AI models will be the same for everyone. What each company knows will not.

Few technologies have reached the enterprise with the breadth of generative artificial intelligence. Its effect goes well beyond automating tasks: it changes how a contract is assessed, how a proposal is structured, how due diligence is conducted and, ultimately, how decisions are made. In most organizations adoption is already under way, by design or otherwise, and the question that matters now is the terms on which it takes place.

One aspect of this shift still receives too little attention. Language models are advancing quickly, yet they tend to converge: what sets one provider apart today is usually available from the others within months, to any competitor willing to pay for it. What does not converge is the knowledge each company has built up over years, its commercial terms, its customer history, its contracts, the logic by which it prices and decides. AI creates distinctive value only when it works on that knowledge, and that is precisely where the risk lies.

Many companies responded by restricting use, with a predictable result: AI went on being used, now through personal accounts and beyond any record. Unrestricted access is no better, since it hands to third parties decisions about assets that ought to remain under the company's control. Between the two lies a more mature course, which is to apply to artificial intelligence the same governance discipline reserved for capital and financial information, deciding explicitly which knowledge may reach each AI environment, in what form and under which rules.

Sovereignty is no longer a matter for states alone

The capacity to build frontier models is concentrated in a handful of companies, based in an even smaller number of countries, and each jurisdiction is responding to that concentration in its own way. The European Union has chosen comprehensive regulation, with an AI Act whose reach extends to providers established outside the bloc. The United States retains legal instruments that reach data held by its providers even outside American territory. China has built an ecosystem of its own, in which generative AI services offered within its borders are subject to state content requirements and, in many cases, to prior registration with the authorities. For a Brazilian company, or for a group operating across several of these markets, the choice of an AI provider carries legal and, to some degree, geopolitical implications.

In this context, sovereignty means the ability to retain control over one's own knowledge: where it is stored and processed, which jurisdiction it answers to, who has access to it, who holds the encryption keys, how long it is kept and who decides on all of this. The reflexive association with in-house servers is misleading. Such control can be exercised in a public cloud with regional residency, in sovereign clouds or on dedicated infrastructure, and it can be wholly absent from a poorly governed on-premise environment.

Two distinctions tend to escape the debate. Region is not jurisdiction: data processed in Brazil by a foreign provider may remain subject to the law of that provider's home country. And customer-held encryption keys protect data at rest, but not at the moment the model processes it. Ultimately, sovereignty is strategic autonomy, the capacity to choose and to replace AI providers without becoming hostage to any of them.

A familiar architecture for a new problem

The technical answer to this challenge calls for no invention. Companies have long relied on proxies, API gateways and secure access platforms to govern network and application traffic. The proposal is simply to extend that principle to artificial intelligence. Rather than letting every user, system or agent connect directly to a provider, the company places a common control layer in between, bringing together the identification of who is asking, the classification of the information, the inspection of what goes out and what comes back, and an audit record.

Within that layer, each request is tested against company policy before it reaches the model, and may be allowed through, have sensitive passages masked or replaced with codes, be blocked, or be redirected to a private environment. The deciding criterion is the sensitivity of the information. Public material may be processed by external tools; internal information, by contracted and approved environments; confidential information, such as prices, contracts and customer data, only under the inspection of the control layer; and restricted information, such as mergers and acquisitions, payroll and strategic plans, solely in private models or sovereign environments.

The model rests on two premises that should be made explicit. Information must be classified, which rarely happens to the extent one would wish, and the prudent rule is to treat anything not yet classified as confidential. Moreover, automated detection of sensitive data is probabilistic: precise for structured identifiers such as tax and company registration numbers, and considerably less reliable in free text, particularly in languages other than English.

The same layer has an effect that goes beyond security. With routing centralized, the model ceases to sit at the centre of the architecture and becomes a replaceable resource, chosen on cost, performance, regulatory requirements or operational continuity. It is the freedom to change providers that gives sovereignty a tangible dimension.

Building the control layer

The practical question that follows is whether this layer has to be built. Rarely from scratch. Its components already exist on the market, in four broad families: AI gateways, which centralize access to several model providers and handle routing, quotas and logging; data loss prevention and classification tools, many of which now extend their inspection to prompts and responses; the secure access platforms most companies already use for web traffic, which can identify and govern the use of public AI services; and the guardrail services offered by the cloud providers themselves. Open-source alternatives exist in each family for companies with the engineering capacity to run them.

What does not come off the shelf is the integration and, above all, the policy: the classification scheme, the rules for each class, the link to corporate identity, the handling of exceptions. That work belongs to the company, and it is where most programmes stall.

A pragmatic sequence has three stages:

1. See. Find out which AI services are already in use, by whom and with what kind of data. The secure access tools most companies own can usually show this within weeks, and the picture tends to be larger than expected.

2. Channel. Offer an approved route that is at least as convenient as the unofficial ones, such as a corporate assistant for staff and a single endpoint for developers, both passing through the control layer, with logging and basic masking from the first day. People abandon shadow tools when the official path is easier, not when it is mandatory.

3. Refine. Tighten policies class by class, extend control to agents, and bring contracted systems with embedded AI under the second front of governance described below.

One choice deserves particular care. The control layer is the component that makes providers replaceable, so it should not itself depend on any single one of them. It should run in an environment and a jurisdiction the company has chosen, and be replaceable in its turn.

Master data: what the control layer needs to know

A policy can only be as good as the company's knowledge of its own data. This is where master data management stops being a back-office discipline and becomes a condition for governing AI.

