In the realm of artificial intelligence (AI), the concept of sovereignty is a complex and multifaceted issue, especially when it comes to cybersecurity. The recent news of Microsoft allegedly sharing the names of Dutch civil servants with the US House of Representatives highlights the critical importance of understanding who has control over data and AI systems. This is a lesson that South Africa must apply to its own AI sovereignty debate, which is currently focused on familiar infrastructure layers such as energy, chips, data centers, and foundational models. While these layers are essential, they are not the only factors that determine a nation's AI sovereignty. In my opinion, the key to true sovereignty lies in the layer that remains controllable when strategic workloads come under stress, and that layer is sovereign cybersecurity.
South Africa must make a strategic choice regarding its AI sovereignty, as each region is prioritizing different layers based on their capacity, risk tolerance, and strategic ambitions. The question is not whether the country can own every layer, but rather which layer it can control deeply enough to ensure the safety and security of its AI dependencies. In my view, the answer is sovereign cybersecurity, which means owning or enforcing the control architecture around strategic AI workloads.
This is not just about cybersecurity as a risk function or compliance checklist. Sovereign cybersecurity involves having the ability to control key custody, telemetry visibility, audit rights, local assurance, exit rights, and the overall cyber engine room that prevents black-box dependency. Procurement is where sovereignty becomes enforceable or collapses into aspiration, as South Africa will need to use various providers such as Microsoft, Amazon, and open-source models while ensuring that strategic workloads are under South African control conditions.
The diagnostic question that matters is: if a provider changes terms, restricts support, raises prices, or exits under geopolitical pressure, can South Africa keep the workload running, preserve access to its data, rotate its keys, recover the service, and maintain operations without foreign permission? This is a national policy question that requires government, regulators, and public sector CIOs to set procurement floors and classify strategic workloads, while private sector CEOs and CIOs must apply the same discipline to their enterprise AI strategies.
In conclusion, South Africa needs to co-build an OEM-grade sovereign cyber platform and enforce it through procurement and design control into the architecture. This discipline will make unavoidable AI dependencies governable and ensure that the country's AI strategy is not just a slogan but a tangible reality. Data centers create capacity, but sovereign cybersecurity creates control, and it is this control that will determine South Africa's ability to safeguard its AI sovereignty in the face of various challenges and dependencies.
