SovAIHub

All training and inference data is classified by sensitivity level

Data residency requirements are documented per data class

PII and regulated data is identified and access-controlled

Data does not leave approved network boundaries during inference

Ingestion pipelines strip or mask sensitive identifiers before embedding

Retention and deletion policies exist for vector store content

Access logs are maintained for all document and data access

Third-party data sharing agreements reviewed for AI workloads

Model sovereignty tier is defined (Fully Sovereign / Conditional / Not Sovereign)

Approved model list exists and is version-controlled

Self-hosted models are deployed on infrastructure the organisation controls

Cloud-managed models are within tenant boundary with data residency verified

Model update and version change process is documented and approved

Fallback model or degraded-mode behavior is defined

Model licensing reviewed for commercial and enterprise use

AI services are deployed in isolated environments (containers, namespaces, or VMs)

Secrets, API keys, and credentials are managed via a secrets vault

Network egress is restricted for AI service containers

Infrastructure-as-code exists for all AI service deployments

CI/CD pipeline includes security scan and approval gate before AI service release

Rollback procedure is documented and tested for AI service deployments

Environment separation enforced: development, staging, and production are isolated

GPU or compute resources are sized and monitored with alert thresholds

AI use policy is documented and approved by leadership

Approved use cases are defined — prohibited uses are explicitly listed

Human review process exists for AI outputs before they affect decisions

Audit trail captures prompts, retrieved sources, responses, and user identity

Incident response procedure exists for AI system failures or harmful outputs

Regulatory obligations (GDPR, HIPAA, AI Act) mapped to AI system controls

Risk assessment completed for each deployed AI use case

Vendor and third-party AI tools reviewed against data processing agreements

AI system inventory is maintained and reviewed quarterly

Hallucination detection or source-grounding check is implemented

Response confidence scoring or uncertainty signalling is in place

Prompt injection and jailbreak input validation is active

Output filtering for sensitive content categories is configured

Evidence citations are returned with answers where retrieval is used

Token usage is tracked per user, service, and model

Inference latency is monitored with SLA thresholds defined

Monthly AI cost is reported and reviewed against budget

Retrieval quality metrics (relevance, recall) are measured for RAG workloads

Alerts configured for cost spikes, latency degradation, and error rates

Evaluation runs are scheduled to detect model quality drift over time

Sovereign AI Readiness Checklist