It tells the layer what is sensitive. Master data holds the authoritative records of customers, suppliers, products, contracts and employees. Supplied to the control layer as a reference, it turns detection in free text from inference into matching: the system no longer has to guess that a name in a prompt belongs to a customer, because it knows. This directly addresses the weakness of probabilistic detection noted above, particularly in Portuguese and Spanish.

It keeps pseudonymization consistent. The same entity receives the same code in every system and over time, so that analyses remain coherent and reversal stays under control.

It gives classification an owner. Every master data domain has someone accountable for it, and that person is the natural one to set its sensitivity class and approve exceptions. Without that ownership, classification becomes a technical task that nobody in the business is able to validate.

It sets the quality of what AI produces. Much of the knowledge that differentiates a company, its pricing logic, its customer history, its contractual terms, is master and reference data. When AI works on duplicated customers or outdated price tables, it does not fail visibly; it produces confident errors at scale.

Companies with mature master data management start this journey ahead. Those without it should not wait for a complete programme: it is enough to begin with the domains that concentrate both risk and value, typically customers, contracts and prices.

The limits worth knowing in advance

The credibility of a governance programme depends on its boundaries being understood before implementation, not discovered after an incident. The control layer is effective for everything that passes through it. Four situations, however, call for their own treatment.

AI embedded in contracted systems

Assistants built into productivity suites, CRMs, customer service platforms and meeting tools send information straight from the vendor to the model, without ever crossing the company's control layer. This is where adoption tends to grow fastest, often switched on by a vendor update rather than by a decision of the company. The answer lies in recognizing a second front of governance, exercised through the configuration of contracted environments, sensitivity labels honoured by the vendor's AI, and clauses on data retention and use. It is a front more contractual than technological, and for that very reason frequently neglected.

The real reach of tokenization

Replacing names with codes is a valuable device whose reach is often overstated. When "the acquisition of ACME for US$48 million" becomes "the acquisition of TARGET_001 for US$48 million", the model no longer knows the company's name, but the exact amount, combined with the sector and the date, may be enough to identify it. This is pseudonymization, not anonymization, and data so treated remains subject to personal data protection obligations.

There is also the opposite cost, since the more is withheld, the less the model can contribute. The balance between confidentiality and usefulness is a decision to be taken case by case. Where the analysis depends on the real identity, the right course is a private model, not tokenization.

Agents acting on the company's behalf

AI agents with access to email, internal systems or the internet also expose information through what they do: they send messages, call external addresses, write data into other systems. They can even be induced to do so by instructions hidden in documents they have read themselves. Inspecting content is not enough here. Actions must be authorized, with clear limits on tools and destinations, least-privilege credentials and human approval for irreversible operations, the same principle that governs any power of attorney.

The control layer itself

To function, the architecture creates two sensitive assets: the audit records, which may hold requests and responses in full, and the table linking each code to the real name. Together they concentrate precisely what the programme sets out to protect, and they demand the highest level of protection, with records minimized by default, segregation of duties in key management and a defined failure behavior, in which an outage of the layer halts traffic rather than letting it through.

Finally, there is a limit of a human kind. If the most sensitive knowledge can only be handled in markedly inferior models, people will find ways around them to deliver what is expected of them. The safest option must also be equal to the task.

Measuring what it is worth

Governance programmes tend to be judged by what has been deployed: policies issued, tools procured, models integrated. These are measures of effort. What leadership needs are measures of result, and the control layer makes them possible: as the single point through which governed use passes, it is also the point where that use can be measured by area, use case, model and cost.

Three levels of indicator are enough to start.

Coverage. The share of the company's AI use that takes place under some form of governance, whether through the control layer or through the management of contracted systems. It exposes the perimeter of control and, above all, what remains outside it.

Unit cost. The cost of a unit of work done with AI, such as a contract reviewed, a proposal drafted or a customer request resolved, including model consumption, a share of the platform and the human review the task still requires. Expressed per unit rather than as a monthly bill, it can be compared with the cost of the same task without AI and followed over time.

Value realized. Time saved, cycles shortened, errors avoided or revenue enabled, measured against a baseline taken before deployment, one use case at a time. Use cases that cannot show value within an agreed period should be redesigned or retired.

Routing is where the technical and the economic meet. Not every request needs the most capable and most expensive model. A layer that already decides by sensitivity can also decide by complexity, sending routine tasks to cheaper models and reserving premium ones for where they make a difference. Caching repeated requests and setting quotas by area complete the picture, and allocating costs to the business units that generate them makes each area weigh what it spends against what it gains.

The cost of governance itself should be read the same way. Expressed as a share of AI spending, it is the premium paid for the right to use AI on the knowledge that matters most. Restriction is not free either: its cost is the value never captured, plus the unrecorded use that happens anyway.

What leadership must decide

These are choices that technology makes possible, but that concern the business as a whole and therefore belong to the executive leadership as a whole.

Leadership must first define which knowledge never leaves the company's control, whatever productivity gain is offered in return. From that follows the risk appetite for each class of information, which is simply a decision about how much exposure is acceptable in exchange for how much capability. AI agents call for particular attention: someone must answer for what they do on the company's behalf, and that question has to be settled before the first of them goes into production. Coverage deserves a target and a deadline, monitored as regularly as any other risk indicator. Finally, every AI use case should have an owner on the business side and an economic target, the expected cost per unit of work and the value it should return, reviewed with the same regularity.

These decisions do not hold back the adoption of artificial intelligence. They are what allow it to be taken to scale with the confidence of knowing what is exposed, to whom and on what terms.

No leadership team would accept the company's cash being moved without approval limits and without a record. The company's knowledge, worth more than its cash, still moves that way.