Could New Zealand Develop Its Own AI Models? The Case for Sovereign AI

A VicAI explainer on what "sovereign AI" means for New Zealand, and whether building our own is realistic.

You hear the phrase "sovereign AI" a lot these days. The idea behind it is simple. Rather than renting our artificial intelligence from a few large overseas companies, a country could own, run, and govern its own systems closer to home. For a small nation at the bottom of the world, that might sound either exciting or faintly ridiculous, depending on your mood. Either way it is worth taking seriously, so let us ask the obvious question. Could New Zealand do this?

This post walks through why people are starting to take the idea seriously, why it is more achievable than it first appears, what the word "sovereign" really covers once you look closely, and the problems that would make it difficult.

Why would we want our own models at all?

Almost every large language model New Zealanders use today comes from overseas, and most of it comes from a small group of companies in Silicon Valley. A couple of years ago that was simply how the technology worked, because there was only one serious provider and no alternative to speak of. Now it is a choice we are making by default, and a choice like that deserves a second look.

If you assume, as seems fair, that the New Zealand economy and culture will lean on these tools increasingly over time, then importing all of them brings a few different kinds of risk.

The first is economic. Money spent on an imported model service leaves the country, and as our dependence grows, so does the outflow. If we built local models and people used them, some of that spending could stay onshore, and a good system might even open export opportunities instead of being a pure cost.

The second is about security, and it has two sides. One side is data. When a model runs on servers sitting overseas, the prompts and documents you feed it can travel offshore as well, which is a real concern for sensitive government and institutional information. The other side is dependence itself. If we came to rely on these tools so heavily that switching them off would cause serious damage, then whoever controls the switch would hold leverage over us, and that leverage could be traded for political or economic concessions. We already talk about food security and energy security. AI security may end up on the same list.

The third is privacy, which is really the data point applied to individuals and communities rather than the state. Personal information routed through an overseas service is information you no longer fully control, and for a lot of people and communities that loss of control is the heart of the problem.

The fourth is political. Models quietly carry the values of whoever built them. This is not a conspiracy theory, and it shows up when researchers test for it. Some models will not discuss certain historical events, while others carry a recognisable national slant. As these tools become the layer through which more of us read, write, and make sense of the world, on top of an information ecosystem already heavily shaped by algorithms, that built-in ideology becomes a form of influence nobody voted for.

A way to frame this for the worriers

New Zealanders are, by international standards, wary of AI. So, there is an obvious tension. How do you sell an active programme to build these systems to people whose first instinct is to keep them at arm's length?

The most convincing framing is a defensive one. Generative AI is arriving whether we like it or not, since it is far too useful. Regulation can blunt some of the sharper edges, but as a country that only consumes overseas models, our control is crude. We can ban a tool outright, or we can ask its makers to change something and hope they agree. There is very little in between, and almost no transparency to check what is going on.

Building our own changes that. If a model runs locally, we set the rules. The risks above, from data leakage to exploitable dependence to imported ideology, all become easier to manage when the system is sitting on our own infrastructure under our own jurisdiction.

It is more achievable than it used to be

The instinctive objection is cost. Surely training a competitive model means a budget in the tens of billions and a data centre the size of a small town? That was roughly true a couple of years ago. Three developments have shifted the picture.

The first is open-weights models. Several major developers now release the trained weights of their models to the public. You do not get the full training data or methods, but you get the finished model, which you can download and run. IBM’s Granite, Meta's Llama family, China's DeepSeek, and national efforts such as Switzerland's Apertus are all open in this sense. Apertus is a useful example. It was developed by Swiss public research institutions and released in 8 billion and 70 billion parameter versions under a permissive licence, trained on around 15 trillion tokens across more than a thousand languages with a deliberate 40 percent non-English mix. What matters for us is that a sovereign model no longer must be built from nothing. A far cheaper route is to take an existing open-weights model and fine-tune it for local needs.

The second is efficiency. Newer architectures and training techniques have made models noticeably cheaper to train and to run than the early giants were. The budget you need to get a useful result keeps falling.

The third is the shift toward agentic systems. A lot of research energy has moved away from building ever-larger standalone models and toward wrapping a model in infrastructure that lets it search the web, read and write to databases, run code, and call other models. A nice side effect is that the model at the centre of such a system does not have to be huge, because the tools around it make up for its limits. Smaller language models become perfectly workable building blocks.

Add these together and a credible localised model starts to look like a low-millions-of-dollars project rather than a ten-of-billions one. Sweden's national model, for instance, was trained on a modest cluster of GPUs within a budget and timeframe that a well-resourced research sector could match. New Zealand has a relevant advantage too, namely comparatively clean, renewable electricity, which matters once you are running power-hungry GPUs around the clock. What we cannot do is the full supply chain. We will not be mining our own minerals or fabricating our own chips. But nobody sensible is suggesting we need to.

What does "sovereign" mean?

This is where the conversation usually goes off the rails. If sovereign AI means a single new foundation model, built by the government, owned by the government, and run by the government, then a bit of scepticism is healthy, because that is an enormous and brittle undertaking. But sovereignty does not have to mean that, and pulling the word apart helps.

For one thing, sovereignty is not only about the nation-state. It can apply to communities, institutions, iwi, and organisations sitting all the way up and down the chain, with different groups sovereign over different things. For another, sovereignty is not the same as isolationism. A small trading nation protects its sovereignty through interdependence and a good place in the international system, not by closing the borders. Total supply-chain isolation is neither possible nor desirable. And a sovereign model does not have to be a brand-new model. It might come from fine-tuning and customisation, or even from context. an ordinary model that has excellent access to the local information it needs to answer questions well can be more genuinely sovereign than a powerful model that knows nothing about us.

