The Sovereignty Ladder: A 5-Rung Model for AI Data Governance
Self-assess your AI data governance framework against the 5-rung Sovereignty Ladder: pass/fail evidence tests per rung and a one-rung-per-quarter climb plan.
Most AI governance programs are a PDF. The Sovereignty Ladder is an AI data governance framework built as a self-assessment instead: five rungs, each defined by evidence you can produce, not documents you have written. It is for CTOs and security leads in finance, healthcare, legal, and advisory work, where the gap is wide: 63% of organizations still have no AI governance policy at all, according to IBM's 2025 breach data [4]. This piece gives you the rung definitions, a pass/fail test for each rung, and a realistic climbing cadence: one rung per quarter, per workload.
An AI data governance framework measured in evidence, not documents
The ladder is our working model, introduced in What Is Sovereign AI. The premise: governance is not a state you declare, it is a set of controls you can demonstrate. Each rung adds control and adds cost. Nobody needs the top rung for every workload, and most of the market's confusion comes from pricing rung five while delivering rung two.
| Rung | Name | What you actually control | Who belongs here |
|---|---|---|---|
| 1 | Consumption | Nothing beyond the vendor's terms. Public API or SaaS, data leaves your perimeter. | Experiments, public data, drafts |
| 2 | Contract | Legal commitments: DPA, zero retention, no training on your data, region pinning | Internal productivity tools on non-client data |
| 3 | Architecture | The chokepoint: an AI gateway in your VPC, your keys, your logs, redaction and routing by data class | Any workload touching client, patient, or matter data |
| 4 | Operation | The models: open weights on infrastructure you operate, you control versions, prompts, and update timing | High-volume or highly sensitive workloads past breakeven |
| 5 | Provenance | The full stack: jurisdiction-clean supply chain, forkable weights, tested exit, no vendor kill switch | Regulated core systems, national-security-adjacent work |
Two properties make this an AI data governance framework rather than a poster.
First, it is scored per workload, not per company. Your marketing copy tool and your client-onboarding copilot sit on different rungs, and averaging them hides the one that matters.
Second, every rung is defined by artifacts an examiner could ask for today. That aligns with how regulators actually assess you. The NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) both frame governance as demonstrable controls over data, models, and third parties, not as stated intentions [1][2]. The OWASP Top 10 for LLM Applications lists sensitive information disclosure and supply chain risk as top-five application risks; both map directly to rungs 2 and 3 [3].
Score a workload in 20 minutes: the rung tests
Here is the artifact to keep. Take one workload. Walk down the tests. The workload's rung is the highest rung where you pass every test in that row and all rows above it. One failure caps the rung.
| Rung | Pass test: the evidence you must produce |
|---|---|
| 1 Consumption | You can name the workload, its owner, and every vendor that touches its data. If you cannot enumerate it, you cannot govern it. |
| 2 Contract | For every vendor in the path: a signed DPA, zero-retention terms, a no-training clause, and region pinning. Plus an acceptable-use policy that is enforced in tooling, not just posted. |
| 3 Architecture | The complete prompt-and-response log, stored in your systems, retrievable today. Customer-held encryption keys. All model traffic routed through a gateway you control, with egress rules and redaction by data class. |
| 4 Operation | Model weights you hold. Pinned versions. You decide when the model updates, and you can roll back within hours. Prompt and config versions under your change control. |
| 5 Provenance | A documented supply chain: base model, fine-tunes, datasets, jurisdictions. Forkable weights. An exit drill run in the last 12 months, with measured recovery time. No single vendor can switch you off. |
The scoring rule that keeps this honest: score with an examiner's standard, not an engineer's. "We have a DPA somewhere in procurement" fails rung 2. "The logs exist but live in the vendor's console" fails rung 3, because you cannot produce them on your own authority or your own timeline.
A common finding when firms run this for the first time: the workload leadership describes as "enterprise grade, fully compliant" sits at rung 1, because nobody can produce the log or name the subprocessor chain. The discovery is uncomfortable and cheap. Discovering it in an audit is neither.
Climb one rung per quarter, per workload
The cadence matters as much as the model. A rung is infrastructure plus habit: the gateway has to be deployed, and then the logs have to accumulate, the redaction rules have to be tuned, and the team has to learn the new workflow. That is a quarter of real work per rung for a competent team. Faster promises produce paper rungs.
A workable sequence:
| Quarter | Move | The actual work |
|---|---|---|
| Q1 | Rung 1 to 2 | Inventory every AI workload. Sign DPAs with zero retention and no-training clauses for each vendor in the path. Publish and enforce acceptable-use policy; policy as code for AI acceptable use covers the enforcement half. |
| Q2 | Rung 2 to 3 | Stand up an AI gateway in your VPC: egress control, customer-held keys, your own log store, redaction by data class. Mechanics in AI egress control in your VPC. |
| Q3 | Rung 3 to 4, selectively | Only for workloads that clear the math: self-host open weights where volume or sensitivity justifies it. Run the numbers first; our self-hosted LLM breakeven analysis is the model. |
| Q4 | Rung 4 to 5, rarely | Supply-chain documentation, forkable weights, a timed exit drill. Reserved for a short list of core systems. |
Two guardrails keep the plan honest.
