't deliver enough capacity at competitive speed, teams will abandon them for the same reason that startup abandoned its perimeter.

---

Infrastructure doesn't govern decisions

Go back to that table. Sovereign, decentralized and perimeter AI all answer where models run and who controls the infrastructure. They're mostly delivery decisions.

Not only delivery, to be fair. Sovereign programs fund models trained on local languages, and a perimeter caps you at whatever fits on your hardware, so infrastructure does shape what your AI can do. But none of these choices governs the decisions made on top of it. None of them tells you whether the output is accurate. Or whether the model was right for the task, whether the data was appropriate, whether the person who approved the deployment understood what they were approving. You can run a badly governed system on perfectly sovereign compute, and a carefully governed one on rented cloud.

What I'd actually like to see decentralized is the learnings. Weights are already flowing, and so are training methods (the INTELLECT-1 team published their framework and their problems, DeepSeek published its recipe). What isn't flowing nearly as well is the stuff that hurts to share: failure reports, evaluation results that made someone look bad, and the decisions that blew up. The AI Incident Database, run by the Responsible AI Collaborative, is one of the few public efforts to collect AI failures and near misses, the way aviation and cybersecurity already do. When that kind of knowledge flows openly, a sovereign university cluster, a decentralized GPU network and a locked-down enterprise perimeter all get smarter together, no matter where their workloads run.

---

Governance as planning (instead of punishment)

Which brings me back to why we're building QCoda.

Most AI governance today works like inspection at the end of an assembly line. You build, you ship, and later someone finds what you got wrong. Then come the consequences: a failed audit, a fine, a breach or a customer who walks.

W. Edwards Deming told manufacturers to stop doing this about 40 years ago. The third of his 14 points in Out of the Crisis says to stop depending on inspection for quality and build quality into the product in the first place. Note the word depending. He never said to throw inspection out. Software security learned the same lesson and called it "shifting left." The NIST AI Risk Management Framework (AI RMF) applies it to AI: its Govern function is cross-cutting, meant to inform every stage of the AI lifecycle instead of sitting at the end.

The law is already written this way, even while the deadlines slip. Article 9 of the EU AI Act requires high-risk systems to have a risk management system run as a continuous process, planned and maintained across the entire lifecycle, not bolted on at release. The EU's Digital Omnibus on AI, which entered into force in July 2026, pushed many of those high-risk obligations (including those for AI used in education and employment) from August 2026 to December 2027. I hear a lot of teams read that delay as permission to wait. I read it as another 16 months of undocumented decisions piling up before the rules bite.

The UK went lighter-touch with the Data (Use and Access) Act 2025, loosening the rules on automated decision-making. But the safeguards it kept are telling: people have to be told about significant automated decisions, be able to contest them and get meaningful human review. You can't offer a meaningful review of a decision nobody recorded.

QCoda is built around what we call an alignment-driven methodology, which means governance at the point of creation. It helps teams surface compliance and risk considerations while they're still planning, make the call deliberately and record why. It doesn't replace monitoring (the EU AI Act still requires post-market monitoring for high-risk systems, and it should). The idea is to plan first, so inspection finds less. That startup didn't need a fine after the fact. It needed someone to ask, right when it mattered, "you're about to send customer data to a third party, is that on purpose, and what's the mitigation?"

That's the shift I care about. Governance stops meaning "you get punished when we find your mistakes" and starts meaning "we help you make better choices before they turn into mistakes." Choosing between sovereign, decentralized, perimeter and rented AI is exactly the kind of decision that deserves it. If you want to see how we approach it, there's more at qcoda.com.

---

So does any of this help industry and education?

Yes, if you match the model to the need instead of the hype.

Most companies will end up hybrid, and most of that mix will still be rented cloud. Add a perimeter for anything confidential or regulated, sovereign-hosted options where jurisdiction is a legal or contractual requirement, and decentralized compute for elastic, cost-sensitive work where the occasional retry is fine. The mistake is letting that mix happen by accident (which, as the startup story shows, is the default).

For education, sovereign compute programs (in the countries that can afford them) are a real chance to narrow the gap between well-funded and under-funded institutions, and open-weight models make it possible to run capable AI without shipping student data to a vendor. UNESCO's 2023 guidance on generative AI in education warned that most countries had no generative AI regulations at all, which left learners' data privacy unprotected, and that institutions weren't ready to validate the tools they were adopting. Better infrastructure can protect the data. Validating the tools takes better decisions.

---

Five questions before you pick

1. What exactly am I protecting? Code, personal data, model weights, or just my budget?
2. From whom? A foreign government, a vendor, a competitor, or my own team's shortcuts?
3. Under which laws? GDPR and the EU AI Act, UK GDPR and the Data (Use and Access) Act, sector rules, or all of the above?
4. Who's accountable when it fails, and can I name them today?
5. When will I find out I chose wrong? During planning, or after the breach?

Answer those five and the architecture usually picks itself. Skip them and it doesn't much matter how sovereign, decentralized or air-gapped your compute is.

