This article provides governance professionals with a structured assessment methodology covering the five sovereignty dimensions defined in the COMPEL sovereign AI readiness framework.
The Strategic Context
Sovereign AI readiness is not an abstract governance exercise — it is a strategic capability with tangible business implications:
Market access. Increasingly, jurisdictions require AI systems to meet local sovereignty requirements as a condition of market access. The EU’s emphasis on trustworthy AI, China’s data localisation requirements, India’s payment data residency rules, and emerging regulations across the Middle East and Southeast Asia all create sovereignty prerequisites for market participation.
Supply chain resilience. The concentration of semiconductor manufacturing, cloud infrastructure, and foundation model development in a small number of jurisdictions creates strategic dependency risks. Organisations that cannot sustain AI operations under supply chain disruption face business continuity threats.
Customer trust. Customers — particularly enterprise buyers, government agencies, and healthcare organisations — increasingly evaluate AI vendors on their sovereignty posture. Can the vendor guarantee where data is stored? Can the vendor provide model auditability? Can the vendor operate under local regulatory authority?
Regulatory preparedness. The regulatory landscape is converging toward sovereignty requirements. Organisations that build sovereignty capabilities now will be better positioned when regulations mandate them.
The Five-Dimension Assessment
Dimension 1: Data Sovereignty Assessment
What to assess: The organisation’s ability to maintain control over data used in AI systems — collection, storage, processing, and transfer — in compliance with jurisdictional requirements.
Assessment approach:
Start with a data flow audit. For every AI system in the portfolio, map: where training data originates, where it is stored, where it is processed for training and inference, and every cross-border transfer in the pipeline. Document the legal basis for each transfer.
Evaluate data classification maturity. Does the organisation have a data classification scheme that identifies sovereignty-relevant categories (personal data, special category data, important data, government data)? Is the classification applied consistently across the AI data estate?
Assess data residency controls. Are technical controls (geo-fencing, encryption, access controls) in place to enforce data residency requirements? Can the organisation demonstrate — not just claim — where data resides?
Evaluate privacy-enhancing technology adoption. Has the organisation evaluated or deployed federated learning, differential privacy, synthetic data generation, or data clean rooms as mechanisms for maintaining data utility while respecting sovereignty constraints?
Key indicators of maturity:
- Level 1: Cannot state where AI training data resides
- Level 3: Comprehensive data flow mapping with enforced residency controls
- Level 5: Sovereign data architecture enables rapid compliance with new jurisdictional requirements
Dimension 2: Compute Sovereignty Assessment
What to assess: The organisation’s control over the computational infrastructure used for AI workloads, including geographic location, vendor dependency, and supply chain resilience.
Assessment approach:
Inventory all compute infrastructure used for AI workloads: cloud providers, data centre locations, GPU/TPU hardware, and contract terms. Document the jurisdictional location of every compute resource.
Evaluate vendor concentration risk. What percentage of AI compute depends on a single cloud provider? What happens if that provider changes terms, pricing, or availability? What is the migration path?
Assess hardware supply chain exposure. Document dependencies on specific GPU vendors, chip fabrication facilities, and hardware supply chains. Evaluate the impact of potential export controls or sanctions on compute access.
Evaluate multi-cloud and hybrid-cloud readiness. Can AI workloads be migrated between cloud providers and regions without significant re-architecture? Is compute portability tested, not just assumed?
Key indicators of maturity:
- Level 1: AI training runs on a single cloud provider with no awareness of data centre locations
- Level 3: Multi-cloud strategy with documented jurisdictional compute location
- Level 5: Sovereign cloud capacity exists for sensitive workloads; organisation can sustain operations under supply chain disruption
Dimension 3: Model Sovereignty Assessment
What to assess: The organisation’s control over the AI models it deploys — the ability to inspect, modify, audit, and replace models without being locked into proprietary foundations.
Assessment approach:
Inventory all AI models by provenance: in-house developed, open-weight, proprietary vendor, and mixed. For each model, document: can the organisation inspect the model’s weights and architecture? Can it audit the training data? Can it modify the model for fairness, safety, or compliance purposes? What happens if the model provider becomes unavailable?