It helps to treat sovereignty as a blend of factors rather than a simple yes or no. Where is the model hosted, and under whose jurisdiction? Can it be switched off by someone who decides they do not like us? How affordable and equitable is access? What about privacy and information security, governance and oversight, how customisable it is, and how well it fits local values? There are upstream and downstream effects too, since a model hosted here but guzzling water and power against the wishes of the community around it is not much of a win. One slightly surprising point is that a lot of these factors already appear in our existing policy and regulatory landscape. The raw ingredients are mostly on the shelf already.

The hard part: one big bet, or an ecosystem?

Picture trying to do all of this as a single vertical, one government-led project that has to line up, all at once, data acquisition with its intellectual property and consent headaches, then curation, training, content moderation, fine-tuning, compute, energy and water, legal liability, corporate governance, cybersecurity, access control, funding, and future innovation. Each of those layers is complex and contested on its own. Stacking them into one moonshot means any single layer can bring the whole thing down, and it concentrates the incentives so narrowly that hardly anyone outside the project has much reason to want it to succeed.

A more promising approach is pluralistic. Treat sovereign AI as a set of horizontal layers with several verticals running through them. Some groups might specialise in curating New Zealand training data. Others might just provide compute. Others might focus on model assurance, or governance, or cybersecurity, or legal liability. There is no single point of failure, the risk and cost are spread across the ecosystem, and many more people end up invested in making it work. Sovereign AI then becomes less about building one cathedral and more about pointing an existing distributed ecosystem toward a shared goal. You end up with several models, several providers, and several oversight bodies, which is both more realistic and more in keeping with how we tend to organise most other things.

The genuinely tricky questions

None of this is easy, and it is worth being upfront about the snags.

Take adoption. A sovereign model that nobody uses is pointless, because it just sits there while the money keeps flowing offshore. Some national models have struggled badly for uptake, with adoption rates down in the low single digits. A model that is good enough to be chosen on its merits is the only version that works, and a mandate forcing a mediocre tool on people will fail. One unexpected help here is that every time an overseas provider behaves erratically, the case for a trustworthy local alternative gets a little stronger.

Then there is ecosystem lock-in. A language model on its own does not trap you. But most of our institutions live inside a wider software ecosystem of operating systems, office suites, and learning platforms that is overwhelmingly imported. Swapping the model is easy. Extracting yourself from everything around it is not. This is exactly why the European push for digital sovereignty has gone well beyond AI. France, for example, is moving millions of public-sector users off United States videoconferencing tools and even off Windows toward open-source alternatives and has told its ministries to map and cut their foreign tech dependencies across operating systems, cloud, and AI. Open standards and open source are a big part of any honest answer here.

Representative data is another. Building a model that reflects the people of New Zealand means assembling training data that represents them. The obvious public archives are not necessarily representative, and deciding whose data counts as "New Zealand" is an inherently political question. The answer is the same as it usually is for political questions, which is pluralism and multiple approaches rather than one official dataset handed down from above.

Copyright and liability are unresolved and consequential too. Whose content can lawfully train a model, and who is responsible when a model says something harmful, are not questions a technical team can quietly settle. They need an open debate about what is acceptable.

Explainability rounds out the list. A raw language model is close to a black box. An agentic system is much easier to follow, because it is a traceable sequence of steps. It searched this, queried that, wrote this, and if you run it locally you can require all of that to be logged and inspected. Open weights also support interpretability techniques that let you locate and adjust specific concepts inside a model. Transparency is far more reachable locally than it ever is with a closed overseas service.

Public, private, or both?

Who should own a local model? One appealing idea is a public utility, developed and maintained by the state under a charter of independence, in the spirit of a public broadcaster. Public models also lend themselves to democratic methods of alignment. The value judgements used to tune a model could be drawn from the public through opinion polling and participatory methods, sampling people's views rather than imposing a single designer's preferences, and without flattening the real diversity of opinion into a bland average. That offers a kind of accountability you can never get from a private overseas product, because the model behaves as it does on account of what New Zealanders said.

There is a reality check, though. These are still expensive systems. It is not realistic to expect every small organisation or community to stand up its own, which is another argument for an ecosystem of trusted shared infrastructure and trusted partners rather than either a single government monolith or a free-for-all.

So, can we?

The honest answer is yes, probably, but not by trying to out-build Silicon Valley. The prize is not a New Zealand ChatGPT going head-to-head on raw power. It is a coordinated, pluralistic ecosystem that gets the sovereignty factors right, covering local hosting and jurisdiction, customisation to local context, real data control, accountable governance, and the literacy to use the thing well.

That last point matters most, because none of the rest counts for much if people cannot use the tools properly. The highest-leverage thing we could do right now is not training a model at all. It is building capability and AI literacy across both ordinary users and technical practitioners, so these systems get deployed sensibly. A perfect sovereign model that everyone uses badly achieves nothing.

If there is a to-do list, it looks something like this. We need a coordinating vision that treats AI as a system rather than a product. We need better information about how much compute and capability we have onshore. We need genuine whole-of-society collaboration rather than government talking to itself. We need regulatory clarity that gives people the certainty to make big decisions. And we need someone, somewhere, with the mandate to pull the threads together and be accountable for the result.

It is a big, messy, deeply political picture. But this picture is just what infrastructure looks like before we decide it is worth building. Roads, pipes, power, public broadcasting, all of them were once new things that governments and communities chose to take responsibility for. The digital and AI realm is the newest entry on that list. The real question for New Zealand is not whether we can build sovereign AI. It is whether we decide it is ours to build.