The Sovereign AI Trade Is Missing a Line Item

In the space of about a week the smartest money in technology agreed on the same trade. Chamath Palihapitiya named it in his July 5 newsletter: the sovereign AI trade. Buy the companies that let institutions own their intelligence instead of renting it.

The evidence arrived almost on schedule. On June 29 Palantir and NVIDIA announced air-gapped deployments for customers whose data cannot leave the building. On July 1 Bloomberg reported that Meta is standing up a business to sell its excess compute to outside customers. That same day Together AI raised $800 million at an $8.3 billion valuation, led by Aramco Ventures, to run open models cheaply at scale, and Venice AI became a unicorn on a privacy-first pitch: it does not log prompts, and conversations stay on the user’s device. On July 2 Microsoft launched Frontier Company, $2.5 billion and six thousand engineers embedded inside customers, with an explicit commitment that customer data, IP, and competitive advantage will not be used to train models in ways that commoditize what differentiates them in their industry. The same day the Financial Times reported that OpenAI had discussed giving the United States government a five percent stake. That last one is a story about politics, and I will leave the politics to people who enjoy them.

Read the week together and the message is unmistakable. Sovereignty is now a product category. Everyone is selling it.

Then, over the following nine days, the two loudest voices in the trade took the assumptions underneath it apart. One of them was the man who named it.

The man who named the trade cannot prove it is working

On July 12 the same investor who had named the sovereign trade a week earlier said there is literally not a scintilla of evidence that AI has helped lift the operating margins of the S&P 500.

He brought numbers. Between zero and two percent of the S&P 493’s recent earnings growth is traceable to AI productivity, on his math. The rest is inflation and buybacks. A PwC survey this year found that fifty-six percent of chief executives saw no revenue or cost benefit from AI at all, and only twelve percent could point to both. Back in May he had already set the clock: roughly five hundred days until the fork in the road, at which point a company has to be able to say it spent X and it made Y, and Y is bigger than X.

This is contested, and it should be. Brad Gerstner has pushed back, noting that S&P 500 operating margins moved from around eleven percent in 2023 to thirteen percent in 2025, and arguing that AI deserves some of the credit. The counter is that most of that expansion is post-pandemic restructuring and cost discipline rather than machine productivity. The argument is unresolved, which is the point. Three years and several hundred billion dollars in, the return is still a matter of opinion.

The next day it acquired a second half.

The paradox names itself

On July 13 Satya Nadella published a long essay describing what he calls the reverse information paradox. In the AI era the buyer of intelligence pays twice: once in money, and once in the proprietary knowledge it must reveal to make that intelligence useful.

Models learn from exhaust. The prompts your people write. The tools your agents call. Above all the corrections your experts make, which is precisely the knowledge a competitor could never buy at any price.

And then the line that should stop every chief information officer in the industry. It leaks almost imperceptibly, he wrote. Trace by trace, correction by correction, eval by eval.

Put those two statements together and they are the same finding. One says you cannot prove what AI is earning you. The other says you cannot see what it is costing you. Not capability. Not capital. Evidence.

An enterprise that cannot prove what its agents did will never be able to prove what they earned. It is one discipline, not two.

And then he said the quiet part

On CNBC this morning, the same investor was asked about privacy at the model layer. His answer should be printed and taped to the wall of every vendor risk team in the country.

The labs, he told CNBC, do a very good job of a very superficial form of privacy called zero data retention. They tell you to enable it, and then everything is hunky-dory. But read the fine print. Suppose you put your secret formula into the model and ask it to improve the recipe. That prompt is covered. Now suppose you click the like button on what it gives back. Is there any guarantee that this was not stored somehow?

The honest answer, he said, is technically no, because we do not know how to do that.

Sit with that. The privacy control that the entire sovereign shelf is sold on, the one whose name is a promise, does not cover the thing Nadella had just finished describing. Nadella said the model learns from your corrections. This says nobody can promise your correction was not kept. One of them told you where the value goes. The other told you the lock on that door does not exist yet.

That is the whole argument of this piece, made by the man who started the trade, on live television, one week after he started it.

Architecture is a claim. Proof is a control.

That is why the sovereign trade, as currently sold, is incomplete. Every offer in that remarkable week is an architecture claim, and architecture claims get inspected once, at procurement, by people who will not be in the room on any of the three hundred and sixty-four days that follow.

