From sovereignty strategy to a real AI setup

An elegant paper-cut illustration of a small advisory firm’s controlled local AI setup: secure workstation, client library, human review and operational safeguards.

AI-assisted PathPatron illustration, developed under human art direction.

PathPatron has already explored the strategic question of sovereign AI. This article takes the next step: from principle to a practical setup that a small organisation can understand, build and govern.

Picture a 25-person advisory firm. Its teams prepare meeting briefs from client material, compare contract clauses, turn interview notes into structured actions and search a growing library of internal methods. The source material is confidential. The firm wants an assistant that works from that material without sending every page to an external AI service.

That assistant can now run on a small, dedicated computer under the firm’s control. Staff sign in with their normal accounts. The assistant finds only the documents each person is permitted to see, prepares a cited draft and hands it back to a human for judgement. The firm controls the data route, access rules, software updates and encryption keys.

This article follows that one firm through the practical decisions: what it could run on a small machine, what it needs to procure, who operates it and where the boundary sits. The companion briefing, Sovereign AI across five European regions, applies the same setup to Germany, France, the Nordics, the Netherlands and the United Kingdom.

Start with the strategy already on the table

This guide assumes a leadership team has already decided that some work merits more direct control. Three earlier PathPatron briefings provide the strategic context:

For the advisory firm, that strategy becomes a practical boundary: which client material must stay under the firm’s direct operation, which lower-risk work may use an external service, and what the firm can honestly promise clients about that distinction.

What a small, private AI service can do

For the advisory firm, OpenAI’s open-weight gpt-oss-20b could become the private research desk. A consultant selects the relevant client folder, asks for a meeting brief and receives a draft with links to the source documents. The same assistant can extract key terms from a contract, turn a call transcript into actions, or prepare a first answer to a recurring client question. OpenAI says gpt-oss-20b can run on edge devices with 16 GB of memory. The larger gpt-oss-120b calls for a professional workstation or server with a single 80 GB GPU. OpenAI: Introducing gpt-oss

Mistral Small 3.1 offers a useful image-and-text alternative. A consultant could upload a photographed invoice, a scanned workshop worksheet or a page from a client’s product manual. The assistant reads it, compares it with the firm’s approved knowledge base and prepares a structured note for review. Mistral says the model can run locally on a Mac with 32 GB of memory or a single RTX 4090 graphics card. Mistral AI: Mistral Small 3.1

For a first pilot, a Mac mini can sit in the firm’s office and serve a small group of colleagues. It runs the model, searches the approved documents and returns a draft into the firm’s own workspace. Leaders should focus on available memory rather than marketing labels. Apple: Mac mini technical specifications

Start with the work

Sovereign infrastructure serves a use case. The PathPatron Use-Case Canvas series provides the blueprint: bring the people who live with the work to the same table; start with one recent, recognisable case; and preserve the evidence it leaves behind.

Then map the work before you automate it: the hand-offs, systems, waits, exceptions, rework and control points. The final step turns the decisions into delivery-ready requirements.

For example: Prepare a cited first draft of a response to a customer support case, using only the product documentation and prior cases that the support agent is allowed to see. A human sends the answer. The team can now choose an appropriate route for that work.

The minimum viable local architecture

People using the service
        │  sign-in, roles and multi-factor authentication
        ▼
AI front door
        │  applies access rules, records use, limits risky requests
        ├── local AI model
        ├── approved document search
        ├── secure document store
        └── tightly limited connections to other tools
        │
Backups, encryption keys, monitoring, updates and incident response

The AI front door checks who is asking, which documents they may search and whether a request is permitted. The document search must respect existing permissions; an AI assistant must not become a back door into files someone could not otherwise open. Connections to email, a calendar or a database should begin read-only and require explicit human approval before consequential action.

What the advisory firm actually buys

Sovereign AI is not a product that arrives in a box. It is a set of boundaries deliberately designed around a piece of work. For the 25-person advisory firm, there are three credible starting packages.

Package 1: a private pilot for one bounded workflow

Procure: one 32–64 GB desktop-class machine, such as a suitably configured Mac mini; an encrypted backup drive or destination; a small network protection device; and a local AI application that can run an approved model and search one approved document collection. If the firm has no one who can securely set up identity, permissions and backups, add a short implementation engagement.

