The Sovereign AI Stack Is No Longer a Talking Point

Third: can you build a frontier model this way? Honest answer: not yet. The weights being trained and fine-tuned in Riyadh and Abu Dhabi are downstream of architectures and base training runs that still originate in the US and, increasingly, China. Sovereign does not mean cutting-edge. What it means is that the application layer, the data, and the inference infrastructure are under local control — and that the dependency on foreign model providers is being methodically reduced, not eliminated overnight. The engineers in that Riyadh ministry were not pretending to have built GPT-5. They were running a fine-tuned derivative on sovereign hardware and treating the gap as a problem to close, not a reason to stop.

Tel Aviv deserves a mention here too, though for different reasons. Israel's AI stack strategy is less about sovereign infrastructure and more about sovereign talent density and export — building foundation model capabilities that get acquired or licensed outward. The model is closer to a research university with commercial spinouts than a national compute project. It is a different bet, and so far a productive one, but the geopolitical ceiling on that model is real and the engineers in those companies know it.

Back to the Gulf. The thing that makes this moment genuinely different from the previous wave of Gulf tech announcements — and I say this with full memory of the smart city vapor that evaporated between 2018 and 2022 — is that the current build is happening in layers that actually connect. You cannot fake a data center. You cannot fake a network of Arabic-language engineers doing RLHF on legal and medical corpora. You can fake a press conference about it, but the underlying work has a physical trace. The physical trace is visible.

The open question that nobody in the region is fully comfortable answering yet is governance of the stack once it is built. Sovereign infrastructure is only as trustworthy as the sovereign. The same data residency guarantees that make a Gulf AI stack attractive to regional enterprises also mean there is no external check on how that infrastructure gets used for domestic purposes. This is not a reason to dismiss the build — it is a reason to watch it. The European Union spent years building GDPR as an external accountability layer for private infrastructure. The Gulf is building its own infrastructure, and the accountability layer is still being designed by the same parties who own the hardware. That tension does not resolve itself.

The column I am not writing today is the one that says Gulf AI is exotic and aspirational and maybe someday. That column was wrong in 2022 and it is obviously wrong now. The column I am writing is: the sovereign AI stack is no longer a whitepaper concept, the business model is partially but not fully proven, and the governance question is the one that will determine whether this is infrastructure or apparatus.

The engineers at that whiteboard in Riyadh did not seem worried about being asked that question. They seemed like people who expected it, and were already arguing about the answer.