Set rung 3 as the floor for regulated data. Anything touching client, patient, or matter information belongs at rung 3 minimum, because the audit trail must be yours. Below that, you are renting your evidence from the vendor.
Refuse uniform climbs. Most workloads should stop at rung 2 or 3 forever. Rung 4 is an economics decision, and rung 5 is a risk decision for a handful of systems. The failure mode is not a low rung; it is a sensitive workload parked one rung below where it belongs while budget flows to a rung it does not need.
The regulatory clock allows this pace, barely. EU AI Act obligations for general-purpose AI have applied since August 2025, and the high-risk system requirements were moved to December 2027 under the Digital Omnibus agreement of May 2026 [6][7]. There is time to climb deliberately. There is not time to climb twice.
The case against: ladders produce paper governance
The strongest argument against this framework deserves full strength, because much of it is right.
Start with the base rate. Gartner has predicted that 80% of data and analytics governance initiatives will fail by 2027, citing the absence of a real crisis to drive urgency [5]. Governance programs are where good intentions go to produce binders. A committee forms, a policy ships, usage continues unchanged. Practitioners have a name for this: governance theater.
Second, maturity models invite gaming. Self-assessment scores inflate because the scorer grades intention rather than evidence, and auditors accept artifacts over controls. A firm can pass every rung 3 test on paper and still leak client data through an unsanctioned browser tab, because the model scores the sanctioned path and ignores the actual one. IBM's 2025 data supports the skeptic here: 20% of organizations suffered a breach involving shadow AI, and those breaches exposed more PII than average [4]. The ladder said nothing about those tools because nobody scored them.
Third, the cadence is slow. One rung per quarter means a year or more before a rung 1 organization reaches rung 4. Shadow AI adoption happens weekly. The skeptic's prescription is simpler and faster: block by default at the network layer, allow-list approved tools, route everything through one chokepoint, and skip the framework entirely. Controls first, taxonomy later, if ever.
Our read
The skeptics are right about paper governance, and the ladder is designed to fail that test.
Every rung test asks for produced evidence: the log you can pull today, the key you hold, the drill you ran. A rung you cannot demonstrate is a rung you do not hold. That is the difference between a maturity model and an audit. It is also why we insist on the examiner's standard for scoring: grade what you can show, not what you intend.
The shadow AI objection is real, and it is an argument for the inventory step, not against the framework. You cannot score what you have not found, which is why Q1 starts with enumeration and why rung 3's egress control doubles as shadow AI detection: traffic that cannot reach an unapproved endpoint surfaces itself. The skeptic's "block by default" prescription is not an alternative to the ladder. It is rung 3 with fewer steps named.
One number worth keeping on the wall while you climb: $670K, the average added cost of a breach when shadow AI is involved [4]. That is the price of the unscored workloads.
What this means for you
- Score before you buy. One afternoon, one spreadsheet: every AI workload, rung tests applied. Most firms find their sensitive workloads one rung below where leadership assumed. That gap is the budget conversation.
- Finance: rung 3 is your examiner's floor. FINRA and SEC recordkeeping expects records you can produce from your own systems. If the log lives in a vendor console, you are at rung 2 with a regulated workload. Fix that first.
- Healthcare: PHI at rung 1 is a breach notification clock you have not heard yet. Get every PHI-touching workload to rung 3 before approving a single new use case.
- Legal and CPA/advisory: your clients already ask. Due-diligence questionnaires from corporate clients now probe AI data handling. Rung 2 contracts are the minimum to answer honestly; rung 3 for matter data is where the answers get easy.
- Report up in rungs, not percentages. Boards understand "we are at rung 2, rung 3 by Q2, and here is the specific risk that retires." If you want an outside score before you self-report, the Systemics Score measures where your workloads actually sit.
Book a free assessment: systemics.ai.
References
- "AI Risk Management Framework." National Institute of Standards and Technology, accessed August 2026. https://www.nist.gov/itl/ai-risk-management-framework
- "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)." NIST, July 2024. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
- "OWASP Top 10 for Large Language Model Applications, 2025 Edition." OWASP GenAI Security Project, 2025. https://genai.owasp.org/llm-top-10/
- "Cost of a Data Breach Report 2025." IBM Security, July 2025. https://www.ibm.com/reports/data-breach
- "Why Data Governance Fails in Many Organizations: The Accountability Crisis and Capability Gaps." DATAVERSITY, March 2026. https://www.dataversity.net/articles/why-data-governance-fails-in-many-organizations-the-accountability-crisis-and-capability-gaps/
- "AI Act: Shaping Europe's Digital Future." European Commission, accessed August 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- "C13-06 Proactive Security Behavior Monitoring (EU AI Act compliance timeline, Digital Omnibus)." OWASP AISVS, May 2026. https://github.com/OWASP/AISVS/blob/main/research/chapters/C13-Monitoring-and-Logging/C13-06-Proactive-Security-Behavior-Monitoring.md
Start with a free architecture assessment.
Thirty minutes, no slides. Tell us where your AI posture stands and we will tell you honestly whether we can help.