Lyzr Research · October 2026 · A 45 minute read
The Sovereign AI
Playbook.
Data residency is not sovereignty. How regulated organizations run models, agents and an AI workspace for every employee inside their own walls.
To the CIO, the CISO and the chief data officer
Your data is in the right country. Is your AI in your hands?
Residency is where the data sits.
Sovereignty is who controls it, legally, technically and operationally. Most programs stop at the first.
Four layers decide who is in control.
Data, models, agents and infrastructure. Own all four and a provider, a price or a policy can change without stopping you.
One question tests all four.
If your model provider were cut off tomorrow, would your key workflows keep running? In June 2026 a government order switched off two frontier models for every customer overnight.
This is the test
This is a playbook for the people who run the stack and the people who use it every day. Part 8 describes Lyzr’s products and is labeled as Lyzr’s. The rest applies whatever you build on.
Lyzr Research, October 2026
The short version.
- The gapMost sovereign AI stops at keeping data in-region. Residency is where data sits. Sovereignty is who controls it.
- The metaphorA microgrid is connected to the grid by choice and can run on its own when it must. Your AI should be able to island.
- The four layersData, models, agents and infrastructure. Own all four, or a provider, a price or a policy can stop the work.
- The testDoes it keep working if your model provider is cut off tomorrow? In June 2026 two frontier models went dark overnight.
- The workspaceEvery employee needs a governed AI workspace inside the walls, or they will use ungoverned tools outside them.
- The stackOne platform team can run models, agents and search on a sealed machine, updated by signed bundles.
- Where Lyzr fitsLyzr’s products cover all four layers and the workspace, in your cloud, on-prem or air-gapped. Part 8 says what is live.
What this covers
Eight parts, start to finish.
Why now
The gap
Residency is not sovereignty, and a provider can be switched off.
Four layers
The microgrid
Data, models, agents and infrastructure, and the test that checks them.
Deployment
Four ways to island
In-region, your cloud, on-premises and air-gapped, and who needs which.
Every employee
The workspace
A governed AI workspace inside the walls.
Platform team
The stack
What the team runs, and how it updates with no network.
Who owns what
By seat
The CIO, the CISO, the CDO, the platform team and the staff.
Predictions
What next
What we expect, and the strongest argument against.
The Lyzr stack
Where Lyzr fits
Every Lyzr product against the four layers, what is live, and where to look elsewhere.
Gartner, as cited in secondary coverage
Gartner expects three in four organizations in Europe and the Middle East to relocate workloads over geopolitical risk by 2030.
Of enterprises and governments in Europe and the Middle East predicted to relocate data and workloads to reduce geopolitical risk by 2030
Residency was the first answer. Control is the next question. The relocation Gartner describes aims at jurisdictional certainty and operational autonomy, and location alone does not give either.
Control is the next question
Gartner prediction, as cited in secondary coverage, 2026.
The argument in one picture
A microgrid is connected to the grid when you choose, and runs on its own when you must.
That is the standard for sovereign AI. Day to day you can use outside models and services. The day a provider, a price or a policy changes, your models, agents and data keep working inside your walls. This playbook gives you four layers and one question to check it.
The gap.
Residency is where the data sits. Sovereignty is who controls it.
This part separates two ideas that get used as one, shows why a region is not a jurisdiction, and sets out a real case of models being switched off for every customer.
Two ideas, often confused
The data never left the region. The control did not stay.
Choosing a region fixes where bytes are stored. It does not decide whose law can compel the provider, whose engineers can reach the environment, or who holds the keys and the software. Control has three parts, legal, technical and operational, and residency covers none of them.
Three kinds of control
Sovereignty has three parts.
Whose courts can compel access
A provider headquartered elsewhere may be bound by its home country’s law, wherever the servers sit.
Whose software and keys
If the provider holds the encryption keys or controls the software, it controls the data.
Whose engineers can reach it
If foreign staff can log into your environment, your control depends on their employer.
Two laws that pull in opposite directions
A region is not a jurisdiction.
Reaches data a US provider controls
US providers can be required to produce data in their possession, custody or control, wherever it is stored.
Asks providers to resist
The EU law requires cloud providers to take measures against unlawful third-country government access to non-personal data.
Residency does not settle it
The provider sits between two legal systems. The safest position is to hold the keys, the software and the hardware yourself.
