The problem the researchers set out to formalize is one that governance frameworks have long danced around. The European Union’s AI Act demands transparency and human oversight for high-risk AI systems. The NIST AI Risk Management Framework calls for observability across the entire inference pipeline. Saudi Arabia’s Personal Data Protection Law imposes data-localization requirements. Yet all of these rules presuppose that an organization can see inside its own AI systems — a condition that cloud software-as-a-service architectures structurally frustrate. When inference happens on a vendor’s servers, the observation points needed for risk assessment are contractually or technically unavailable, no matter what the compliance paperwork says.

SARAI’s answer is to make this intuition rigorous. The authors define three measurable quantities: a Data Sovereignty Index, which captures the fraction of data operations that remain inside the organizational boundary; an Inference Sovereignty Score, which weights four stages of the AI pipeline — model storage, prompt transmission, inference execution, and log retention — according to whether each stays local; and a Risk Assessment Capability Index, which measures which of four governance mechanisms an organization can actually run. The Observability Bound Theorem then proves that the maximum achievable risk capability is a monotonically non-decreasing step function of sovereignty. Below the minimum thresholds, the capability index is exactly zero — regardless of how accurate the underlying model is.

The theorem’s proof is constructive rather than mysterious. Each risk mechanism requires access to specific system internals. Detecting dangerous AI-generated SQL requires intercepting queries before execution. Monitoring schema drift requires direct database introspection. Confidence gating — rejecting outputs the model itself is unsure about — requires access to token-level log-probabilities that cloud APIs simply do not expose. Feedback loops require both query logging and the ability to re-prompt the model. A fully cloud-hosted system scores zero on inference sovereignty and therefore unlocks none of these capabilities. The authors are careful to characterize this as a design theorem, internally consistent by construction, whose thresholds were assigned by domain experts — a limitation they acknowledge openly.

To show the framework is more than theory, the team built a complete five-layer system on a single commodity server with eight virtual CPUs, 32 gigabytes of RAM, and an NVMe drive. Data from five business domains — e-commerce, healthcare, retail, financial services, and supply chain — was deliberately split across PostgreSQL and MariaDB so that every analytical query required cross-engine federation. A distributed SQL engine with a cost-based optimizer handled the joins, a self-hosted Apache Superset instance rendered 49 live charts, and an AI layer dispatched natural-language questions to either local quantized models (Llama 3.2 3B and Llama 3.1 8B running on CPU) or cloud models (Gemma-3 27B and DeepSeek R1) for comparison.

The benchmark results crystallize the trade-off with unusual clarity. On a 50-question test stratified across five complexity tiers, the cloud-hosted Gemma-3 27B achieved 90 percent accuracy, and DeepSeek R1 reached 78 percent. The local Llama 3.1 8B managed 60 percent, and the 3B model 46 percent. Yet the sovereignty scores invert the picture entirely: both cloud models scored zero on risk assessment capability, while both local models achieved the full index of 1.0. DeepSeek R1, despite substantially outperforming the local 8B model, could not enable a single one of the four governance mechanisms. Statistical analysis using McNemar’s exact tests with Holm–Bonferroni correction confirmed that the 8B local model was not reliably outperformed by DeepSeek R1, even as the gap to Gemma-3 remained significant.

The four risk mechanisms themselves moved from aspiration to running code. A rule-based SQL anomaly scorer, applying thirteen detectors for injection patterns, invalid catalogs, structural anomalies, and hallucinated column names, achieved an F1-score of 0.980 on a test set of fifty valid and fifty adversarial queries, with no false positives on legitimate benchmark queries. Schema-drift monitoring using the Population Stability Index correctly flagged simulated column additions and row-count shifts while producing zero false alerts under stable conditions. An automated feedback loop regenerates failed queries with error hints for up to three iterations. The authors are notably honest about the limits: when scored against 54 real model errors from the benchmark run, the anomaly detector caught only about 39 percent, because most failures were semantically wrong but syntactically valid SQL — a category the structural rules were never designed to catch.

Perhaps the most striking technical finding concerns prompt engineering. Without worked examples, every model — local or cloud — scored zero percent, because the cross-catalog syntax required for federated queries simply does not appear in standard training data. Adding the full schema raised the 8B model to 32 percent; adding four worked examples lifted it to 74 percent on the real benchmark configuration. For this class of specialized task, prompt design contributed more than model scale, a result with immediate practical implications for organizations building sovereign deployments.

The economics are equally nuanced. A parametric cost model places the self-hosted deployment at roughly 11,635 dollars per year at 1,000 queries per day, dominated almost entirely by operator effort rather than compute — electricity accounted for just 0.3 percent of the total. Cloud pricing at the same volume was a fraction of that, with break-even estimated near 29,000 queries per day. The authors frame this carefully: the cost of sovereignty is essentially the cost of an engineer, and organizations that already staff a data platform pay it in overhead they have committed anyway. Latency tells a similar story of trade-offs, with local CPU inference taking a median of about 19 seconds per question for the 8B model against under 4 seconds for the GPU-accelerated cloud alternative.

The study’s broader message lands at the intersection of regulation and architecture. If the theorem holds, then AI systems deployed as opaque cloud services are structurally ungovernable from the consumer’s standpoint, and mandates for appropriate transparency may implicitly require infrastructure sovereignty for high-risk applications to be more than a paper commitment. The authors point toward hybrid routing — sending simple queries to local models while reserving cloud inference for complex cases under relaxed constraints — as a navigable middle path, and toward fine-tuning and better example curation as ways to close the accuracy gap without surrendering control. Their conclusion reframes the cloud-versus-on-premise debate: it is not primarily about cost or convenience, but about how much governance an organization can actually achieve. In an era when regulators are writing transparency requirements into law, SARAI offers a measurable answer to a question that has mostly been answered with slogans — and a demonstration that, on commodity hardware, the sovereign option is no longer merely a philosophical preference.

Subject of Research: The relationship between infrastructure sovereignty and AI risk assessment capability in federated business intelligence systems

Article Title: SARAI: Sovereignty-aware risk assessment infrastructure for reliable federated business intelligence

Article References: Alnahari, W., Arbaaeen, A., Hasanin, T., & Jambi, S. (2026). SARAI: Sovereignty-aware risk assessment infrastructure for reliable federated business intelligence. Results in Engineering, 32, Article 113508. https://doi.org/10.1016/j.rineng.2026.113508

Image Credits: AI Generated

DOI: 10.1016/j.rineng.2026.113508

Keywords: AI governance, data sovereignty, federated queries, text-to-SQL, large language models, risk assessment, cloud computing, EU AI Act, self-hosted inference, business intelligence, observability, NIST AI RMF