Keeping artificial intelligence within national borders is becoming an attractive proposition for banks, but the location of a server tells only part of the story. A financial institution may process customer information through AI infrastructure located in its home market while continuing to depend on an overseas technology provider for the underlying models, software updates, security architecture and specialised computing capabilities. This distinction is gaining importance as banks begin integrating advanced AI into customer services, financial crime monitoring, risk management and internal operations. Emirates NBD’s recently announced collaboration with OpenAI, which will enable the bank to use GPT models through UAE-based inference infrastructure, illustrates how financial institutions are approaching the issue. Yet it also raises a broader question for the industry: does running AI locally give banks greater control over the technology, or does it simply change where some of their existing dependencies are located? The answer matters because AI is gradually becoming part of the infrastructure on which banking operations depend, bringing new considerations for technology governance, operational resilience and long-term strategic independence.
What Does Sovereign AI Actually Mean for a Bank?
Sovereign AI has become an increasingly prominent term in discussions about national technology infrastructure, particularly as governments and regulated industries seek greater control over the systems used to process sensitive information. In practical terms, the concept can refer to several different arrangements. These include AI models developed domestically, computing infrastructure operated within national borders, locally governed data environments or technology platforms designed to comply with jurisdiction-specific requirements. Although these approaches are often discussed together, they provide different degrees of control and should not be treated as interchangeable.
For a bank, running an AI model on infrastructure located within its own country may help address requirements relating to data residency and the location of processing activities. However, this does not necessarily mean that the institution owns the model, controls its development or can operate it independently of the original provider. A locally hosted AI service may still depend on proprietary software, externally developed models, remote management capabilities and specialised hardware supplied by international technology companies. The bank may have greater control over where certain information is processed while retaining limited influence over the technology responsible for processing it.
This distinction is particularly important for financial institutions because sovereignty is not a single technical characteristic that can be established by selecting a particular data centre. It involves questions of operational authority, contractual rights, data governance, software dependencies and the ability to maintain critical services under changing circumstances. A bank considering sovereign AI therefore needs to understand which elements of its technology environment are genuinely under its control and which remain dependent on external organisations.
Emirates NBD Illustrates the Shift Towards In-Country AI Infrastructure
The growing interest in locally deployed AI infrastructure was highlighted on 19 October 2026, when Emirates NBD and OpenAI announced an enterprise collaboration that will allow the Dubai-based banking group to deploy GPT models using inference infrastructure located in the UAE. According to the announcement, Emirates NBD will become the first bank in the Middle East and North Africa to use OpenAI’s models through this type of in-country inference arrangement. The bank intends to integrate the technology across customer engagement, risk and compliance, knowledge-intensive operations and employee productivity, while connecting AI capabilities with internal systems, enterprise data and application programming interfaces.
The significance of the arrangement extends beyond the introduction of another generative AI platform. It reflects the increasing importance of deployment architecture in enterprise AI procurement, particularly for organisations operating in regulated industries. Emirates NBD is seeking access to advanced models while supporting local expectations concerning privacy, governance and data residency. The collaboration also aligns with the UAE’s wider ambition to develop domestic AI infrastructure and encourage adoption across strategically important sectors. However, the announcement does not provide a complete technical description of the deployment, including the extent of operational control over the infrastructure, model lifecycle management or supporting services. It would therefore be premature to conclude that the arrangement provides full technological independence.
What the announcement demonstrates is that the ability to offer AI inference within a particular jurisdiction is becoming commercially important. Banks are no longer evaluating AI providers solely on model capabilities or subscription costs. They are increasingly examining where processing takes place, how models connect to enterprise systems and whether the deployment arrangement fits within existing technology risk and regulatory frameworks. This creates opportunities for AI companies and infrastructure providers able to offer more flexible deployment options, while also introducing new questions about the dependencies associated with those arrangements.