CLOUD Act, 18 U.S.C. section 2713. EU Data Act, applicable from September 12, 2025.
Anthropic, Redeploying Fable 5, June 30, 2026
In June 2026 a government order switched off two frontier models for every customer.
Days between the June 12 export order and the July 1 return of Fable 5 to customers worldwide
The order took effect immediately and Anthropic had no reliable way to verify nationality, so it suspended both models for all users. The lesson applies to every provider. Any model you depend on can be withdrawn by an order, a price or a policy.
A policy can switch a model off
Anthropic, Redeploying Fable 5, June 30, 2026. Access to Mythos 5 was restored first for a set of US organizations.
Regulators already ask the question
Regulators already require exit plans.
Tested exit plans
Regulation (EU) 2022/2554, Article 28, requires documented and tested exit plans for ICT services that support critical or important functions.
Termination planning
The 2023 interagency guidance on third-party relationships covers contingency planning and termination, for banks of every size.
Extend the plan to AI
Exit plans written for core banking and cloud should now cover models and agent platforms too.
The result
So the test is one question.
Residency is where data sits
Sovereignty is who controls it.
A provider, a price or a policy can change overnight.
Regulators already ask whether you can exit.
So ask the one question
Does it keep working if your model provider is cut off tomorrow?
The microgrid.
Four layers, one question.
A microgrid is a set of generation, storage and loads that can disconnect from the main grid and keep running. This part maps those parts onto your AI, goes through the four layers one by one, and ends with a drill that tests them.
The mapping
Same engineering, different parts.
In a microgrid, generation makes the power, storage holds it, loads use it and a controller keeps it stable. In your AI, models make the intelligence, data holds what it knows, agents do the work and the infrastructure keeps it running. If one comes from outside and cannot be replaced, you are not islanded.
Instrument 01 of 04 · A model worth borrowing
Islanding
Power engineering, the microgrid
A microgrid can disconnect from the grid and keep its own lights on.
Why it matters here
The US Department of Energy defines a microgrid as a group of connected loads and local energy sources that acts as one controllable system and can connect to or disconnect from the main grid. The value is the ability to choose, with independence as the fallback. For AI, that means using outside models when you want to and keeping your own when you must.
US Department of Energy, microgrid definition.
Instrument 02 of 04 · A model worth borrowing
The single point of failure
Reliability engineering
If one part can stop everything, one day it will.
Why it matters here
A single point of failure is any part whose loss halts the whole system. In AI stacks the usual suspects are one model provider, one cloud region, one vendor’s agent runtime and one identity service. Map yours, then give each a second path before you need it.
Standard reliability engineering practice.
Instrument 03 of 04 · A model worth borrowing
Black start
Power system restoration
Can you restart from cold with no outside help?
Why it matters here
After a blackout, a few plants have black start capability, which means a small local source can start the plant without grid power, and the plant then restarts the grid. Sovereign AI faces the same test. If the network and every provider vanished, could your own team bring the models and agents back up from media you hold?
Standard power system restoration practice.
Instrument 04 of 04 · A model worth borrowing
Least privilege
Jerome Saltzer and Michael Schroeder, 1975
Give every person and program only the access the job needs.
Why it matters here
Saltzer and Schroeder named least privilege as a design principle for protecting information. It matters twice for AI. Employees should reach only the files they are allowed to see, and agents should hold only the keys their task needs. A workspace that ignores permissions turns a search box into a leak.
Saltzer and Schroeder, The Protection of Information in Computer Systems, Proceedings of the IEEE, 1975.
The four layers
Four layers, four questions.
Do you hold every copy and every key?
Prompts, files, embeddings and logs, on storage you control.
Can you run the models you need?
On hardware you control, with the option to swap.
Are the agents yours?
Prompts, policies and workflows you own and can move.
Can you run it without permission?
Operate, patch and restart it with your own people.
Layer 1 of 4, data
Every copy and every key, inside your walls.
Data sovereignty covers more than documents. Prompts, retrieved passages, embeddings and logs are data too, and they often leave through places nobody checks. Own the storage and hold the keys, and a request served to someone else cannot reach what the provider never held.
Data, residency compared with sovereignty.
Layer 2 of 4, models
Own a model you can run, and keep the others as options.
