Executive Summary
AI adoption in Europe and Switzerland is no longer constrained by access to models or compute. The primary constraint has shifted to a misunderstanding at the intersection of law, architecture, and machine learning theory. Many organizations still assume that data residency, end-to-end encryption, or embedding-based architectures are sufficient to guarantee sovereignty, even when AI models are deployed on clouds governed by foreign jurisdictions. This assumption is no longer defensible.
Recent research has demonstrated that modern language models are almost surely injective: distinct input prompts produce distinct internal representations. As a result, learned representations preserve information rather than abstract it away. In such systems, the model itself becomes a potential disclosure surface, independent of whether data is encrypted at rest or in transit. The implication is decisive:
For AI systems, sovereignty is not only determined by where data is stored, or by how it is encrypted, but also by where the model executes and under which jurisdiction that execution is governed.
This article explains why several widely cited “safety arguments” collapse under closer scrutiny, and what decision-makers must do instead.
The Residency Illusion
For years, organizations equated compliance with physical data location. If data remained in Switzerland or the EU, sovereignty was assumed. This assumption, the Residency Illusion, was already fragile in the cloud era. In the AI era, it becomes structurally false.
Modern AI systems are not passive storage containers. They are active transformation engines that:
-
Ingest data,
-
Internalize patterns,
-
Adapt behavior, and
-
Generate new outputs based on learned representations.
As a result, sovereignty can no longer be reasoned about purely in terms of where bytes sit.
AI Sovereignty must be reasoned about in terms of who governs intelligence in execution.
The CLOUD Act Trap
The U.S. CLOUD Act clarified that U.S. authorities may legally compel certain providers to disclose data within their possession, custody, or control, regardless of where that data is physically stored. This already undermines the idea that “local hosting” alone guarantees sovereignty. But for AI systems, the issue goes further.
The CLOUD Act is not only about access to stored data.
It is about jurisdiction over systems. When AI workloads run on infrastructure governed by foreign law, authorities may legally compel the operator of that infrastructure to provide access to:
-
Runtime memory,
-
Model weights,
-
Fine-tuning checkpoints,
-
Inference logs,
-
Update pipelines,
-
Operational telemetry.
At this point, encryption and embedding arguments typically enter the discussion.
The Encryption Argument: Why it Fails for AI?
Decision-makers are often reassured with statements such as:
-
“Our data is end-to-end encrypted.”
-
“We only use embeddings, not raw data.”
-
“The provider cannot read customer content.”
These statements are often technically correct—and strategically misleading.
What encryption actually protects
End-to-end encryption is effective for storage, transport, and backup. It ensures that a provider cannot simply open a file and read its contents. But AI models cannot operate on encrypted data. To perform inference, inputs must be tokenized, embedded, and propagated through model layers as plaintext internal representations.
At that moment, cryptographic guarantees end.
Encryption protects data containers, but AI systems operate on data as intelligence.
Equation Shift: The Injectivity of Language Models
Recent research has fundamentally revised assumptions about how language models handle information. In Language Models Are Injective and Hence Invertible (Nikolaou et al., 2025), the authors prove that standard decoder-only Transformer language models are almost surely injective as mappings from input prompts to internal representations. In precise terms: For virtually all parameter settings encountered in practice, and throughout standard training, distinct input prompts produce distinct hidden representations. Collisions exist only on pathological, measure-zero parameter sets that initialization and training will not reach.
What injectivity means in practice
Because the prompt-to-representation mapping is injective:
-
Internal hidden states uniquely identify the input prompt
-
Input sequences can, in principle, be exactly reconstructed from hidden activations
-
Learned representations are information-preserving, not lossy abstractions
The authors operationalize this result with SIPIT, an algorithm that provably reconstructs the exact input prompt from hidden states in linear time, and demonstrate this empirically across multiple production-grade models.
Their conclusion is explicit:
Hidden states are not abstractions but the prompt in disguise.
Why this invalidates common sovereignty arguments
If internal representations uniquely encode the input, then:
-
Hidden activations are functionally equivalent to raw data
-
Embeddings are not anonymized artifacts
-
Deleting prompts does not remove the information once execution has occurred
As a result, encrypting inputs, outputs, or stored embeddings does not eliminate exposure if a third party can access runtime memory, hidden activations, model execution state.