---

References

1. Tom's Hardware, "Big Tech's AI spending plans reach $725 billion" (April 2026). https://www.tomshardware.com/tech-industry/big-tech/big-techs-ai-spending-plans-reach-725-billion
2. NVIDIA Blog, "NVIDIA CEO: Every Country Needs Sovereign AI" (February 2024). https://blogs.nvidia.com/blog/world-governments-summit/
3. United Nations High-Level Advisory Body on AI, Governing AI for Humanity: Final Report (September 2024). https://www.un.org/en/ai-advisory-body
4. Irish Examiner, "Rapid spread of AI may worsen global inequality, UN warns" (2026), on the preliminary report of the UN Independent International Scientific Panel on AI. https://www.irishexaminer.com/world/arid-41872071.html
5. CXO Digital Pulse, "IndiaAI Mission Backs 13 Responsible AI Projects, 20 Sovereign AI Models, Sanctions 93 Lakh GPU Hours" (July 2026). https://www.cxodigitalpulse.com/indiaai-mission-backs-13-responsible-ai-projects-20-sovereign-ai-models-sanctions-93-lakh-gpu-hours/
6. The Star, "UN chief warns AI divide could widen global inequalities" (September 2026). https://www.thestar.com.my/aseanplus/aseanplus-news/2026/09/13/039this-is-not-healthy-at-all039-un-chief-warns-ai-divide-could-widen-global-inequalities
7. UK Government, AI Opportunities Action Plan (January 2025). https://www.gov.uk/government/publications/ai-opportunities-action-plan
8. UK Government, Sovereign AI Unit collection. https://www.gov.uk/government/collections/sovereign-ai-unit
9. UK Government, UK Compute Roadmap. https://www.gov.uk/government/publications/uk-compute-roadmap/uk-compute-roadmap
10. CASRAI, "AI Opportunities Action Plan: Research, Year One." https://casrai.org/news/ai-opportunities-action-plan
11. Wilson Sonsini Data Advisor, "European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI" (June 2026), on the Cloud and AI Development Act. https://www.wsgrdataadvisor.com/2026/06/european-commission-publishes-proposal-for-act-to-reduce-reliance-on-foreign-cloud-and-ai/
12. European Parliament Legislative Observatory, Cloud and AI Development Act, procedure 2026/0138(COD). https://oeil.europarl.europa.eu/oeil/en/document-summary?id=1903654
13. Meta, Mark Zuckerberg, "Open Source AI Is the Path Forward" (July 2024). https://about.fb.com/news/2024/07/open-source-ai-is-the-path-forward/
14. DeepSeek-AI, DeepSeek-R1 model release and paper (January 2025). https://github.com/deepseek-ai/DeepSeek-R1
15. TechCrunch, "Zuckerberg says Meta likely won't open source all of its superintelligence AI models" (July 2025). https://techcrunch.com/2025/07/30/zuckerberg-says-meta-likely-wont-open-source-all-of-its-superintelligence-ai-models
16. McKinsey & Company, "The future of AI workloads" (February 2026). https://www.mckinsey.com/featured-insights/week-in-charts/the-future-of-ai-workloads
17. The Block, "Nosana launches GPU marketplace to drive AI innovation" (January 2025). https://www.theblock.co/post/334565/nosana-launches-gpu-marketplace-to-drive-ai-innovation
18. Jaghouar et al., INTELLECT-1 Technical Report, Prime Intellect (December 2024). https://arxiv.org/abs/2412.01152
19. Anthropic, UK AI Security Institute and The Alan Turing Institute, "A small number of samples can poison LLMs of any size" (October 2025). https://www.anthropic.com/research/small-samples-poison
20. Nextgov/FCW, "Microsoft deploys air-gapped AI for classified defense, intelligence customers" (May 2024). https://www.nextgov.com/artificial-intelligence/2024/05/microsoft-deploys-air-gapped-ai-classified-cloud/396354/
21. TechRepublic, "Mistral AI Wins French Military Deal" (January 2026). https://www.techrepublic.com/article/news-mistral-french-military-ai-deal/
22. Bloomberg, "Samsung Bans Staff's AI Use After Spotting ChatGPT Data Leak" (May 2023). https://www.bloomberg.com/news/articles/2023-05-02/samsung-bans-chatgpt-and-other-generative-ai-use-by-staff-after-leak
23. LLMesh (open source). https://github.com/qcoda-ai/llmesh
24. TechRepublic, "IBM Report: Shadow AI and Poor Governance Linked to Costlier Breaches in 2025." https://www.techrepublic.com/article/news-ai-breach-risks-rise-as-governance-lags/
25. Responsible AI Collaborative, AI Incident Database. https://incidentdatabase.ai
26. W. Edwards Deming, Out of the Crisis (MIT Press, 1986), 14 Points for Management, summarized by the Institute for Manufacturing, University of Cambridge. https://www.ifm.eng.cam.ac.uk/research/dstools/demings-14-points/
27. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (January 2023). https://doi.org/10.6028/NIST.AI.100-1
28. EU Artificial Intelligence Act, Article 9 (Risk Management System) and Article 72 (Post-Market Monitoring). https://artificialintelligenceact.eu/article/9/
29. Hunton Andrews Kurth, "EU Digital Omnibus on AI Enters into Force" (July 2026). https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force
30. UK Government, "Data (Use and Access) Act 2025: data protection and privacy changes." https://www.gov.uk/guidance/data-use-and-access-act-2025-data-protection-and-privacy-changes
31. QCoda, AI governance platform for AI-assisted software engineering. https://qcoda.com
32. UNESCO, Guidance for Generative AI in Education and Research (September 2023). https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research