A model you can run is an option you keep. Open-weight models trail the closed frontier by about four months on Epoch’s capability index, which is close enough for many enterprise workflows. Keep outside models as options, route between them, and make sure at least one capable model runs on hardware you control.
Models, a provider’s compared with one you run.
Layer 3 of 4, agents
Agents that are yours, governed, and switchable off.
Agents act, so they need more than a location. They need an identity, a policy checked before each action, read-only access by default and a switch that turns them off. If the agent platform belongs to someone else, so does that switch.
Agents, a vendor’s runtime compared with your own.
Layer 4 of 4, infrastructure
Infrastructure you can run without anyone’s permission.
The bottom layer decides whether the other three can stand. It means power, cooling, a controlled network door and hardware you can restart without asking. If the platform needs an outside connection to start, it is not islanded, however many layers sit on top.
Infrastructure, rented compared with operated.
Where sovereign stops.
Our assessment, to argue with. A full dot means you own the layer, a half dot partly and an empty dot not at all. Tags mark what survives a cut-off.
The drill
Cut the provider off and watch which screens go dark.
The test is a drill, not a debate. Take one key workflow, cut off the model provider on a test day, and see what stops. Where the work continues on a model you run, you have an island. Where screens go dark, you have found your single point of failure.
Four ways to island.
In-region, in your cloud, on-premises and air-gapped.
Sovereignty comes in degrees. This part sets out four deployment modes, what each one owns, which sectors tend to need which, and when on-premises is the wrong answer.
Four rungs
Each rung owns more of the four layers.
In-region SaaS keeps data in a region you chose. Running in your own cloud adds control of your agents. On-premises adds your own models and hardware. Air-gapped adds the ability to run with no network at all. Pick the lowest rung that passes your test.
What each mode keeps, and what it costs.
What drives the requirement, by sector.
Our summary. Rules differ by country, so confirm with counsel.
Honest limits
When on-premises is the wrong answer.
Your demand is bursty and rarely sustained
Hardware sits idle and rented capacity would cost less.
You have no team to operate it
A sealed appliance helps, and it still needs an owner.
The work needs a frontier model that exists only as an API. Open-weight models trail by months.
The data is low sensitivity
Residency may be enough, and the extra effort buys nothing.
Build it, rent sovereign cloud, or buy an appliance.
A workspace for every employee.
Governed AI inside the walls.
Sovereign AI is also a product for the people who use it every day. Employees will find AI somewhere, so the question is whether it is somewhere you govern. This part is about giving them a governed workspace.
IBM and Ponemon, Cost of a Data Breach 2025
One in five organizations has had a breach linked to shadow AI.
Of organizations reported a breach involving unauthorized AI use, adding $670,000 to the cost for those with high shadow AI use
97% of the AI-related breaches IBM studied lacked proper AI access controls. Staff use these tools because they help, so the answer is a better sanctioned option.
People will use AI somewhere
IBM and Ponemon Institute, Cost of a Data Breach Report 2025, July 2025, as reported in secondary coverage.
Before and after
A governed workspace beats a ban.
Without an approved option, people paste sensitive data into whatever works. With a workspace on your own hardware, they get any model, search over their own files and the ability to build agents, and nothing leaves. The same work happens, and now you can see it.
What the workspace must do
A workspace people choose to use.
The best one for the task
Several models on the box, so no one reaches outside for capability.
Answers from your own data
Search that respects who is allowed to see what.
Build and share
Anyone can turn a routine into an agent, inside the guardrails.
By design
No prompt, file or log goes to a third party.
Governed by default
The workspace carries the controls.
Single sign-on and role-based access, so the workspace knows who is asking.
Search that keeps document permissions intact.
Approvals before an agent acts on anything that matters.
A tamper-evident log of what was asked and what was answered.
Ban the tools, or provide a workspace.
The platform team’s stack.
What the team runs, and how it updates with no network.
The platform team is the other daily user. This part sets out the six layers they run, how updates reach a machine with no network, a weekly rhythm, and a test of the whole thing.
The stack
Six layers, one team, one sealed machine.
Hardware, runtime, models, agents, workspace and search, and control and audit. Each has a daily task, and none needs an outside party to restart. The fewer separate vendors in that list, the smaller the platform team needs to be.
Updates
Updates cross the gap as signed bundles.
