By Sam Greenwood, MLOps Tech Lead at Fuzzy Labs
A lot of teams are building systems on models they don’t own and can’t control. With export controls, chips and data centres in the news every week, what was once a technical detail is now becoming a business risk.
That was the topic at our latest MLOps.WTF meetup: AI sovereignty.
We had a great panel in front of a packed room:
Matt Squire, our CTO and co-founder, hosting
Shahel Khan, AI researcher at i.AI, the government’s Incubator for AI
George Drayson, co-founder and chief AI officer at Locai Labs
Matthew Wilkes, technical director at Hippo
Harry Schone, deputy director at Police.AI
Matt Squire started by setting the scene - the public sector, healthcare, finance and defence are all adopting AI fast, and the UK could end up relying entirely on other countries for it. That’s fine while everyone gets along, but only a few months ago the US briefly stopped people outside the country from using certain models. So what happens next time, and could open source give us a way out?
Here’s what I took away.
What does sovereign actually mean?
Shahel suggested working backwards from what a country needs - confidence that it can keep delivering national security, a stable economy and public services. For him, sovereignty means being able to use the technology on your own terms, with some leverage somewhere in the supply chain.
But the supply chain is long, from research, chip makers, data centres, cloud providers, then the models themselves. Nobody can win at every layer, so the question becomes where a country with limited money gets the most leverage.
If a provider switches a model off tomorrow, how quickly can you move to another one? Have you tested whether the alternative works for your use case? From his days working in startups, he reckons most teams build on one provider, and very few have a backup plan.
He also mentioned some European Commission work that splits sovereignty into four levels, from keeping data in the right country (level one) up to owning the whole supply chain (level four). When they mapped existing workloads, around 70% only needed level one. Under 2% needed level four, pwhich were robably things like defence.
George’s definition was a bit shorter - “Can someone else turn it off, and does someone have control over its outputs?”
By that test, a lot of “UK” AI fails. If your model runs in a US-owned data centre, the US CLOUD Act means your data can be accessed without you even being informed. And if you don’t fully control the servers, then someone else can switch them off at any point.
The case of the disappearing model
Harry from Police.AI started explaining what they actually do. People tend to assume it’s predictive policing, but most of the work is back-office, like summarising case files (something we’ve been working on with them), searching hours of CCTV and redacting body-worn video. Right now, redaction often means an officer blurring faces frame by frame. Taking that off officers’ plates saves a huge number of hours, does a lot for their wellbeing, putting them back on front-line policing duties.
He told a story about a system that had been running on a GPT-4 model when OpenAI then went and retired that model earlier than planned. The only option was to move to GPT-5, pay a lot more, and use a model nobody had tested on the task. A fairly simple classification task too, but when you scale that across 43 police forces in England and Wales, the lack of control can start to be costly.
“If we are deploying mission-critical systems, and those systems are vulnerable to forces outside of our control… then we need to be examining what plan B is.”
The good news is that policing mostly needs transcription, summarisation and classification, done cheaply, for lots of people. Open models already handle that very well. And when Police.AI builds something, it wants the components to be reusable rather than tied to one stack, so local forces can pick them up. That’s another piece of work we’ve helped them with.
Harry also made the point that sovereignty is about capability, not just infrastructure. A small rural force isn’t going to hire AI safety researchers, so it ends up relying on whatever Microsoft or Salesforce tell it. Running testing and evaluation nationally means forces don’t have to take a vendor’s word for it. Open source helps here too, because building a quick version yourself tells you whether a supplier’s price is justified, or whether they’re relying on the public sector not knowing any better.
AI in a box, and a UK AI grid
Locai Labs started out adapting open models for UK needs, but George said they kept hitting the same wall. Once you’ve trained a model, where do you run it? UK compute is scarce, expensive, and often sits in data centres that fail the “can someone turn it off?” test.
So they built AI in a box, an off-the-shelf computer made for running models. You buy it, plug it in and run open models on your own premises. George compared it to Apple taking computing from IBM mainframes in huge office buildings to a personal computer in everyone’s home. He still sees a place for data centres for the hardest queries, but expects more and more work to run locally.
The bigger problem is power, the UK grid has a backlog of around 125GW waiting to connect, with 75GW of that for data centres. But his idea is to use the electricity already wired into offices, which often sits idle. It’s a bit like rooftop solar at home where you can sell spare electricity back to the grid, so why couldn’t your AI box sell spare tokens while you sleep? A kind of UK AI grid, a bit like OpenRouter spread across the country.
Confidentiality, integrity, availability
Matt Squire asked Matthew Wilkes what happens if the UK gets this wrong. His answer was to go back to security basics, and it neatly tied together everything the panel had said so far.
Harry’s disappearing model is an availability problem, and the fixes are the ones George and Shahel had been describing like AI in a box, hybrid set-ups, routing between providers. Data that can be reached under the CLOUD Act is a confidentiality problem. The one that gets less attention is integrity. That’s a model that changes underneath you, or has been quietly shaped to nudge what you do with it, without you ever noticing.
The impact, he said, could be “subtle and devastating, or open and devastating, or it could be very minor”, and there’s no way of knowing in advance which you’ll get. So you have to prepare for all three.
Integrity is also where the open source debate gets interesting.
Is open source safer?
