CASE: AI sovereignty risk console

Where does the exposure sit?

Seven hazard classes around one dependency; each class is carried by one of its dimensions in a given case

7 classes · 29 dimensions · framework 1.0

3 What does it create from our data: and where does THAT go?

Data Derivatives

This is the part almost every vendor review misses entirely. AI systems don't just read your data, they transform it into new things: mathematical fingerprints of your documents, logs of every answer given, records of which answers got a thumbs-down. Those new things get stored somewhere, often by a company you've never heard of and never contracted with directly.

Ask the vendor

Does this turn our documents into some kind of derived file (an “embedding”) so it can search them faster?
If so, who stores that derived file, you, or a completely different company?
Do you keep a copy of everything the AI said back to us, a log of how we used it, or a record of when we said the answer was wrong?

Dimensions

Start an assessment with this class

All hazard classes and dimensions as a list

Whose AI brain is this, really? (Model Layer)
What are we feeding it? (Data Input)
What does it create from our data: and where does THAT go? (Data Derivatives)
Who's deciding what the AI sees and does? (Retrieval & Orchestration Pipeline)
Which humans are actually looking at our stuff? (Human-in-the-Loop)
Who's holding the steering wheel? (Control Plane)
How many companies are really in this chain: and did we agree to it? (Subprocessor & Supply Chain)