AI sovereignty requires infrastructure control beyond data residency

AI sovereignty frameworks extend beyond data residency to address who accesses systems, who operates infrastructure and who governs use, according to Abdelilah Nejjari, Managing Director for the Gulf, Levant, Türkiye, Caucasus and Central Asia at Cisco. Organisations deploying AI workloads must balance control over sensitive systems with access to global innovation while developing operational capability to manage autonomous systems.

Three areas of control for AI workloads#

Three areas of control matter most for AI sovereignty, Nejjari stated in an interview published by Tahawultech on 8 January 2025. The first is access: who can reach systems and data. The second is operations: who runs the environment and whether updates can be managed on the customer's own schedule. The third is governance: whether technology partners' principles align with the customer's own. Under Cisco Sovereign Critical Infrastructure, customers hold complete authority over system and data access, while Cisco neither operates nor accesses the infrastructure itself, Nejjari said. The company's product development practices prohibit any intentional features designed to allow unauthorised access or to bypass security controls, he added.

Deployment choices across on-premises, hybrid and cloud environments#

The right deployment model depends on the workload, Nejjari stated. On-premises, air-gapped environments operated exclusively by the organisation may be required for systems supporting national services or critical operations. Hybrid models combining sovereign infrastructure with private or public cloud services can accommodate other workloads. Data sensitivity, regulatory requirements and business need should drive these decisions, he said. Organisations can run on-premises, air-gapped Sovereign Critical Infrastructure alongside cloud-based services, choosing which workloads belong on sovereign infrastructure and which do not. Enterprises that determine which workloads carry the highest priority can direct sovereignty measures to those systems rather than applying controls uniformly, Nejjari stated.

UAE National Strategy for Artificial Intelligence 2031#

The UAE set out its AI ambitions with the UAE National Strategy for Artificial Intelligence 2031, Nejjari noted. AI workloads process an organisation's most sensitive information, including financial transactions and operational data from critical facilities. How securely that data is protected and controlled determines the value AI can deliver, he stated. Sovereignty does not mean isolation, Nejjari said. Enterprises in the region seek to maintain links to global innovation while keeping control over their most critical systems. Air-gapped environments generally provide standard product functionality, he added, though the evidence does not specify the trade-offs he referenced.

Cisco infrastructure approach for Gulf enterprises#

Cisco's approach to infrastructure gives customers choice, control and autonomy over their data and digital infrastructure, Nejjari stated. Where information is stored is the question data residency addresses, but AI introduces a wider set of questions: who holds authority over the data, the systems and the infrastructure AI depends on. Leaders should be clear about the trade-offs between different deployment models, he said. The interview was published by Tahawultech and focused on deployment choices, operational skills and agent security for sovereign AI infrastructure across the UAE and wider region.