Operate: one business owner decides what the pilot is for and which documents may enter it. One technically capable person or retained support partner installs updates, checks backups and manages administrator access. Five to ten named users test it. The assistant drafts; a person remains responsible for every client-facing output.

Boundary and budget: the model and client documents can remain technically local. Strong sign-in, encryption and blocked outbound connections are configuration controls that must be checked. Plan roughly €1,500–€3,500 for equipment before VAT, internal time and specialist support.

Do not use this for: a whole-company knowledge base, unattended use, high availability, or automatic access to email and business systems.

Package 2: a team service for recurring confidential work

Procure: a dedicated GPU workstation or small server; encrypted storage for the approved document collection; a separate encrypted backup destination; a firewall; identity integration; and a document-search layer that enforces existing permissions. Add monitoring, a protected administrator account and a support agreement with someone who can restore the service when it fails.

Operate: the business owner owns purpose and policy. A technical operator owns patching, access reviews, monitoring and recovery. A tester checks that the assistant cannot retrieve an unauthorised client document and that cited answers point to real sources.

Boundary and budget: the firm has a stronger technical and operational boundary, provided it holds the keys, approvals and records. Plan roughly €5,000–€15,000 for initial equipment and setup, excluding VAT, electricity, support and internal time.

Do not use this for: a promise of uninterrupted service without resilience investment, or a claim that local hosting automatically solves every legal or supply-chain dependency.

Package 3: a controlled hybrid for local confidentiality and occasional scale

Procure: the team service above, plus a separately assessed regional provider for lower-risk or peak work. Build a routing rule into the AI front door: client folders, sensitive notes and internal methods stay on the local service; material approved for the external route may use the provider.

Operate: the business owner decides which classes of work may leave the local environment. The technical operator reviews the provider’s data-processing terms, region, support access, subcontractors, encryption-key arrangement and transfer position. The tester periodically proves that a sensitive document cannot be routed externally by mistake.

Boundary and budget: confidential work keeps a local technical boundary. The external route has contractual, regional and configuration controls, not the same physical separation. Initial local equipment is normally in the €5,000–€15,000 range, plus external-service and operating costs.

Do not use this for: sensitive work where the firm cannot define a safe external route, or where it lacks the discipline to maintain and audit the classification rule.

What “fully edge” still demands

An offline-capable box offers control only if the surrounding practices are equally disciplined: no routine outbound route from the model and document-search system; separate accounts for everyday use and administration; encryption for storage, backups and network traffic; tested restores; reviewed updates; and no autonomous access to consequential systems without clear limits and human confirmation.

“On our premises” describes a location. Security comes from patching, protected administration, encryption, tested backups and clear operating responsibility.

A 30-day leadership plan

Week 0 — if the strategic boundary is not decided: Before beginning the pilot, decide which work needs more direct control and why. Making Sense of Sovereign AI: Questions to Ask Before You Invest helps leadership define that boundary; When AI Access Becomes a Sovereignty Question explains why access and provider dependence belong in the decision.

Week 1: Choose one bounded situation. Define the data involved, the people affected, the purpose, the owner and the rule for stopping. The Monday Morning Supplier Problem offers a practical way to start with a concrete piece of work and the people who carry it.

Week 2: Build a contained pilot. One model, one approved document collection, real sign-in and access rules, no autonomous actions. Test it with five to ten real cases. Requirements for AI-Enabled Work helps turn the workflow rules, permissions and acceptance tests into a delivery conversation.

Week 3: Test the uncomfortable cases. Try to make the system use a document it should not see. Test poor sources, a failed update and a backup restore. For the information boundary, Before You Ask AI for Sources, Decide What It Is Allowed to Know is the relevant companion reading.

Week 4: Compare evidence: usefulness, answer quality, response time, operating effort, failure modes and data exposure. Decide whether to scale locally, add a controlled regional provider or stop. Transformation Journey: From Pilot to Scale to Sustain offers the decision gates for that next step.

The leadership takeaway

The strategic question is already clear: retain meaningful choice over work that matters. The practical question is now answerable too: buy a bounded service, give it explicit permission boundaries and name the people who own its consequences.

For the country-by-country implications of this same setup, read the companion briefing: four ways to operate a sovereign research assistant — from a German local pilot to European and UK routes.

Primary sources

Editorial note: hardware pricing and service availability change. Recheck the investment bands and any proposed deployment immediately before procurement.