Sovereign AI in the UK: What It Means, and How to Keep Your AI and Data Under Your Control

UK sovereign AI has two meanings. For the government, it means backing British AI companies through the £500 million Sovereign AI Unit, and building more computing power in the UK. For your organisation, it means knowing where your prompts and documents are processed, who operates the AI service and whose laws can reach it.

This guide covers both. It explains what the national programme has done so far, how Microsoft Copilot handles your data and when a private model makes sense. It ends with what to ask before you run AI on a public service, a hyperscaler platform or a UK sovereign cloud.

What is sovereign AI?

Sovereign AI is AI capability that a country or an organisation can direct for itself, with the models, the computing power and the data under its own control. The UK government’s Compute Roadmap puts it carefully: “we do not define sovereignty as isolation or self-sufficiency”.

Instead, the Roadmap describes sovereignty as the ability to act independently where it matters most, including to protect sensitive data. It wants the capacity built through programmes like the AI Research Resource and AI Growth Zones to be physically located in the UK.

Two related terms come up often. Data residency is where your data is stored. Data sovereignty asks whose laws can reach it, which depends on who holds the data as well as where it sits.

The same idea works for a single organisation. You do not need to build your own model to have sovereign AI. You need to know where your data goes when you use AI, keep the sensitive parts on infrastructure you control, and be able to move if the terms change.

What is the UK government doing about sovereign AI?

The government is backing sovereign AI in three separate ways. Sovereign AI, a £500 million unit, invests in British AI start-ups. A programme of up to £2 billion to 2030 builds public computing power. AI Growth Zones help large AI data centres get built. All three trace back to the AI Opportunities Action Plan of 13 January 2025.

The Sovereign AI Unit’s website calls it the UK Sovereign AI Fund and describes its offer as early-stage equity investment of up to £10 million. Its focus is on British AI companies, not on the AI that most organisations buy.

What has the UK Sovereign AI Fund backed so far?

By 3 August 2026, Sovereign AI had made five equity investments and backed 11 start-ups in total, including some that received computing time only. Its bets are on AI chips, AI infrastructure, new kinds of model, materials and life sciences. On 31 August 2026 the government also launched the first competitions in a £100 million Sovereign AI scheme through which public bodies buy from British AI companies.

The fund’s own FAQs name Callosum, Ineffable Intelligence, Isomorphic Labs and CuspAI as portfolio companies. They say equity is typically between £1 million and £10 million. Companies must have, or commit to building, a significant UK presence.

Can a UK business get support from Sovereign AI?

Yes, if it builds AI rather than only using it. Sovereign AI backs early-stage AI companies with a significant UK presence, mainly through equity. Other routes, such as public compute and government procurement, are open to firms the fund has not invested in. Check each route’s own page for current terms, as they change.

The UKRI page for Sovereign AI series one shows the competition opened on 11 August 2025. Watch UKRI and GOV.UK for any second round rather than relying on older listings.

For most organisations, the more pressing question is where their own AI use runs. The rest of this guide covers that.

What are AI Growth Zones and sovereign compute?

AI Growth Zones are sites where the government helps with planning and access to power, so that large AI data centres can be built in the UK. Sovereign compute is the wider aim: AI computing power that sits in the UK and can be pointed at national priorities. The AI Research Resource is the public part of that capacity.

The scale is large. In July 2025 the Compute Roadmap forecast that the UK will need at least 6 gigawatts (GW) of AI-capable data centre capacity by 2030, about three times the UK’s total data centre capacity at the time. Its goal is a core group of sites that can each serve at least 500 megawatts (MW) by 2030, with at least one zone passing 1 GW.

The Roadmap also makes a point that matters for any organisation planning AI. Training a model is “generally less dependent on location”, it says, while inference may benefit from being close to data sources or users. Inference is the step where a trained model answers a prompt, and it is the step most organisations run every day.

The AI Research Resource is the government’s own AI compute. Its GOV.UK page, updated on 28 September 2026, lists two systems: Isambard-AI at the University of Bristol and Zenith at the University of Cambridge. Access is by application, through a Gateway route for researchers and a Rapid Access route for small and medium-sized organisations.

Where does your data go when you use public AI services?

When you type a prompt into an AI service or let it read your documents, that data is processed by the provider, somewhere. Four things decide how sovereign that is:

1. Where the processing happens. Some services let you choose a country or region, and some send each request wherever they have capacity.
2. Who you contract with. If the provider is established outside the UK, sending it personal data is a restricted transfer under UK GDPR. Our guide to international data transfer agreements explains what that involves.
3. Who owns the provider. A UK region of a US-owned service still belongs to a company that US law can reach, including through the CLOUD Act.
4. What happens to the data afterwards. How long prompts and outputs are kept, whether they are used to train models and who can see them are set by the service terms you agree to.

