Sovereign and air-gapped AI: why regulated institutions need purpose-built foundations.

One point keeps coming up in conversations about regulated technology: resilience is not the same thing as availability.

Financial institutions have benefited enormously from hyperscalers, SaaS platforms and specialist AI providers. I am not arguing for a retreat from them. They have accelerated innovation, reduced the cost of experimentation and given smaller firms access to capabilities that would once have required huge internal technology estates.

But convenience can become dependency quietly.

The real question is not “cloud or no cloud?”. It is: what do you still need to control when somebody else's infrastructure, policy or jurisdiction becomes part of your operating model?

That matters more as AI moves from a productivity tool to something closer to an operating layer. If models are summarising internal information, interpreting documents, supporting decisions, orchestrating workflows or eventually taking controlled actions, the institution is no longer outsourcing only compute. It may also be outsourcing parts of its intelligence layer.

Regulated firms need a more deliberate boundary

For an investment manager, bank, insurer, market infrastructure provider or asset servicer, the boundary should be explicit. Which data may leave the institution? Where can models run? Who can administer the environment? What happens during a connectivity failure, geopolitical disruption, vendor policy change or cyber incident? Can the most sensitive workloads continue to operate independently?

This is where sovereign and air-gapped infrastructure becomes strategically interesting. It is not simply another security label. Done properly, it can provide local control over data, models, infrastructure and operations, while still allowing institutions to use sophisticated modern AI capabilities.

Why the Airtel model is worth watching

Airtel Business now offers Google Distributed Cloud air-gapped in India. Airtel describes the environment as able to run advanced AI completely offline, with data residency and sovereignty in India. Google describes the underlying GDC air-gapped model as fully disconnected from Google Cloud and the public internet, with Gemini and other AI services available on-premises.

The current Airtel proposition is particularly aimed at government, defence and other highly sensitive environments. That distinction matters. I would not pretend the same deployment model should simply be copied into every financial institution.

But the architecture demonstrates something important for regulated finance: advanced AI and sovereign operational control are no longer mutually exclusive.

The answer is probably hybrid, not ideological

The future is unlikely to be “everything third-party” or “build everything yourself”. The more practical model is tiered.

Use global cloud and specialist platforms where they genuinely improve economics and capability. Keep the most sensitive data, decision workflows and critical intelligence within environments whose operational, jurisdictional and security boundaries are understood. And design portability, continuity and exit into the architecture before they become urgent.

That changes the technology conversation. Sovereignty stops being only a compliance question and becomes part of operating-model design.

For boards and executives, I think the useful question is becoming:

Where should our most sensitive intelligence actually live — and what must still work if the public cloud does not?

That is a much more consequential question than whether a platform can call itself cloud-native.