Air-gapped proves isolation. It does not prove governance. Last week’s piece made this argument about the sandbox, and it holds one layer up. A boundary tells you where the work happened, not whether the work was allowed. An air-gapped environment full of ungoverned autonomous agents is an extremely well isolated place in which to lose control of your software.

Not trained on is a policy until it is a contractual term with evidence attached. Which uses are excluded, who decides, on which tier, and what does the buyer actually get to inspect on a Tuesday in March, eighteen months later, when the terms have quietly moved? They do move. Multiple major platforms have already migrated from we do not train on your data to we train on your data unless you find the setting and switch it off.

Does not log looked like the strongest of the three until this morning. Now we have it from the trade’s own architect that the retention promise stops at the fine print, and that the guarantee you actually want is one the industry does not yet know how to give. You are not holding a control. You are holding a setting, and a hope about everything the setting does not cover.

And if the leak really is imperceptible, then none of these promises can be verified by looking. That is what imperceptible means. What you are holding is not a control. It is a claim.

None of this makes the sovereign stack a bad buy. Most of it is a real improvement on the status quo, and some of these companies will be among the winners of the decade. The point is narrower. Every one of these products moves the boundary. Not one of them, on its own, produces the proof.

The line item

So here is what the sovereign trade has not priced, and it turns out to be the same line item twice.

Sovereignty is not a place you arrive at. It is a state you have to be able to demonstrate, repeatedly, to someone who does not take your word for it. A regulator. An auditor. A board. A customer running vendor due diligence on you. And, in about five hundred days, an investor who wants to see the number.

So the question is not which sovereign stack you bought. It is whether, on any given day, you can prove the sovereignty you bought is still holding.

Can you show that the model running in production is the model you approved? That the data classified as never-leaves did not leave, and demonstrate it rather than assert it? That the agent operating inside your air-gapped environment took only the actions a human authorized? That when a vendor’s terms shifted in February, you knew, you reassessed, and you have the record to show for it?

Very few institutions can answer those questions today. Not because the technology is missing, but because the industry has been selling the boundary and not the proof.

He gave the same warning this morning from the finance side, and it is worth hearing in his words. Most chief executives and chief financial officers, he told CNBC, probably have no idea how much token consumption is happening inside their own organizations. One day the quarter misses by a few pennies, the chief executive asks the chief financial officer where all the incremental operating expense came from, and somebody has to go and trace it.

Trace it with what?

That is the question the sovereign trade has not answered, and it is the same question the regulator asks, wearing a different suit. The instrument that answers the examiner is the instrument that answers the board. A ledger that records what every agent did, what it consumed, what a human authorized, and under which policy is an audit artifact on Monday and an ROI artifact on Friday. You cannot prove the return on autonomous work you cannot account for. The fork in the road arrives for both questions at once.

This series has a name for assurance that holds continuously instead of once, at procurement: Continuous Agentic Assurance. It is the layer the sovereign trade is missing. It has to sit above whichever sovereign stack you bought, because most institutions will end up running more than one, and because they will change their minds.

The same disclosure, in the same spirit

Everyone arguing about sovereignty this month is talking their book, and I am going to say so plainly, because I have just spent two thousand words quoting them. The investor who named the trade and then took it apart now runs an enterprise AI company himself, and said as much on air: selling enterprise is his entire job. Nadella has a $2.5 billion business built on being the trustworthy option and an essay that makes his competitors look careless. Palantir has a partnership to sell. And I run a company that builds the governance and evidence layer for regulated institutions, which makes a piece arguing that sovereignty needs proof exactly as self-interested as it sounds.

None of that makes any of them wrong. It does mean you should check.

So do what I would do. Do not take my word for it. Take the strongest claim your most important AI vendor makes about your data, and ask them in writing what evidence you are entitled to inspect, how often, and what you are contractually owed if the answer ever changes. The ones with good answers will produce them quickly. The silence of the others is also an answer.

The sovereign era is real, and the trade is probably right. But sovereignty you cannot audit on any given day is not sovereignty. It is a mood. And a mood is not going to survive the moment someone asks to see the numbers.

Paul Goldman is the CEO of iTmethods, where his team builds the control and assurance layer for agentic AI: the governance, evidence, and portability that let regulated institutions run any model, swap it under pressure, and prove control. He writes The Trust Layer at itmethods.com.