If regulated data cannot leave a jurisdiction, what about the AI models trained on it? In the second part of its data sovereignty series, Computer Weekly put this and other forward-looking questions to ten storage and backup vendors and a lawyer. Alexander Lefterov, Founder and CTO of Tiger Technology, was one of the interviewed experts. Below is a summary of the key points.
Does an AI model inherit the sovereignty of its training data?
The interviewed experts agreed that it does. Model weights and embeddings carry the sovereignty of the data they came from. The same applies to RAG pipelines and inference outputs. This means training, fine-tuning and inference need to stay inside the same jurisdictional boundary as the source data, and some experts expect this to become an explicit requirement in regulated-industry tenders within a year.
What does real control over data look like?
Alexander Lefterov defined real data control through four conditions. Organizations must be able to:
- Know where their data is.
- Decide what happens to it at every stage of its lifecycle.
- Recover it without depending on a single vendor.
- Prove all of this to an auditor.
In his view, most backup and cloud-first models today fail on at least two of the four, so organizations should start by governing the control plane and establishing clear data visibility and lineage.
How Tiger Bridge maps to the four conditions
The four conditions are a useful test to run against any storage architecture, including ours. Here is where Tiger Bridge sits against each.
Know where your data is. Tiger Bridge is jurisdiction-aware by design: you define where each data category lives and it routes files to the chosen target automatically, with compliance status visible in real time rather than reconstructed during an audit.
Decide what happens at every lifecycle stage. Placement, replication and tiering are driven by user-defined policies rather than by a provider's defaults, so the lifecycle rules stay with the organization that owns the data.
Recover without depending on a single vendor. Tiger Bridge connects every major EU cloud and runs alongside the infrastructure you already own, so the recovery path does not pass through one provider's control plane. That independence is the point of the condition, not a side effect.
Prove it to an auditor. Real-time compliance monitoring and file versioning mean the evidence exists continuously, instead of being assembled after the fact.
Why are sovereignty SLAs the next procurement requirement?
The experts Computer Weekly spoke to see data sovereignty moving from a compliance cost to a competitive advantage, as AI makes proprietary data more valuable. The next step is contractual. Procurement teams are expected to demand sovereignty SLAs that cover jurisdictional exposure and control-plane independence alongside uptime. Alexander Lefterov expects these within 18 months and advises organizations to start asking their vendors for sovereignty SLA commitments now.
"Organisations cannot protect or control data they do not understand."
Alexander Lefterov, Founder & CTO, Tiger Technology
Read the full article on Computer Weekly: Sovereignty's next chapter: Why AI makes sovereignty a competitive advantage
This is part two of Computer Weekly's two-part series on data sovereignty. Read our summary of part one: The Cloud Region Myth: Why Data Sovereignty Isn't About Where Your Server Sits
Also published in
The two-part analysis was picked up across Europe and the Middle East:
- Manage IT (Germany) — Datenresidenz und Datensouveränität im Zeitalter der KI
- CyberSecurity News (Belgium) — Why the geographical choice of a cloud is no longer a sovereign strategy with AI
- Digitalisation World (UK) — part one and part two
- Silicon Valleys Journal — part one and part two
- Tech Novice (German) — Datensouveränität im Zeitalter der KI: Warum der Speicherort allein nicht reicht
- Storage Insider (German) — Der reine Speicherort ist nicht entscheidend