Is a private Azure OpenAI deployment actually sovereign?

No. A private Azure OpenAI deployment is not sovereign. Running the model inside your own Azure tenant isolates your data logically, but the model still executes on vendor-operated hardware, run by a provider under United States jurisdiction, with the encryption keys and the control plane held by the vendor rather than by you. Sovereignty is decided by who holds the keys, who runs the silicon and which law can compel access, and on all three counts the answer is not the customer.

This distinction matters because 2026 is the year regulated buyers stop accepting logical isolation as a proxy for control. DORA has been in force since January 2025, NIS2 now binds essential and important entities across Europe, and the EU AI Act's high-risk obligations are approaching. Procurement teams in defence, finance and critical national infrastructure are being asked a sharper question than "is it private". They are being asked to prove where a model runs, who can reach it and whether an auditor can verify the answer without trusting the vendor's word.

What does sovereign actually mean?

Sovereignty is not a marketing adjective. It is a set of testable conditions. A system is sovereign when three things are true at once: the customer holds the cryptographic keys, the customer controls the hardware the model runs on, and no foreign law can compel a third party to hand over data or access. Data residency, the promise that bytes sit in a named region, satisfies none of these on its own. A model can process data inside a Frankfurt data centre and still be reachable by a legal order served on the operator. Region is geography. Sovereignty is jurisdiction plus custody.

How does a private Azure OpenAI deployment actually work?

A private Azure OpenAI deployment gives you a dedicated endpoint inside your tenant, private networking, and a contractual promise that your prompts are not used to train shared models. That is genuine data isolation and it is worth having. What it is not is custody. The weights sit on vendor-managed accelerators. The control plane that schedules, patches and observes those accelerators is operated by the vendor. Encryption at rest defaults to vendor-managed keys, and even customer-managed keys in this model are stored in a vendor-run key service. You rent isolation. You do not hold the machine.

Why does the US CLOUD Act break the sovereignty claim?

The United States CLOUD Act lets US authorities compel a US-headquartered provider to produce data in its possession, custody or control, wherever in the world that data physically sits. A European subsidiary and a European data centre do not remove the parent's reach. This is the fault line a tenant boundary cannot cross:

• The provider can be ordered to act without notifying you.
• The order reaches data in any region the provider operates.
• Your own contract cannot override a lawful government demand on the provider.

Logical isolation protects you from other tenants. It does not protect you from the provider's own legal obligations.

What can an auditor actually check?

An auditor cannot verify what they cannot inspect. In a hosted deployment, the honest answer to "prove this ran where you say and that no one else touched it" is a set of vendor attestations and certifications. Those are evidence about the vendor's controls. They are not proof you can reproduce. A stronger standard, and the one regulated buyers are moving towards, is offline verifiability: an audit ledger the customer holds, sealed with signatures the customer can check independently, on hardware whose identity is attested rather than asserted. The named test is simple. Can you prove the record without asking the vendor? If the answer needs a trust-us certificate, the deployment is not sovereign.

“Sovereignty is not where the data sits, it is who can be compelled to reach it and who can prove they did not.”

Which rules make true sovereignty necessary?

European and UK regulation is converging on control you can demonstrate, not control you assert. DORA, in force since January 2025, makes financial entities accountable for concentration risk in their critical technology providers. NIS2 extends security and oversight duties to essential and important entities across sectors. GDPR still governs international transfers and the lawful basis for processing. ISO/IEC 42001 sets an auditable management standard for AI systems. On the EU AI Act, the high-risk obligations under Annex III that were once due on 2 August 2026 have been deferred by the Digital Omnibus to 2 December 2027, with embedded high-risk systems under Annex I moving to 2 August 2028 and the Article 50 transparency duties largely unchanged. We read that shift as a build window, not a reprieve. The buyers preparing now are the ones who will not be rebuilding under a deadline later.

How does a Sovereign Intelligence Operating System close the gap?

Mickai is a Sovereign Intelligence Operating System, a SIOS, built for exactly the conditions a hosted deployment cannot meet. It runs offline on operator-owned hardware, so there is no vendor control plane and no foreign legal reach into the silicon. Its perimeter is zero-egress: the system accepts what it needs inbound and sends nothing out. Identity is hardware-attested and bound into the audit chain, so every action is tied to a device the operator controls. Every action is sealed in a post-quantum signed audit ledger using FIPS 204, the ML-DSA signature standard, with FIPS 205 as the stateless-hash alternative, giving a record you can verify without trusting anyone. Cross-model consensus lets more than one sovereign model check a result before it is trusted. The architecture behind this is protected by 104 filed UK patent applications, approximately 2,340 claims, owned by Mickai LTD, and patent pending. The difference from a private cloud deployment is not degree. It is custody.

Frequently asked questions

Is Azure OpenAI in your own tenant private?

Yes, it is private in the sense that your data is logically isolated from other customers and is not used to train shared models. Private is not the same as sovereign. The model still runs on vendor-operated hardware under US jurisdiction, so isolation protects you from other tenants but not from the provider's own legal obligations.

Does choosing a European Azure region make it sovereign?

No. A European region controls where the data physically sits, which is data residency, not sovereignty. Because the provider is US-headquartered, the CLOUD Act can compel production of data held in any region it operates. Geography does not change jurisdiction.

Can customer-managed keys make Azure OpenAI sovereign?

They help, but they do not close the gap. In a hosted deployment your customer-managed keys are still held in a vendor-run key service on vendor-run hardware. Sovereignty requires that you hold the keys and control the silicon, not that the vendor manages your keys on your behalf.

What is the single test for AI sovereignty?

Ask whether you can prove where the model ran and that no one else reached it without relying on the vendor's word. If verification needs a vendor certificate or attestation, the deployment is not sovereign. True sovereignty means an offline, independently verifiable audit record on hardware you control.

Does the EU AI Act delay mean sovereignty can wait?

No. The high-risk Annex III obligations moved from 2 August 2026 to 2 December 2027, with embedded high-risk systems following on 2 August 2028, but DORA and NIS2 are already in force. We read the delay as a build window, not a reprieve, because sovereign architecture takes longer to adopt than a deadline allows.