A machine with no network still needs patches. The vendor signs a bundle, a person carries it across on physical media, the machine verifies the signature, applies it, and rolls back automatically if anything fails. No network ever crosses the gap.
The platform team’s rhythm.
Operating principles
Run it like a utility.
Measure it
Capacity, latency and use, for each team.
Rehearse it
Drills beat documents.
Document the exit
Know how to move models and agents to new hardware.
Staff it
Name an owner for each layer.
Try it on your own estate
How far could you island?
Five quick answers, and be honest. The weakest layer is where to start.
The islanding test
Answer all five to see how far you could island.
A planning aid, not an assessment. Nothing you select here is sent anywhere.
Who owns what.
Five seats, one island.
Sovereign AI crosses the whole organization. This part sets out what each seat owns, what to do first, and what to watch for.
The CIO owns the architecture and the exit.
The CISO owns the keys, the access and the audit trail.
The chief data officer owns what the AI may know.
The platform lead owns uptime, updates and the drill.
Every employee is a daily user.
What comes next.
Five predictions, and the strongest argument against.
Predictions are cheap, so each one comes with what would prove it wrong and what to watch for. The strongest argument against this playbook comes right after, because leaving it out would be dishonest.
Looking forward
Five things we expect to be held to.
A date
Each prediction names the year we expect it by.
A confidence
A rough number, so you can hold us to it.
Signals to watch
What would tell you early that it is happening.
What would prove us wrong
Written down before the fact.
Prediction 01 of 05 · Lyzr’s view
Exit plans for models and agents become a standard line in regulated procurement.
Why we believe it
DORA already requires tested exit plans for critical ICT services, and AI is becoming critical.
What would prove us wrong
If regulators treat models as ordinary software, the requirement stays implicit.
Signals to watch
- Procurement questionnaires ask about model exit
- Regulators publish AI exit guidance
- Contracts include model portability terms
Prediction 02 of 05 · Lyzr’s view
The cut-off drill becomes a routine control test in regulated firms.
Why we believe it
The June 2026 suspension showed that a model can be withdrawn overnight, and a drill turns that lesson into evidence.
What would prove us wrong
If providers guarantee continuity in contracts, drills may stay informal.
Signals to watch
- Auditors ask for drill evidence
- Boards request a quarterly result
- Trade groups publish drill templates
Prediction 03 of 05 · Lyzr’s view
Open-weight models reach parity on most enterprise tasks that matter.
Why we believe it
Epoch measures a lag of about four months on its index, and most enterprise tasks do not need the very top of the range.
What would prove us wrong
If the frontier pulls away, regulated firms will face a real capability trade-off.
Signals to watch
- The lag stays under six months
- Regulated firms publish open-model results
- Hardware gets cheaper per token
Prediction 04 of 05 · Lyzr’s view
Sealed on-premises appliances become a normal procurement category for regulated AI.
Why we believe it
A sealed unit lowers the operating burden that stopped many on-premises plans.
What would prove us wrong
If hyperscaler sovereign offerings convince regulators, demand stays in the cloud.
Signals to watch
- More vendors ship appliances
- Public-sector tenders name the category
- Regulators accept appliance attestations
Prediction 05 of 05 · Lyzr’s view
Regulators and boards judge sovereignty by whether the work survives a cut-off.
Why we believe it
Residency is easy to claim and hard to verify, while a drill gives evidence.
What would prove us wrong
If rules keep being written around location, region labels stay the shortcut.
Signals to watch
- Rules mention continuity of service
- Audit scopes include cut-off drills
- Marketing shifts from regions to controls
The strongest argument against this playbook
Sovereign cloud from a hyperscaler is enough.
The argument
Hyperscalers now offer sovereign regions with local operators, and they are cheaper and easier than owning hardware.
Where it is right
For many workloads, especially low-sensitivity ones, it is a sound choice and the economics favor it.
Where it stops
The provider still sits under its home jurisdiction, and a model withdrawn or repriced still stops your work. A region does not pass the cut-off test.
What would change our mind
Evidence that sovereign cloud operators keep working through a real cut-off, and legal opinion that closes the jurisdiction gap.
Where Lyzr fits.
Lyzr’s products, mapped to the four layers.
This part describes Lyzr’s full product set against the four layers and the workspace, from Lyzr’s own pages. It says what is live, what ships later, and where another approach may fit better.