Local Inference Is Not the Same as Local Control
Understanding the distinction between inference and model ownership is central to evaluating sovereign AI. Inference is the process through which a trained AI model receives information and generates a response, prediction or other output. When inference takes place within a particular jurisdiction, the computing resources performing that processing are located there. Depending on the architecture and contractual arrangements, this can help institutions control where certain information is processed and potentially reduce the need for sensitive data to travel across borders during model execution.
However, the model being used may still have been developed and trained elsewhere. Its architecture, capabilities, updates and licensing conditions may remain under the control of the original technology provider. Even where inference is performed locally, supporting activities such as system monitoring, software maintenance, logging, security management or technical support may involve services operating outside the jurisdiction. The precise implications depend on how the environment is designed and governed, making it important for banks to examine the complete service rather than rely solely on the location of the inference infrastructure.
There is also a difference between having access to a model and being able to operate it independently. Some deployment arrangements may provide institutions with substantial control over infrastructure and configuration, while others involve managed services in which the provider retains responsibility for important operational components. These distinctions influence how quickly a bank can respond to incidents, whether it can control model updates and what options are available if the commercial relationship changes. Local inference can provide meaningful benefits, but those benefits should be evaluated as part of a wider assessment of control over the AI operating environment.
Data Sovereignty Requires More Than Keeping Information in One Country
Data residency is often one of the principal reasons financial institutions consider sovereign AI arrangements. Banks process large volumes of confidential information, including customer records, financial transactions, account details and internal risk assessments. Introducing this information into AI applications raises questions about where it is transmitted, how long it is retained, who can access it and whether it is used for purposes beyond the institution’s authorised requirements. In-country inference can help address some of these concerns by locating model processing within the relevant jurisdiction, but it does not automatically resolve every aspect of data governance.
A banking AI application typically involves more than a model receiving a prompt and generating an answer. Information may be retrieved from enterprise databases, processed through application services, stored in temporary environments or recorded in operational logs. Retrieval-augmented generation systems, for example, may use vector databases and document-processing services to supply models with relevant business information. An AI agent may also connect to internal APIs, workflow engines and external services to complete assigned tasks. Each component introduces additional considerations about data location, access permissions, encryption and retention. A bank could operate inference locally while still transferring certain information through other parts of the application architecture.
Financial institutions therefore need to examine the complete data lifecycle associated with AI applications. This includes identifying what information enters the model, whether it is stored or logged, which parties can access it and how it is protected throughout the process. Contractual assurances and technical controls are both relevant, particularly where third-party providers manage parts of the infrastructure. The objective is not simply to keep data within a national boundary, but to ensure that the institution can demonstrate appropriate control over how sensitive information is processed and used.
Sovereign AI May Introduce New Forms of Technology Concentration
Banks have spent years examining their dependence on major cloud providers, particularly as more critical applications have moved away from internally managed data centres. The introduction of advanced AI adds another layer to this concentration risk. Financial institutions may depend on a relatively small number of companies for frontier models, specialised computing infrastructure, AI development platforms and the software required to operate these systems. Even when processing takes place within a domestic data centre, the underlying technology may remain closely connected to global suppliers.
This creates a distinction between geographic diversification and technological diversification. A bank may reduce certain cross-border processing dependencies by using local AI infrastructure while remaining dependent on a single model provider. If the model becomes unavailable, licensing terms change or an important software component requires replacement, the institution may face difficulties maintaining its applications. These risks become more significant when AI is integrated into operational workflows rather than used only for general employee productivity. A customer service application may be relatively straightforward to suspend or replace, while an AI system supporting financial crime investigations or complex internal processes could require extensive testing before an alternative can be introduced.
The issue also connects with cloud portability. An AI application developed around a proprietary model and its associated tools may not be easily transferable to another provider, even if the replacement infrastructure is located in the same country. Differences in model behaviour, integration interfaces and supporting services can create substantial migration work. Banks seeking greater technological control may therefore need to consider model portability, alternative deployment options and the ability to maintain essential functions when individual AI services become unavailable.
