How to Evaluate a Sovereign AI Infrastructure Proposal

A government can put AI servers inside its borders and still have very little control over the system that matters. The accelerator vendor may control firmware updates; a cloud layer may make workloads difficult to move; foreign support staff may be essential during an incident. That is why a sovereign AI proposal needs a harder test than data location alone.

Editorial illustration from a Pexels photograph by Andrey Matveev. It does not depict Malaysia, Skyvast, a government AI system, or a specific accelerator.

Malaysia offers a useful case for this distinction. Its Ministry of Digital announced a 2025 memorandum between Huawei Malaysia and Skyvast Cloud for a proposed sovereign AI cloud using Huawei Ascend GPUs, Kunpeng servers, cloud platforms, and networking. Soon after, the trade ministry said that initiative was privately driven, not government-endorsed, and that significant public AI infrastructure would require legal, operational, and reputational due diligence. Those are compatible facts: an MOU can show what a supplier stack offers without proving that a national procurement has been approved.

The practical question for any government is not whether one vendor represents independence from another. It is whether the state can inspect, operate, adapt, and eventually replace the system while protecting the data and services it runs.

Define sovereignty as five controls

Start with data control. Which workloads may enter the environment? Who holds encryption keys, audit logs, and administrator credentials? Where do backups, telemetry, model weights, and support tickets go? A domestic data centre helps, but it does not settle those questions. A credible design separates data classifications and makes privileged access observable and revocable.

Next is technical control. Procurement should identify the dependencies below the application: accelerators, servers, networking, drivers, orchestration, model-serving software, and update channels. A vertically integrated stack can make a first deployment faster. It can also increase the cost of switching later. The right comparison is not a benchmark chart; it is the work required to run the intended models, train local staff, patch vulnerabilities, and migrate a service without losing records or uptime.

Third is legal and supply-chain control. Buyers should document the origin of relevant components, maintenance commitments, export-control obligations, and the parties that can block financing, insurance, support, or replacement parts. In May 2025, the US Bureau of Industry and Security named Huawei Ascend 910C in guidance on PRC advanced-computing ICs and warned that General Prohibition 10 can create risk when there is knowledge of an export-control violation. That guidance is not a substitute for legal advice, nor does it prove that every foreign use is unlawful. It is a reason to require supplier documentation, independent compliance review, and clear allocation of risk before a system carries public workloads.

Fourth is operating control. A sovereign system needs more than a local building and a vendor training session. Public operators need incident playbooks, monitoring access, tested backup restoration, patch windows, and authority to refuse remote access. They also need enough engineers who can work across the stack rather than only follow a supplier's escalation path. Otherwise, a domestic installation remains dependent on an external operations team at the moment of greatest pressure.

Fifth is exit control. Ask at the beginning how a ministry will leave. Can data, logs, model artefacts, prompts, and evaluation records be exported in documented formats? Can applications use portable interfaces? Is there a funded migration plan, a maximum support response time, and a contractual handover of operational documentation? Exit clauses are not a sign that a project is expected to fail. They are what make supplier competition useful after the contract is signed.

Match the stack to a limited first workload

The fastest way to hide risk is to call a project a national AI platform before anyone has defined its first workload. Begin instead with a narrow service: document search over a controlled corpus, a multilingual public-information assistant, or an internal classification workflow. Define the data sensitivity, acceptable error rate, throughput, offline requirements, human review, and recovery objective. Then test candidate stacks against that specification.

This matters because sovereignty has costs. Running several vendor environments can increase resilience and bargaining power, but it also creates skills, integration, and governance overhead. A single-stack design can simplify support but should not turn one company's proprietary interfaces into the only route to a public service. The decision is a portfolio choice, not a symbolic vote for a technology bloc.

Malaysia's National AI Action Plan for 2026–2030 explicitly pairs data and compute foundations with governance, talent, research, and locally developed capability. That framing is useful beyond Malaysia. Compute capacity is necessary for some public AI work, but it becomes national capability only when institutions can govern it, people can operate it, and applications can survive a supplier change.

Turn due diligence into acceptance tests

Before an award, require the bidder to demonstrate the intended workload with the actual model, language mix, security controls, and operating team—not a generic benchmark. Run an access-control exercise, a restore drill, and a staged failure test. Measure the time to export data and redeploy the service elsewhere. Review the bill of materials, support path, software licences, and update process with security and legal teams that can reject the proposal.

After award, publish the non-sensitive parts of the decision: workload scope, governance owner, audit arrangements, data-residency rules, and performance measures. Transparency does not require exposing a country's security architecture. It does make it possible to distinguish a carefully governed service from an infrastructure announcement.

A sovereign AI proposal can be worthwhile without promising complete technological self-sufficiency. The reliable standard is more concrete: the government should know what it depends on, be able to operate and audit critical services, and retain a credible path to change course. That is the kind of control a server location alone cannot deliver.