SML 9 — AI Sovereignty

AI sovereignty evaluates the organizational oversight, system clarity, and independent control of artificial intelligence solutions.

SML 9.CO 1 AI Governance

Objective: To ensure that governance structures are established to define responsibility, oversight, and accountability for the development, deployment, and operation of AI systems.
Sovereignty Contribution: Ensures that AI systems are subject to organizational oversight and are not operated without clear responsibility or control.

SML 9.CO 1.C 1 (Governance and Operations)

Scope: Service Provider
Service Type: All
The service provider has defined and documented governance structures for the development, deployment, and operation of AI systems.
SML 9.CO 1.C 1.Q 1: Has the service provider defined and documented governance structures for the development, deployment, and operation of AI systems?

SML 9.CO 1.C 2 (Technical)

Scope: Client-Facing Service
Service Type: All
The service ensures that AI-driven decisions can be controlled, restricted, or overridden where necessary.
SML 9.CO 1.C 2.Q 1: Does the service ensure that AI-driven decisions can be controlled, restricted, or overridden where necessary?

SML 9.CO 1.C 3 (Governance and Operations)

Scope: Client-Facing Service
Service Type: All
The use of AI within the service can be configured or limited by the customer or operator.
SML 9.CO 1.C 3.Q 1: Can the use of AI within the service be configured or limited by the customer or operator?

SML 9.CO 2 AI Transparency

Objective: To achieve a situation whereby the provider ensures that the architecture, capabilities, limitations, and intended use of AI models are documented and communicated to relevant stakeholders.
Sovereignty Contribution: Enables customers and regulators to understand how AI systems operate and prevents opaque “black box” dependencies.

SML 9.CO 2.C 1 (Governance and Operations)

Scope: Client-Facing Service
Service Type: All
The architecture, key components, capabilities, limitations, and intended use of AI models are defined and documented.
SML 9.CO 2.C 1.Q 1: Are the architecture, key components, capabilities, limitations, and intended use of AI models defined and documented?

SML 9.CO 2.C 2 (Governance and Operations)

Scope: Client-Facing Service
Service Type: All
AI documentation is made available to relevant stakeholders and customers in accordance with governance policies and legal requirements.
SML 9.CO 2.C 2.Q 1: Is documentation about AI systems available to relevant stakeholders?

SML 9.CO 3 Explainability

Objective: To ensure that AI systems are designed in a way that allows meaningful explanation of decision-making processes and enables human oversight or intervention where necessary.
Sovereignty Contribution: Ensures that organizations remain in control of automated decision-making processes rather than delegating authority entirely to AI systems.

SML 9.CO 3.C 1 (Technical)

Scope: Client-Facing Service
Service Type: AI Service
The service provides mechanisms to review AI-generated outputs or decisions before or after execution where relevant.
SML 9.CO 3.C 1.Q 1: Does the service provide mechanisms to review AI-generated outputs or decisions where relevant?

SML 9.CO 3.C 2 (Technical)

Scope: Client-Facing Service
Service Type: AI Service
AI systems are designed to incorporate explainability mechanisms tailored to the underlying model type, including providing appropriate metrics.
SML 9.CO 3.C 2.Q 1: Are AI systems designed to incorporate explainability mechanisms tailored to the underlying model type, including providing appropriate metrics and documentation?

SML 9.CO 3.C 3 (Technical)

Scope: Client-Facing Service
Service Type: AI Service
Human oversight mechanisms are defined for critical AI-driven decisions.
SML 9.CO 3.C 3.Q 1: Are human oversight mechanisms defined for critical AI-driven decisions?

SML 9.CO 3.C 4 (Governance and Operations)

Scope: Service Provider
Service Type: AI Service
Policies and procedures define when and how human oversight is required for AI-driven decisions.
SML 9.CO 3.C 4.Q 1: Are policies and procedures defined specifying when and how human oversight is required for AI-driven decisions?

SML 9.CO 4 External AI Dependencies

Objective: To ensure that dependencies on external AI services are transparent, controlled, and do not lead to loss of control over AI functionality.
Sovereignty Contribution: Prevents lock-in and loss of control by ensuring that reliance on external AI providers does not undermine autonomy or operational independence.

SML 9.CO 4.C 1 (Governance and Operations)

Scope: Service Provider
Service Type: All
The service clearly identifies and documents dependencies on external AI services used within its functionality.
SML 9.CO 4.C 1.Q 1: Are dependencies on external AI services used within the service identified and documented?

SML 9.CO 4.C 2 (Technical)

Scope: Client-Facing Service
Service Type: All
The service is designed to control or limit the use of external AI services where necessary.
SML 9.CO 4.C 2.Q 1: Is the service designed to control or limit the use of external AI services where necessary?

SML 9.CO 4.C 3 (Governance and Operations)

Scope: Service Provider
Service Type: All
Alternative solutions or fallback options are defined for critical dependencies on external AI services.
SML 9.CO 4.C 3.Q 1: Are alternative solutions or fallback options defined for critical dependencies on external AI services?

SML 9.CO 5 AI Life Cycle Management

Objective: To achieve a situation whereby the organization manages the life cycle of AI models, including training, validation, deployment, monitoring, retraining, and retirement.
Sovereignty Contribution: Prevents uncontrolled model drift and ensures long-term accountability for AI behavior.

SML 9.CO 5.C 1 (Governance and Operations)

Scope: Service Provider
Service Type: AI Service
The life cycle of AI models is documented, including training, validation, deployment, monitoring, retirement and complete model lineage information.
SML 9.CO 5.C 1.Q 1: Is the life cycle of AI models documented and regularly reviewed?

