You were sold sovereignty, and then you were quietly asked to choose. Pick the AI that is actually good at the work, or pick the one you can actually verify - but not both, because the option that is both does not exist for sale yet, and almost nobody selling to you will say so out loud.
That is the sentence under every “sovereign AI,” “private AI,” and “enterprise-grade trust” pitch landing in your inbox this quarter. The pitch says you no longer have to trade capability for control. The market underneath the pitch says you still do. NTT DATA’s 2026 survey found 95 percent of organizations call private and sovereign AI important and 29 percent are doing anything concrete about it. That gap is not laziness. It is the shape of a market that is selling a cell that is empty.
Here is the map that makes the empty cell visible.
Two axes, four cells
Draw a square. The horizontal axis is capability: how good is the AI at the actual work, from weak on the left to frontier on the right. The vertical axis is trust type: what kind of trust its delivery asks of you.
The trust axis is the one nobody draws for you, so draw it carefully. At the bottom sits policy-trust: a promise you have to accept. The vendor says your data is safe, the model is fair, the logs are honest, and you believe them because the terms of service say so. At the top sits architectural-trust: a property you can check. The system is built so that an outsider who does not take the vendor’s word can confirm the claim for themselves. This axis is not how much verifying you happened to do. It is which kind of trust the architecture forces on you - a promise you can only accept, or a property you can discharge by looking. Policy-trust is “we would never.” Architectural-trust is “you can look.”
Four cells fall out of those two axes. Three of them are full. One is empty, and it is the one you want.
Cell one: capable, and take our word for it
This is where almost everything lives, and where you almost certainly are right now.
The mainstream consumer AI you and your team actually use every day is powerful and improving monthly. It is also, on the plans most people run, pure policy-trust. Anthropic’s consumer privacy policy, in effect since July 8, 2026, reads: “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings. Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review.” Read the second sentence twice. You opted out, and they wrote an exception into your opt-out, and you agreed to the exception the day you accepted the terms. That is what a promise is worth to you here: exactly as much as the next revision decides it is.
Google’s Gemini Apps tells consumers plainly that “a subset of chats are reviewed by human reviewers,” and that those reviewed chats “are not deleted when you delete your activity. Instead, they are retained for up to three years.” You press delete. A person has already read it, and your delete does not reach them. OpenAI’s consumer ChatGPT is the same shape by its own documentation: a control it named “Improve the model for everyone,” on by default for Free and Plus users, that you have to find in Data Controls and switch off to stop your chats training the model. The name is doing work. You are improving the model for everyone whether you meant to or not, until you go looking.
None of this is hidden. All of it is policy-trust. You are trusting a promise that the setting works, that the flag is narrow, that the reviewer is careful, that the retention expires when they say. The AI is genuinely good. What you can verify about how it treats you is close to nothing.
There is an exit door inside this cell, and it is worth naming precisely so nobody sells it to you as more than it is. Move to a business, enterprise, or API tier and these same vendors stop training on your traffic by default. That is a real improvement. It is also still policy-trust - a better promise, not a property you can check. A stronger contract is not architecture. Do not let anyone relabel the exemption tier as “sovereign.” It is the same cell with a nicer clause.
Cell two: verifiable, and not very good
Now the top-left. Here trust is a property you can confirm, and capability is thin.
A printed checklist you score by hand is the purest architectural-trust object in existence. It collects nothing, phones nowhere, and cannot leak what it does not hold. You can verify every word because every word is in front of you. It also cannot write your incident report, triage your tickets, or reason across a thousand documents. A rule-based script you wrote yourself has the same shape: fully inspectable, fully yours, and narrow.
Small local models are the live edge of this cell, and they have climbed fast. A 3-to-14-billion-parameter model running on your own hardware now matches much larger models on targeted tasks - Microsoft’s Phi-4, at 14 billion parameters, reaches reasoning and code performance comparable to models many times its size - and it runs where you can watch it. For classification, extraction, and summarization at volume, that is often enough. For open-ended reasoning, long context, and the frontier work that made you want AI in the first place, it is not yet close. You bought verifiability and paid for it in capability.
The most serious attempt to climb out of this cell is worth studying, because it shows how hard the climb is. Apple’s Private Cloud Compute publishes, in its own words, “the measurements of all code running on PCC in an append-only and cryptographically tamper-proof transparency log,” and commits that “every production Private Cloud Compute software image will be published for independent binary inspection.” That is architectural-trust done seriously: not “trust us,” but “here is the log, here are the binaries, check us.” It is the closest anyone has moved a real product toward the top-right. And it still does not land there. The capability is bounded to Apple’s own workloads - it runs first-party software, not your agent. The best architectural-trust story on the market is not yet a general, capable, open agent you can point at your hardest work. It proves the axis is real. It has not filled the cell.
