Drafted with AI assistance, then checked and revised by the author. The judgements and the errors are the author’s. How this site is written sets out what is declared on every piece, who checks it, and where the per-piece record lives.
Plain words, and what each term is worth to someone making a decision.
Sovereignty. In this series it means rightful authority over records, not capacity to build models. Two arrangements with identical hardware can differ entirely on this. Ordinary usage often means the second — a country’s ability to make its own AI — and conflating them is how a hardware investment gets described as a sovereignty measure.
Worth knowing because: if someone tells you a purchase improves sovereignty, ask which sense they mean.
Jurisdiction. Whose courts can compel a party to hand something over. Not the same as where the data sits.
Worth knowing because: this is the single most common confusion in the market. A data centre in Auckland operated by a foreign-parented company satisfies location and fails jurisdiction.
Region-washing. Describing an arrangement as sovereign because the servers are local, when the operator remains subject to foreign compulsion. Usually said in good faith by people who have not been asked the second question.
Operator. The entity that runs the infrastructure — not the reseller, not the local subsidiary that signs your contract. The one a foreign authority would serve papers on.
Worth knowing because: Test 1 turns on this and contracts rarely make it obvious.
Compulsion. A legal power to force disclosure. The relevant question is not whether a party would resist but whether it could.
Inference. A model producing an answer. The step where your material is actually processed.
Inference path. Where that happens and who operates it — which may be nowhere near where the software you clicked appears to run. A product hosted locally can send every request offshore for processing.
Worth knowing because: this is what Test 0 asks about, and it appears on no standard procurement form we found.
Training. Using data to change a model’s weights. Distinct from inference, and the distinction carries the whole weight of Test 3: a vendor may process your data without training on it, and the promise not to train is the one that cannot be verified from outside.
No-training term. A contractual promise that your inputs will not be used to improve the vendor’s models. Real, available, and standard on enterprise plans. Written by the vendor, changeable by the vendor, and — the point of Test 3 — not verifiable by you.
Egress. Data leaving a boundary. Often incidental rather than deliberate: update checks, licence validation, crash reports, telemetry. These are the paths by which a “nothing leaves” claim usually fails.
Attestation. A signed statement that something is true, issued by a party who can be identified. Its value depends entirely on who issued it and whether you can check it. A vendor’s attestation about itself is a claim, not evidence — it is the thing evidence is needed for.
Provenance. A record of where something came from and what it was derived from. In this series it means being able to ask, of any artefact, which of your records contributed to it — and get an answer by running a query rather than asking a person.
Portability. Moving your complete operational position elsewhere — records, configurations, adaptations, history, integrations — not just exporting a data file.
Worth knowing because: almost every product offers data export and almost none offers this. Test 4 asks for the second.
Open weights. A model whose parameters are published, so anyone can run it. Genuinely useful and frequently offered as the answer to portability. It is not: it gives you model portability. The three years of accumulated organisational state inside a hosted product is untouched by it.
Lock-in. Usually described as a commercial tactic. More accurately, a property that accumulates: every month of use raises the cost of leaving, without anyone deciding it should.
Exit time. How long it would actually take to move, measured by performing it rather than estimating it. An unmeasured exit plan is a document.
IPP 12. Information Privacy Principle 12 of the Privacy Act 2020, governing disclosure of personal information to an overseas recipient. The usual route relies on a judgement that the recipient is subject to comparable safeguards — which in practice rests on the vendor’s own statement.
Worth knowing because: it is what New Zealand currently has instead of a residency requirement, and it makes no provision for Māori data governance.
Cloud First. New Zealand government policy directing agencies to prefer public cloud, refreshed in 2023. Contains several provisions that would do real work if sharpened — including a dormant sentence about a “suitable onshore service”.
Transfer prohibition notice. A power allowing the Privacy Commissioner to block an overseas transfer where comparable safeguards are absent. On paper the strongest cross-border provision available. Whether it has ever been used is one of the things we could not establish.
Compliance notice. A direction to an agency to do or stop doing something. Enforceable through a tribunal, and ultimately backed by a fine capped at ten thousand dollars.
Evidenced. Sources are cited and can be checked by you.
Not evidenced. We searched, we say what we searched, and we did not find it. Reported as a gap. Absence of a finding is not proof of absence — this form is used wherever the universe is open-ended, such as every audit ever conducted, and it is deliberately weaker than a conclusion.
Common false pass. A way a test can appear to pass when it has not. Each test has at least one, and they are the most practically useful part of the instrument — usually more useful than the finding.
The lowest score, not the average. The overall result is the worst individual finding. Sovereignty is not a portfolio and a hard failure is not offset by easy passes.
How any of these properties is achieved. This series states what must be true and how you would check it, never how a system should be built. Where a definition above reads as incomplete for that reason, it is complete for its purpose.
What this publication does not claim, and what is outstanding against it in the register.
A question this rests on is parked: What do we do with an application that refuses to run inside the boundary?
We do not claim that a member's existing applications can be made to run inside the boundary. We claim only that the boundary reveals which ones cannot.
Alongside: the publication · questions and answers · sources and provenance