Each of these is a question of data sovereignty. AI tools add a complication of their own, because they copy your data into prompts and outputs, and often into logs and search indexes as well. Each copy can sit somewhere different.

Staff choices matter too. The NCSC wrote about “shadow AI” on 7 September 2026: staff using AI tools their employer has not approved. Information given to an unapproved AI tool may be stored, retained or used to improve the service, outside your security and governance arrangements, unless specific privacy controls are in place. The NCSC expects shadow AI to persist, and advises giving staff approved tools that meet their needs.

None of this puts public AI services off limits. It means you should sort your AI use by sensitivity, and keep the most sensitive work where you control it.

How does Microsoft Copilot data residency work, and does Copilot store your prompts?

Yes, Copilot stores your prompts and its responses as an activity history. The record is encrypted and kept under the same contractual commitments as your other Microsoft 365 content. Microsoft says it does not use them to train its foundation models. Where the AI processing happens is a separate question. For UK customers, Microsoft expects to offer local processing by the end of 2026.

Microsoft has renamed Microsoft 365 Copilot as Microsoft Copilot. Its privacy and security page, last updated on 18 August 2026, makes these points:

• The stored record includes each prompt and response, with citations to the sources Copilot used. Admins can search it, and can set retention policies in Microsoft Purview.
• Your prompts and responses are not used to train foundation large language models, and nor is the data Copilot reaches through Microsoft Graph.
• Copilot became a covered workload in Microsoft’s data residency commitments on 1 March 2024.
• Customers outside the EU “may have their queries processed in the US, EU, or other regions”. The UK is outside the EU.

That last point is what Microsoft’s in-country processing plan addresses. In an update on its blog dated 3 April 2026, Microsoft said it expects local inferencing for Copilot interactions to become available in the United Kingdom by the end of 2026. Its original announcement in November 2025 had aimed for the end of 2025.

On the Microsoft 365 roadmap, the local inferencing item, which covers the UK, was still “In development” when last changed on 23 September 2026, with general availability listed as December 2026. Until it arrives, record Copilot in your data protection impact assessment with the processing locations Microsoft states today. Then recheck them when the change goes live.

Which AI work should stay on infrastructure you control?

Start with the data, not the tool. A simple way to sort AI use is by what goes into the prompt, and by what the AI is allowed to read.

The last row is where sovereign AI matters most. Law firms and defence suppliers hold data their clients expect them to keep under tight control. So do health researchers and public bodies. For that work, a model running in a UK data centre, operated by a UK provider whose staff and sub-processors are also in the UK, keeps the data and the answers in one place you can account for. That is the practical core of sovereign AI.

UK law does not require AI processing to stay in the UK. Government guidance on multi-region cloud even allows OFFICIAL data, including OFFICIAL-SENSITIVE, to be processed overseas when the legal, data protection and security conditions are met. The case for keeping sensitive AI work in the UK is about control and jurisdiction risk, and about what your own clients expect.

What are private, local and self-hosted LLMs?

A large language model (LLM) is the kind of AI model behind chat assistants. A private LLM runs only for your organisation, rather than as a shared public service. A self-hosted LLM is one your own team installs and runs. A local LLM runs on your own computer or network. All three aim to keep the model and its prompts inside a boundary you can define and check.

The terms overlap, and suppliers use them loosely, so ask what each one means in the contract. In practice:

• Private LLM hosting means a provider runs the model for you on infrastructure set aside for your organisation, rather than as a shared public service. Terms vary, so ask whether the GPUs are dedicated to you or shared.
• A self-hosted LLM is one your own team installs and runs, on your hardware or on servers you rent.
• A local LLM usually means a smaller model that runs on a workstation or a single server, with no need to send prompts over the internet.

Most private set-ups use open-weight models. These are models whose trained parameters, called weights, the developer publishes for anyone to download. Each comes with its own licence, and the licence decides how you may use it commercially, so read it before you build. Running a private model no longer means training one from scratch.

When does running your own model make sense? These rules of thumb help:

1. The prompts, or the documents the AI reads, include data you would not put into a public service.
2. Your clients or contracts require you to say exactly where AI processing happens and who can access it.
3. You need the same model to behave the same way for years. Microsoft, for example, says the models behind Copilot are regularly updated.
4. Your use is steady and heavy enough that fixed capacity could cost less than paying for each request.

If none of these applies, a business AI service that you have checked is usually the simpler choice.

Should you use a public AI service, private LLM hosting or on-premises AI?

Use a public AI service for general work with no sensitive data. Choose private LLM hosting when sensitive data must stay in UK jurisdiction and you do not want to run your own data centre. On-premises AI suits organisations that already have data centre space and the skills to run GPU servers. Many organisations end up using more than one.