The Importance of Model Governance and Operational Independence
One of the less visible challenges of sovereign AI concerns control over the model itself. Financial institutions are accustomed to managing software changes through established testing, approval and deployment procedures. AI introduces additional complexity because changes to a model can affect how an application interprets information, generates recommendations and interacts with connected systems. A model update may improve performance in some areas while producing different results in others, even when the bank has made no changes to its own application code.
For banks deploying externally developed models, governance arrangements need to establish how updates are introduced, what testing is required and whether the institution can control when changes affect production applications. This is particularly important for systems supporting risk management, compliance and other activities where inconsistent behaviour could have financial or regulatory consequences. The ability to operate inference locally does not necessarily provide control over the model development process or the availability of future versions. Institutions may therefore need contractual and technical arrangements that support version management, performance monitoring and appropriate validation before changes are introduced.
Operational independence also depends on the surrounding infrastructure. Banks need to understand who is responsible for maintaining the computing environment, responding to security incidents, managing encryption keys and restoring services following disruption. If a locally deployed AI platform requires remote intervention from the original provider to resolve critical problems, the institution’s practical control may be more limited than the location of the infrastructure suggests. These considerations do not make managed AI services unsuitable for banking, but they reinforce the need to distinguish between local deployment and the ability to operate a service independently.
Can Banks Build AI Systems That Are Less Dependent on Individual Providers?
One possible response is to design banking AI applications so that the underlying model can be changed without requiring the entire application to be rebuilt. This approach separates business workflows, enterprise data access and operational controls from the model used to perform particular tasks. A bank might establish an internal AI platform that manages authentication, data retrieval, monitoring and policy enforcement while allowing different models to be selected according to the requirements of individual applications. Such an architecture could support a combination of proprietary and open-weight models, depending on performance, cost, security and deployment considerations.
However, model portability is not straightforward. Two models may support similar tasks while producing different responses, interpreting instructions differently or selecting different actions when connected to enterprise tools. Replacing one model with another can therefore require extensive testing to establish that the application continues to operate reliably. This is particularly relevant for agentic AI, where models may determine which tools to use and how to complete a sequence of activities. The surrounding application must enforce permissions and transaction controls independently of the model, while testing must establish that the replacement model behaves appropriately within those boundaries.
Banks may also consider whether selected AI workloads can be supported by smaller or more specialised models that can be operated within infrastructure they control. Such models may be suitable for particular document-processing, classification or analytical tasks, although they may not match the capabilities of larger frontier models across every application. The appropriate architecture will depend on the complexity of the workload, the quality of available models and the institution’s operational requirements. Greater independence is possible in some areas, but it may involve trade-offs in performance, development effort and infrastructure costs.
The Economics of Sovereign AI Deserve Closer Examination
Operating advanced AI within a particular jurisdiction can introduce financial considerations that differ from conventional access to centrally managed cloud services. Frontier models require substantial computing resources, and inference infrastructure must be capable of supporting the workloads generated by enterprise applications. Depending on the deployment model, organisations may need to consider specialised processors, networking, storage, cooling, capacity management and technical support. These costs can be difficult to justify if infrastructure is underutilised or if demand varies significantly across business functions.
For banks, the economics will depend on whether local inference is delivered as a managed service, through dedicated infrastructure or as part of a broader enterprise platform. A managed arrangement may reduce the institution’s direct infrastructure responsibilities while introducing continuing dependence on the provider. Dedicated infrastructure may offer greater control over capacity and configuration but can require additional investment and specialised operational expertise. Financial institutions must also consider the cost of maintaining alternative systems, conducting model evaluations and ensuring that AI services remain available during infrastructure failures or other disruptions.
These trade-offs mean that sovereign AI should not automatically be regarded as either more expensive or more efficient than conventional deployment models. Its value depends on the applications being supported, the regulatory and operational requirements involved and the extent to which the architecture provides benefits that justify its costs. For some banks, in-country inference may be an important enabler of enterprise AI adoption. For others, the most practical solution may involve a combination of deployment approaches, with particularly sensitive workloads receiving different treatment from lower-risk applications.