Assess vendor lock-in risk. For proprietary foundation models, evaluate: contract terms, API stability, data ownership, model auditability provisions, and exit costs. Can the organisation switch to an alternative model without rebuilding the application?
Evaluate in-house model development capability. Does the organisation have the talent, infrastructure, and processes to develop models for critical applications internally, rather than depending entirely on third-party models?
Assess model abstraction architecture. Are applications built directly on a specific model’s API, or through an abstraction layer that enables model switching?
Key indicators of maturity:
- Level 1: Heavy dependency on opaque, proprietary foundation models from a single vendor
- Level 3: Multi-model strategy with audit provisions in vendor contracts
- Level 5: Organisation develops proprietary models for competitive-critical applications
Dimension 4: Regulatory Alignment Assessment
What to assess: The organisation’s capability to understand, interpret, and comply with AI regulations across all jurisdictions where it operates.
Assessment approach:
Map the organisation’s regulatory footprint. For every AI system, identify every applicable regulation based on deployment location, data processing geography, and extraterritorial reach.
Evaluate compliance programme maturity. Does the organisation have a systematic AI compliance programme, or is compliance addressed reactively? Is the compliance programme integrated into the AI development lifecycle?
Assess regulatory intelligence capability. Does the organisation monitor regulatory developments across jurisdictions? How quickly can it assess the impact of a new regulation on its AI portfolio?
Evaluate cross-framework harmonisation. Has the organisation identified overlapping requirements across regulations and designed a harmonised compliance architecture, or does it maintain separate compliance programmes for each regulation?
Key indicators of maturity:
- Level 1: No systematic tracking of AI regulations
- Level 3: Compliance programme integrated into AI development lifecycle
- Level 5: Organisation shapes regulatory development through active participation in consultations
Dimension 5: Talent and Skills Sovereignty Assessment
What to assess: The organisation’s human capability to govern AI systems — technical, legal, ethical, and strategic governance skills.
Assessment approach:
Inventory AI governance roles and capabilities. How many people have dedicated AI governance responsibilities? What is the ratio of governance professionals to AI systems? Are governance roles filled by qualified individuals or assigned as additional duties to already-overloaded roles?
Assess capability breadth. Does the governance team include technical AI expertise (ML engineering, data science), legal and regulatory expertise, ethics and social impact expertise, and business strategy expertise? Or is the team skewed toward one discipline?
Evaluate succession and dependency risk. If the top 2–3 governance professionals left the organisation, could the governance programme continue? Is governance knowledge documented and transferable?
Assess training and development. Is there a structured professional development programme for AI governance professionals? Are governance team members developing skills to keep pace with evolving AI technology and regulation?
Key indicators of maturity:
- Level 1: No dedicated AI governance roles; complete dependency on external consultants
- Level 3: Dedicated governance team with cross-functional representation
- Level 5: Organisation is recognised as a leader in AI governance capability
Conducting the Assessment
Step 1: Self-Assessment (2–3 weeks)
Each dimension is assessed by the relevant function using the maturity indicators. Data sovereignty by the data governance team, compute sovereignty by infrastructure, model sovereignty by ML engineering, regulatory alignment by legal/compliance, and talent by HR and governance leadership.
Step 2: Cross-Validation (1–2 weeks)
Self-assessments are reviewed by an independent party (internal audit, governance committee, or external assessor) to calibrate ratings. Self-assessments tend toward optimism; cross-validation provides a reality check.
Step 3: Gap Analysis and Roadmap (2–3 weeks)
Compare current maturity against target maturity (typically 2 levels above current for a 2-year horizon). Identify the highest-priority gaps and design a remediation roadmap with specific actions, owners, and timelines.
Step 4: Board Presentation
Present the sovereignty readiness profile to the board or governance committee as a radar chart showing current versus target maturity across all five dimensions. Focus the narrative on business implications: market access at risk, supply chain vulnerabilities, and regulatory exposure.
Step 5: Periodic Reassessment
Reassess annually. Track progress against the roadmap and adjust targets as the external environment evolves.
This article is part of the COMPEL Body of Knowledge v2.5 and supports the AI Transformation Governance Professional (AITGP) certification.