The middle column needs care. On Microsoft’s Foundry platform, for example, “Global” deployments may be processed in any Azure region. Data Zone deployments stay within the US, the EU or Asia Pacific. Deployments tied to one geography arrive last for new models, with no guaranteed date, so picking a UK region for storage does not always fix where the model runs.

What does a sovereign AI architecture look like?

A sovereign AI set-up keeps every part of the system where you can account for it, from the model and its GPU servers to the logs and backups. Each part can create a copy of your data somewhere new. So give each one a location and an owner, and decide who can reach it.

Many business AI tools use retrieval-augmented generation (RAG). Before answering, the system searches your own documents and passes the relevant passages to the model. The search index, often a vector database of “embeddings” (numbers that represent the meaning of your text), is derived from your documents. Protect it as you would the documents themselves.

To design one, work through these steps in order:

1. Map the data: list what users will type in and what the AI will be allowed to read.
2. Classify it, using the sensitivity table earlier in this guide.
3. Choose where each component runs, starting with the most sensitive.
4. Set access: named administrators, multi-factor authentication, and separate environments for testing and live use.
5. Decide how long to keep prompts and outputs, and the logs, before you go live.
6. Plan the exit: how you would move the model and its index, with the data, to another provider.

How do you keep AI data secure?

Treat an AI system as software with some new weak points. Apply your usual security controls first. Then add protection for the model, for the data it learnt from or reads, and for the prompts it accepts. Two UK documents set out how: the NCSC’s guidelines for secure AI system development and the government’s Code of Practice for the Cyber Security of AI.

The NCSC guidelines were published on 27 November 2023 with the US Cybersecurity and Infrastructure Security Agency (CISA), and agencies from 18 countries, the UK and the US among them, endorsed them. They split AI security into four stages: design, development, deployment, and operation and maintenance. The Code of Practice followed on 31 January 2025. It is voluntary, and sets 13 principles across five phases, from secure design to secure end of life.

For enterprise AI security, the practical points from the two documents include:

• Control who can reach the models and their interfaces, and keep environments that hold sensitive code or data separate from the rest.
• Record a cryptographic hash (a digital fingerprint) of each model file, so you can check it has not been tampered with.
• Watch how the model is queried. Attackers can try to rebuild a model, or the data it learnt from, by sending it many questions.
• Keep good audit logs, and include AI systems in your incident response plans.
• Track your assets and your supply chain, including third-party models and code libraries.
• Dispose of data and models properly when a system is retired.

The Information Commission (formerly the ICO) adds a data protection angle. Its guidance on AI and data protection describes “model inversion” attacks. In these, someone who already holds some personal data about a person in the training data uses the model’s answers to infer more about them. It also describes “membership inference”, where an attacker works out whether a person was in the training data. It cites a study that found popular machine learning frameworks with up to 887,000 lines of code and 137 external dependencies, each a possible weak point.

How does AI governance work in the UK?

On AI governance, UK law has no dedicated AI Act. Instead, existing regulators apply the rules in their own sectors, guided by five principles the government set out in a March 2023 white paper and confirmed in February 2024. For most organisations, the rules that apply in practice are UK GDPR and their own sector’s regulations.

The five principles are safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. In its response of 6 February 2024, the government kept them on a non-statutory footing. It also set out the case for future binding requirements on developers of the most capable general-purpose AI models. A title search of legislation.gov.uk on 19 October 2026 found no Act of Parliament with “artificial intelligence” in its name.

For personal data, the main reference is the Information Commission’s guidance on AI and data protection, last updated on 15 March 2023. It now carries a notice that it is under review because of changes made by the Data (Use and Access) Act 2025, so check the current version before you rely on it. Regulations in force since 12 May 2026 also require the regulator to prepare a statutory code of practice on developing and using AI, and on automated decision-making.

That guidance says that in the vast majority of cases, using AI will involve processing likely to result in a high risk to individuals. That triggers the legal requirement for a data protection impact assessment (DPIA). The DPIA is also the natural place to record where an AI system processes personal data and which suppliers are involved.

This section explains the rules in general terms and is not legal advice.

What should you ask a provider before running AI on its infrastructure?

Ask where every copy of your data will sit, who can reach it, and how you would leave. Private AI needs more than a server, so these questions go beyond where the data sits. Ask them of any provider, including us.

Our guide to G-Cloud 15 for public sector buyers covers the framework’s certification rules. Our white paper on cloud sovereignty explains how ownership and jurisdiction fit together.

How BlackBox Hosting can help

BlackBox Hosting runs managed private cloud and sovereign cloud in UK data centres. We work with organisations in defence and manufacturing, government and the public sector, healthcare and research, finance and insurance, and legal and professional services. We are ISO 27001 and CSA STAR Level 2 certified and hold Cyber Essentials Plus.

If you are working out where AI fits in your organisation, and which data and backups must stay under your control, talk to an expert.

Frequently asked questions