In injective systems, the model itself becomes a transformed dataset.
Encryption protects data containers, but execution on an Language Model is itself is a data surface.
Why “Zero-Knowledge AI” Is Often a Category Error
The concept of zero-knowledge originates in cryptography and applies well to messaging and storage systems. For AI systems, it frequently collapses. To operate a model, a provider necessarily controls the execution environment, the scheduler, the memory space, inference logs, and more.
If that execution environment is subject to foreign jurisdiction, zero-knowledge claims lose relevance. Legal compulsion applies to the operator of the infrastructure—not merely to visibility of encrypted storage.
With injective models, even perfect encryption at the storage layer does not prevent disclosure at the intelligence layer. This is why:
AI sovereignty cannot be achieved through encryption alone.
A Note on Confidential Computing
Some architectures attempt to reduce execution-level exposure through confidential computing and trusted execution environments (TEEs).
These techniques can reduce certain technical attack surfaces. They do not, however, resolve the sovereignty question.
Jurisdictional authority applies to execution control, lifecycle management, and legal accountability. Even when memory is isolated, execution governed by foreign law remains externally controllable.
Confidential computing may reduce risk.
It does not eliminate jurisdictional dependence.
Sovereignty for AI Means Execution Sovereignty
The decisive boundary for AI sovereignty is not storage. It is execution. An AI system is sovereign only if:
-
The model executes on infrastructure governed by “domestic” law,
-
Operational control is locally enforceable,
-
Runtime, updates, and lifecycle management are not subject to foreign compulsion.
This applies equally to:
-
Foundation models,
-
Fine-tuned models,
-
Retrieval-augmented systems,
-
Agentic architectures.
If execution is non-sovereign, sovereignty is compromised, regardless of encryption.
Fine-Tuning: From Generic Intelligence to Local Sovereign Assets
Fine-tuning can adapts generic intelligence to specific purpose, including local context, such as regulatory constraints, institutional decision logic, domain-specific language, organizational risk tolerance. At this point, the model ceases to be generic. It becomes local / “Proprietary” intelligence.
Given injectivity, fine-tuned models must be treated as strategic assets, comparable to proprietary algorithms or regulated decision systems.
The critical distinction
Fine-tuning determines what the model knows, and how it behaves.
Deployment determines who governs that knowledge.
Deploying fine-tuned models on foreign-governed infrastructure reintroduces exposure, even if: data never leaves the country, inputs are encrypted, embeddings are used. Only sovereign deployment preserves:
-
Legal authority,
-
Operational control,
-
Long-term autonomy over institutional intelligence.
The End of Comforting Myths
Several narratives remain widespread:
-
“Our data never leaves Europe.”
-
“Everything is encrypted.”
-
“We only use embeddings.”
-
“The provider cannot see our content.”
These statements may be factually correct, while strategically irrelevant. For AI systems, the real question is simpler and more uncomfortable:
Under which law does your Enterprise AI execute?
If the answer is foreign law, sovereignty does not exist.
Executive Takeaway
AI sovereignty is not ideological. It is structural and architectural.
The injectivity of language models eliminates the illusion that encryption alone can guarantee control. In AI systems, the model is the data, and execution is the control point. The choice facing leaders in 2026 is therefore clear:
-
Architect AI systems for sovereign execution and lifecycle control, or
-
Accept embedded dependency and external governance of institutional intelligence
This choice is not reversible without significant cost.
Sources
-
Nikolaou et al., Language Models Are Injective and Hence Invertible, arXiv:2510.15511, 2025
-
U.S. Congress, Clarifying Lawful Overseas Use of Data Act (CLOUD Act), 2018
-
European Union, General Data Protection Regulation (GDPR), Article 48
-
European Data Protection Board, Guidelines 02/2024 on Article 48 GDPR
-
Swiss Federal Council, Federal Act on Data Protection (revFADP)
-
European Union, Artificial Intelligence Act (AI Act) — governance and applicability