Cell three: weak, and take our word for it anyway
The bottom-left is the cell nobody advertises and plenty of teams are stuck in. Tooling that is neither good at the work nor checkable - legacy systems and thinly-wrapped models that ask for your trust and your data and return little for either. It is the worst of both axes, and the reason it persists is that switching costs are real and the replacement is not obviously better on the axis that would justify the move. I am naming the cell rather than a vendor, because the point is not to pillory a product. The point is that “we must trust it and it barely works” is a place, and if it is your place, you should be able to see it on the map and leave.
Cell four: the one you want, and cannot buy
Top-right. High capability and architectural-trust. An AI good enough for your real work, built so an outsider who does not take the vendor’s word can verify how it behaves, what it keeps, and what it refuses.
It is empty. Not sparse. Empty of a frontier-capable, openly-verifiable, general agent you could point at your hardest work today - at any scale that matters, for anyone shopping.
We know how empty it is because we tried to stand in it ourselves and could not. This week we published our own sovereignty instrument’s score against itself. As a written methodology it sits in the top-left, verifiable and safe. As a working tool it runs on consumer AI infrastructure and drops to Progressing - a 77 - inheriting the exact policy-trust failures in cell one, because that is the only cell the delivery layer had to stand in. We could not put our own instrument in the empty cell. That is not a confession. It is the strongest evidence we have that the cell is empty even for people building toward it on purpose.
Why the cell is empty, and what fills it
The cell is empty because filling it is a different kind of work than making models better. Capability comes from scale and training. Architectural-trust comes from building the system so its own behavior is provable to someone outside it - the log an auditor can read, the refusal an outsider can confirm fired, the identity that cannot be quietly swapped, the retention that expires because the architecture expires it and not because a policy says it should. Those are not features you add to a capable model. They are a substrate you build under it, and the frontier labs have spent their effort on the first axis because that is what the benchmark rewards.
That substrate is the work we are pointing our own build at. I am not going to tell you it is finished, or claim the cell is filled, because it is not - not by us, not by anyone. Naming the shape of the empty cell is the honest first move, and it is the one the market keeps skipping, because a named empty cell is a promise nobody can yet keep and every “sovereign AI” pitch depends on you not noticing it is empty.
So do the noticing yourself. Take the AI stack you already run and place it on the map. How good is it, honestly, at the work you need. And what could you actually verify about it if a regulator, a customer, or your own board asked you to prove it - not promise it, prove it. Most stacks land in cell one and their owners believed they had bought cell four. The distance between those two cells is the distance between a guarantee and a costume of one.
You can run half of that placement for free right now. Our sovereignty checklist scores the trust side of this map by hand, with nothing leaving your desk - 47 questions about what your stack is honest about, what it collects, what you can verify and what you can only take on faith. It will not rank your capability; you already know that axis. It will show you, item by item, how much of your trust is a promise. Count those before someone sells you the empty cell.
Score your own stack against the free sovereignty checklist - 47 questions, no email, no account, nothing leaves your desk. It scores the trust side of this map, not your capability: every item you cannot verify is a place you are running on a promise. We would rather you counted those yourself than took our word for the map.
Sources: Anthropic, consumer privacy policy, anthropic.com/legal/privacy (effective 2026-07-08, verified July 2026); Google, “Gemini Apps Privacy Hub,” support.google.com/gemini (verified July 2026); OpenAI, “Data Controls FAQ” and “How your data is used to improve model performance,” help.openai.com (the “Improve the model for everyone” setting; verified July 2026); Apple, “Private Cloud Compute: A new frontier for AI privacy in the cloud,” security.apple.com/blog/private-cloud-compute; NTT DATA, 2026 Global AI Report on private and sovereign AI; small-model capability per Microsoft’s Phi-4 and Phi-4-reasoning technical reports (arXiv 2412.08905 and 2504.21318, 2024-2025). Provider policy points verified current as of July 2026.
Licensed under Creative Commons Attribution 4.0 (CC BY 4.0). Free to use, share, and adapt with attribution to Erin Stanley, Evoked.
The map is free. The empty cell is the point. Draw your own stack onto it before you buy your way into the corner someone else labeled sovereign.