Article

Sovereignty is a vendor question, not just an infrastructure one

September 18, 2026

AI and model risk almost never fits in one box. A biased credit model is a model problem. The data feeding it is a data problem. The vendor hosting it is a third party problem. The pipeline moving it is a cyber problem. One AI system can trigger all four at the same time.

That is why more and more banks now treat AI risk as one connected, company-wide risk, instead of leaving it with a single team. It sits next to things like cyber risk and operational risk, not tucked away under model risk alone.

One part of that risk has been growing fast: data and technology sovereignty.

Why sovereignty is about more than just where your data sits

Most people hear "sovereignty" and think of one thing: where the servers are. That matters, but it is not the whole picture. For AI and models, sovereignty raises several very real, practical questions.

Can foreign laws reach your data?

Even if your data sits inside your own country, laws such as the US CLOUD Act can, in some cases, still give foreign authorities a way to access it. For banks working under EU or Canadian rules, that is not a theory. It is a real gap that legal and compliance teams increasingly have to explain and close.

Can you protect your models?

Your credit scoring models, trading algorithms, and forecasting tools are not just code sitting on a server. They are years of work, tuning, and data that give you a real edge over competitors. If a model, or the data used to build it, ever ends up inside someone else's system or training pipeline, you cannot get that advantage back.

Can a vendor or a country change the rules on you?

Trade disputes, a vendor suddenly changing its policy, or a service quietly being shut down: any of these can disrupt your risk operations overnight. Most risk teams plan carefully for market shocks. Far fewer plan for a vendor decision made in a different country suddenly changing what they are allowed to do.

Can you see everything, and prove it, whenever someone asks?

Validators and regulators do not just want your word that a model works. They want to check it themselves, line by line: the code, the data, every step in between. On top of that, you need to keep your risk logs, sign-offs, and performance history safe, complete, and easy to find, for years, not scattered across five different tools and inboxes.

‍

What sovereignty actually demands

One thing, really: control you can point to, not control you assume you have. Which models are running. Who validated them. What happened to them since. And whether you would still have access to any of that if your vendor's home country changed its mind tomorrow.

That is not something you get by picking the right country on a map. It comes from good governance: knowing exactly which models you have, where they run, who signed off on them, and what they have done since. Having that in one place, not spread across five systems. Having an audit trail nobody can quietly edit. Having a track record that holds up whether it is a validator, a regulator, or your own board asking the hard question.

Sovereignty raises the question. Governance is how you answer it, and this is where your choice of software vendor matters too, not just your infrastructure. Where your vendor is based, and how much say you have over that relationship, shapes how much you can honestly promise your own regulator.

That is the real difference. European and Canadian firms do not just need better governance on paper, they need a vendor who can actually back it up. Yields is based in Europe. When sovereignty is a hard requirement, we can run the platform on EU or Canadian infrastructure for that client specifically. Not every vendor in this space can say that.

‍

About the

Author(s)

Efrem Bonfiglioli

Model Risk Management Expert

Efrem Bonfiglioli is a seasoned model and AI risk management professional with a passion for advising model developers and validators on best practices for effective model and AI use case management. He has held various roles related to model risk management across multiple lines of defense in leading global banking institutions, covering a wide range of asset classes and risk types. Efrem is a visiting professor at universities in Italy and the UK where he teaches courses ranging from foundational financial subjects to advanced quantitative modelling. He earned his PhD in Financial Mathematics, where he focused on researching the applications of jump-diffusion models in the context of derivatives pricing.

Jos Gheerardyn

CEO and Co-founder

Jos Gheerardyn is the co-founder and Chief Executive Officer (CEO) of Yields. Prior to his current role, he worked as both a manager and an analyst in the field of quantitative finance. With nearly 20 years of experience, he has worked with leading international investment banks and start-up companies. Jos is the author of multiple patents that apply quantitative risk management techniques to the energy balancing market. Jos holds a PhD in superstring theory from the University of Leuven.

Get a guided tour of our Model Risk Management platform and its key capabilities.

Schedule a walkthrough