Matt Squire brought up the recent open letter, Open Weights and American Leadership, which argues the US should go open-first for reasons of trust, transparency and safety, but is it really that simple?
Matthew Wilkes, who has a long history in open source, didn’t think so. He separated open source from open weights. With open weights you can test the model, but you can’t see everything that went into it. He compared it to US export controls on cryptography decades ago. Some of those algorithms are still suspected of being tampered with, and they’re just a couple of numbers you could write on a piece of paper. An open-weights model is the same problem, only vastly bigger.
Open source projects are targets too. Matthew Wilkes has seen people try to sneak in everything from crypto miners to tiny, hard-to-spot changes. Nobody knows who’s behind them. They could be nation states, or just someone having a bit of fun. A frontier AI company worth close to a trillion dollars can afford to defend itself in ways a volunteer project can’t.
“I do think open source is the way forward. But we can’t move from closed frontier models to open source and expect all the same protections, and for it to be cheaper.”
Open source still costs something, you just end up paying in different ways like maintenance and contributions.
Shahel was even more direct. Does open source enable sovereignty? “Well, it doesn’t.” What it does is let engineers tinker with the cutting edge and build new things. With Europe holding around 5% of the world’s AI compute, the UK won’t win by building the biggest model, so it has to win by being creative. The catch, he said, is that the UK keeps losing its best researchers, and raising money here is far harder than in the US, where you “have a cup of coffee and take 10 million dollars”.
So, what if the US and China pulled the plug tomorrow?
Matt Squire’s final scenario was imagining a future where both superpowers bring in export restrictions and cut off everything we rely on. What should the UK do now?
Matthew Wilkes: have credible alternatives ready, even if they’re a step down. We already have backup options for email, documents and operating systems, they just aren’t anyone’s first choice. The aim is to slide back to a level we can live with.
George: do two things at once. Train a UK model from scratch, accepting it’ll take a while to get close to the best. Switzerland’s Apertus model, from ETH Zurich, is a good example. It’s nowhere near the frontier AI models, but at least it’s a start that is catching up. In the meantime, take existing open models and adapt them for UK use. That means shrinking huge models down to run on the hardware we have, and dealing with bias and censorship, which George argued is a problem for American and Chinese models alike, just more obvious in some. Then there’s the risk of hidden backdoors. Locai’s research team recreated a “sleeper agent” model that slips a particular API key into any code it writes once the date in the prompt is 2030, and it did so about 99% of the time. They then used a technique called activation steering to remove the backdoor while keeping the rest of the model’s behaviour, with a paper due out that week.
Shahel: the models are already good enough, but we should build the skills to run open models in-house, and above all build your own evaluation tools. Then you can test any model on your own use cases and switch when you need to. He pointed out that enterprise use of open-weight models roughly halved between 2024 and 2025, from about 19% to 10%, and not because the models weren’t good enough. Running them is the hard part.
Three different answers, but they all had a thread of having the control to switch.
Questions from the room
It was time to open questions to the room. One person asked why UK industry uses so much open source but gives so little back, especially compared with France. There, banks, energy firms and retailers back shared sovereign infrastructure, and someone in the room mentioned French public bodies moving off Microsoft Office. The panel agreed government needs to lead by example. Matthew Wilkes added that the market needs a nudge, because people will always reach for the easiest option.
Another attendee, speaking from the government side, shared a cautionary tale. They’d looked at a UK “sovereign AI” supplier, then discovered it was funded by US venture capital. What happens if you use that model and they’re bought out two months later?
Our very own Ruby asked about the recent press scare stories over people running open-weight models on their own laptops, stripping out the guardrails and asking for help with genuinely harmful things. George argued that US frontier labs are pushing that story partly to protect their position, and that leaving the guardrails solely to OpenAI and Anthropic means the UK has no say. His examples cut both ways. When Hugging Face was attacked using an OpenAI model, they couldn’t use OpenAI to investigate because its guardrails kept refusing, so they used a locally hosted GLM 5.2 model instead. And when Anthropic accidentally released the Claude Code source, people inspecting it found prompt injection issues that were then fixed. Shahel was more cautious - anyone can poison an open model, re-upload it under the same name and tune it to pass your benchmarks. He’d recently met HiddenLayer, a startup working on ways to spot exactly that.
The last question asked whether the genie is already out of the bottle, given services like our GP are already sending personal data to foreign servers. Matthew Wilkes answered with a proverb - “The best time to plant a tree was 20 years ago. The second best time is now.”
What I took from the evening
Map your model dependencies. For every model in production, know who can turn it off and what you’d switch to.
Own your evals. If you can’t test a replacement model on your own task in an afternoon, you’re locked in.
Build for routing. Keep the model behind an interface so swapping provider is a quick config change.
Right-size the model. Most production work is summarisation, classification and extraction, and an open model you control often does the job.
Treat open weights like any other dependency. Check where they came from, pin versions, and test before you trust.
Give back. Open source only keeps going if the people using it contribute.
A lot of sovereignty comes down to everyday engineering choices, like which models we use, and how easily we can swap them.
Thanks to Shahel, George, Matthew and Harry for a brilliant discussion, and to the people I met on the night.
Come and join us: If these are the problems and conversations you’d like to spend your days on, Fuzzy Labs has open senior engineer and lead engineer roles. See the roles, or come and say hello to me at the next MLOps.WTF.