SML 9.CO 5.C 2 (Governance and Operations)

Scope: Service Provider
Service Type: AI Service
AI models and changes are validated before deployment. Validation data is documented and updated regularly.
SML 9.CO 5.C 2.Q 1: Are AI models validated before deployment and are validation procedures and results documented?

SML 9.CO 5.C 3 (Governance and Operations)

Scope: Client-Facing Service
Service Type: AI Service
AI model performance is regularly monitored after deployment.
SML 9.CO 5.C 3.Q 1: Are monitoring metrics defined and AI model performance monitored after deployment?

SML 9.CO 5.C 4 (Governance and Operations)

Scope: Service Provider
Service Type: AI Service
Processes exist for retraining or updating models when necessary.
SML 9.CO 5.C 4.Q 1: Are processes defined for retraining or updating AI models?

SML 9.CO 6 Control Over AI Assets

Objective: To ensure that AI model artifacts, including weights and architecture, remain under the control of the service provider and are protected from unauthorized access or modification by the infrastructure provider.
Sovereignty Contribution: Preserves AI sovereignty by preventing infrastructure providers from accessing or modifying model artifacts during execution.

SML 9.CO 6.C 1 (Technical)

Scope: Client-Facing Service
Service Type: AI Service
The service ensures that AI model artifacts (e.g., model weights, configurations) remain under the control of the service provider.
SML 9.CO 6.C 1.Q 1: Are AI model artifacts, including model weights, configurations, and architecture, documented and controlled by the service provider and protected from unauthorized access?

SML 9.CO 6.C 2 (Technical)

Scope: Client-Facing Service
Service Type: AI Service
Access to AI model artifacts is restricted and controlled to prevent unauthorized access or modification.
SML 9.CO 6.C 2.Q 1: Is access to AI model artifacts restricted and controlled, including the documentation and enforcement of access permissions?

SML 9.CO 6.C 3 (Governance and Operations)

Scope: Service Provider
Service Type: AI Service
The service provider defines policies and processes to maintain control over AI model artifacts.
SML 9.CO 6.C 3.Q 1: Are policies and processes defined and implemented to maintain control over AI model artifacts?

SML 9.CO 7 External Access to Training Data

Objective: To ensure that dependencies on external AI providers do not allow access to training data, which must remain confidential and protected from disclosure, storage, or reuse by the external provider.
Sovereignty Contribution: Preserves AI data sovereignty by preventing external AI providers from accessing or retaining training data during processing.

SML 9.CO 7.C 1 (Governance and Operations)

Scope: Service Provider
Service Type: All
Safeguards are defined and implemented to prevent disclosure or retention of training data.
SML 9.CO 7.C 1.Q 1: Are safeguards defined and implemented to prevent disclosure or retention of training data?

SML 9.CO 7.C 2 (Contractual)

Scope: Service Provider
Service Type: All
Contracts with external AI providers define restrictions on the use of customer data as training data.
SML 9.CO 7.C 2.Q 1: Do contracts with external AI providers restrict the use of customer data as training data?

SML 9.CO 7.C 3 (Technical)

Scope: Client-Facing Service
Service Type: All
Technical mechanisms prevent external AI providers from storing or reusing training data.
SML 9.CO 7.C 3.Q 1: Are technical mechanisms implemented to prevent storage or reuse of training data by external providers?

SML 9.CO 8 Training Data

Objective: To achieve a situation whereby organizations maintain transparency and governance over the sources, ownership, and legal status of training data used for AI models.
Sovereignty Contribution: Prevents hidden legal, ethical, or jurisdictional risks related to training datasets.

SML 9.CO 8.C 1 (Governance and Operations)

Scope: Service Provider
Service Type: All
Sources of training data used for AI models are documented, versioned, and periodically reviewed.
SML 9.CO 8.C 1.Q 1: Are sources of AI training data documented, versioned, and periodically reviewed?

SML 9.CO 8.C 2 (Governance and Operations)

Scope: Service Provider
Service Type: All
Ownership and legal rights associated with training data for AI models are assessed and documented.
SML 9.CO 8.C 2.Q 1: Are ownership and legal rights associated with training data for AI models assessed and documented?

Mapping of the Objectives to the corresponding Sovereignty Maturity Level

ID	Managed	Advanced	Future-Proof
SML 9.CO 1.C 1	x	x	x
SML 9.CO 1.C 2			x
SML 9.CO 1.C 3		x	x
SML 9.CO 2.C 1	x	x	x
SML 9.CO 2.C 2		x	x
SML 9.CO 3.C 1	x	x	x
SML 9.CO 3.C 2		x	x
SML 9.CO 3.C 3		x	x
SML 9.CO 3.C 4		x	x
SML 9.CO 4.C 1	x	x	x
SML 9.CO 4.C 2		x	x
SML 9.CO 4.C 3		x	x
SML 9.CO 5.C 1	x	x	x
SML 9.CO 5.C 2		x	x
SML 9.CO 5.C 3		x	x
SML 9.CO 5.C 4			x
SML 9.CO 6.C 1	x	x	x
SML 9.CO 6.C 2	x	x	x
SML 9.CO 6.C 3		x	x
SML 9.CO 7.C 1	x	x	x
SML 9.CO 7.C 2		x	x
SML 9.CO 7.C 3			x
SML 9.CO 8.C 1	x	x	x
SML 9.CO 8.C 2	x	x	x