Lyzr’s products against the four layers.
Lyzr sovereign AI page, homepage and pricing page, October 2026. Vendor claims, not independently verified here.
The Lyzr stack
One stack covers all four layers and the workspace, wherever you run it.
Lyzr describes its sovereign stack as the agent platform, Lyzr LLMs and Optimus, with Open Cowork for employees and Opencontroller across the estate. It states that everything runs on open protocols in your own environment, in your cloud, on your hardware or on a sealed appliance. Optimus is the highest-security option, and one of three ways to run the stack.
Three ways to run the Lyzr stack.
Deployment options and status per Lyzr. The cut-off row is our assessment.
Open Cowork
One assistant for the whole company.
Models you run
Brainstorm, create artifacts and spin up custom agents with nothing leaving the building.
Answers from your data
Connectors index the systems you choose and access control stays intact.
Department workbenches
Packaged workbenches for finance, HR, marketing and sales, run privately.
Lyzr Optimus site and Lyzr pricing page, October 2026.
Lyzr Optimus
Optimus is the sealed option for the highest-security sites.
Lyzr describes Optimus as an on-prem AI agent factory in three sizes, from a desk-side machine to a 4U node, with no public cloud, no external model calls and no token meter, and fully air-gapped if required. Lyzr says it ships in Q4 2026.
Optimus Mini at a glance, per Lyzr.
Lyzr Optimus site, October 2026. Availability by region is confirmed during ordering.
Where Lyzr fits, and where to look elsewhere.
A first step, before any hardware.
About Lyzr
The full-stack agent infrastructure platform for enterprises and governments that want to own their intelligence.
Founded in New York in 2023. Agent Studio, Architect, Opencontroller, Open Cowork, Openfinetuner, Optimus and Madison cover building, governing, running and owning agents. Deploys in your AWS, Azure or GCP account, a dedicated tenant, SaaS, on bare metal, fully air-gapped, or on the Optimus appliance.
Backed by Rocketship.vc, BGV, Accenture Ventures, GFT, the Partnership Fund for New York City and Plug and Play.
Sources and notes
Every fact, and where it came from.
- Gartner, digital sovereignty prediction for Europe and the Middle East, as cited in secondary coverage, 2026.
- Clarifying Lawful Overseas Use of Data Act, 2018, 18 U.S.C. section 2713. Explained in secondary coverage.
- EU Data Act, Regulation (EU) 2023/2854, applicable from September 12, 2025, as described in secondary coverage.
- Anthropic, Redeploying Claude Fable 5, June 30, 2026.
- Regulation (EU) 2022/2554, DORA, Article 28, and RTS (EU) 2024/1773, Article 10, on exit strategies and plans.
- Interagency Guidance on Third-Party Relationships, Risk Management, June 2023.
- Epoch AI, Open models lag state-of-the-art closed models by 4 months, May 2026.
- IBM and Ponemon Institute, Cost of a Data Breach Report 2025, as reported in secondary coverage.
- Lyzr sovereign AI page, the sovereign stack and what is live and coming, October 2026.
- Lyzr homepage, product descriptions, October 2026.
- Lyzr pricing page, Optimus availability and Openfinetuner, October 2026.
- Lyzr Optimus site, hardware, models, security and software, October 2026.
- Lyzr, Sovereign AI and Control Plane launch, EIN Presswire.
Vendor claims are labeled as Lyzr’s. Secondary citations say so, and the underlying texts are the issuing bodies’ own.
Sources and notes
The ideas, and who had them.
- US Department of Energy, microgrid definition.Connect and disconnect by choice
- Reliability engineering, the single point of failure.Give every critical part a second path
- Power system restoration, black start.Restart from cold with no outside help
- Jerome Saltzer and Michael Schroeder, The Protection of Information in Computer Systems, 1975.Least privilege
The four layers, the islanding test, the ranking of offerings, the predictions and the first step are our own, offered to be argued with.
Your next step
Bring your islanding test.
Leave with a dependency map and a drill plan. Thirty minutes, no slides, and an honest view of whether Lyzr is the right way to island.
01
Map it
We map your four layers and the single points of failure.
02
Scope it
We pick one workflow and one team to island first.
03
Drill it
We agree how to run the cut-off drill and what counts as a pass.