A New Competitive Dimension for Banking Technology Providers
The growing interest in sovereign AI could reshape competition among AI developers, cloud infrastructure companies and banking technology vendors. Financial institutions increasingly require more than access to capable models. They need deployment arrangements that fit within established security, governance and operational frameworks, together with integration capabilities that allow AI to work with existing banking systems. Providers able to support in-country inference, controlled model updates, enterprise identity management and flexible infrastructure arrangements may find opportunities among banks that have previously been cautious about deploying advanced AI at scale.
There is also a role for banking technology companies that can help institutions manage AI independently of any single model provider. Platforms offering model orchestration, data governance, testing, monitoring and secure API integration could become important components of enterprise AI architecture. Such capabilities may allow banks to adopt different models without repeatedly rebuilding the controls surrounding them. However, the effectiveness of these approaches will depend on how well they manage the technical differences between models and the operational risks associated with automated decisions.
The Emirates NBD and OpenAI collaboration illustrates the commercial importance of this emerging market. It shows how advanced model providers are adapting their enterprise offerings to the needs of regulated financial institutions, particularly in markets investing in domestic AI infrastructure. The longer-term competitive question is whether banks will become more independent through these arrangements or whether they will develop new dependencies on a smaller group of AI technology suppliers.
The Real Test of Sovereign AI Is What Happens When Dependencies Are Challenged
The attraction of sovereign AI is understandable. Financial institutions want to use increasingly powerful models without compromising their responsibilities for customer information, operational resilience and regulatory compliance. Local infrastructure can support those objectives, particularly when it provides greater control over the location of processing and enables closer integration with domestic technology environments. Yet sovereignty should be assessed through the practical capabilities an institution retains, not simply through the geographic location of its computing resources.
A bank that can run AI inference locally but cannot manage model updates, replace a provider or maintain critical services during a disruption may still face substantial external dependencies. Conversely, an institution using internationally developed technology may achieve meaningful operational control through carefully designed architecture, contractual protections, independent security controls and tested contingency arrangements. The distinction is important because the industry risks treating sovereign AI as a deployment label rather than a measurable set of technical and governance capabilities.
As AI becomes more deeply embedded in banking operations, financial institutions will need to determine which forms of control matter most for different applications. Data residency may be essential for some workloads, while model portability, operational resilience or independent governance may be more important for others. The next phase of enterprise AI adoption is likely to involve more detailed scrutiny of these trade-offs, particularly as banks connect models to sensitive information and critical business processes. The institutions that benefit most from sovereign AI will be those that understand precisely what control their chosen architecture provides, where dependencies remain and how those dependencies can be managed over time.
What this means for the industry
- Sovereign AI is more than a question of geography. In-country inference can support data residency objectives, but it does not automatically provide ownership or independent control of AI models and supporting infrastructure.
- Banks need to examine the entire AI architecture. Data retrieval, logging, model management, security controls and connected enterprise services can introduce dependencies beyond the location where inference takes place.
- AI concentration risk is becoming a strategic consideration. Financial institutions may reduce certain geographic dependencies while remaining reliant on a small number of global model and infrastructure providers.
- Model governance will become increasingly important. Banks need appropriate control over updates, testing, monitoring and the behaviour of AI applications connected to operational systems.
- Portability could become a differentiator for technology vendors. Providers offering flexible deployment options, secure integration and the ability to support multiple models may appeal to institutions seeking greater long-term control.
- Local infrastructure introduces commercial trade-offs. The benefits of in-country AI processing must be assessed alongside infrastructure costs, operational responsibilities and the availability of alternative technologies.
- Operational independence will be the real measure of sovereignty. Banks need to understand whether they can maintain, recover or replace important AI services when existing technology arrangements are disrupted.
Image Source: Pexels.com
