As artificial intelligence moves from research labs into the systems that run hospitals, banks and public services, governments around the world are asking a blunt question: who controls the algorithms? The answer is pushing a new policy idea into the mainstream — AI sovereignty — and it is forcing policymakers in Sri Lanka and other developing countries to balance security, economic opportunity and the costs of technological independence.

AI sovereignty describes the ability of a state to govern, host and—when needed—build the infrastructure, data systems, legal rules and human skills that determine how AI is developed and used within its borders. The concept has risen rapidly alongside two powerful trends: the concentration of AI capabilities in a handful of cloud providers and chipmakers, and the growth of laws and political pressure to keep strategic data and services under national control. Experts say that for resource-constrained countries, the choice is rarely full isolation or full reliance; instead, governments are pursuing hybrid approaches that protect critical systems while continuing to leverage global innovation. 

Sri Lanka’s starting point: strategy and regulation

Sri Lanka has already taken institutional steps that give it a runway to pursue a pragmatic sovereignty agenda. The government’s National AI Strategy and accompanying white paper lay out plans to expand secure, energy-efficient infrastructure, create shared AI platforms for public services, and fund needs-driven R&D. These documents position the state to make targeted investments rather than attempt an unaffordable, full-stack build-out. 

At the same time, Sri Lanka’s Personal Data Protection Act — now in force — gives regulators a legal framework for classifying and safeguarding personal data. That law equips authorities to require stricter handling of sensitive public registries (health, civil records, land) and to demand contractual protections from foreign vendors that process those datasets. For many policymakers, the PDPA is the leverage they need to insist on encryption, audit rights and data portability instead of blunt bans on outside cloud services. 

Why many countries are worried (and acting)

Several drivers make sovereignty more than an abstract priority. First, compute and model development is concentrated: a handful of companies control most advanced GPUs and hosted model platforms, creating chokepoints for access and pricing. Second, trade and foreign policy frictions can interrupt those supplies — recent export controls on high-end AI chips show how geopolitical tensions translate into technology scarcity. Third, data-localization and AI governance laws in large markets raise compliance costs for foreign firms and nudge governments to develop domestic alternatives. Together, these dynamics push states to think about who owns the infrastructure and the rules that govern it. 

Practical models: hybrid sovereignty in action

No viable strategy for a developing country currently recommends building everything in isolation. Instead, governments are experimenting with hybrid models:

• Selective protection — identify “crown-jewel” datasets (national health records, land registries, welfare rolls) and mandate onshore processing or strict contractual safeguards.
• Shared domestic platforms — create lightweight national stacks and model hubs for low- to medium-risk public services so startups and agencies can reuse infrastructure without duplicating costs. India’s push for a National AI Stack shows how a large developing country is trying to combine sovereign platforms with open interfaces to catalyse local innovation. 
• Strategic partnerships — use cloud and hardware partnerships with strong service-level agreements (SLAs), audit rights and migration paths rather than outright bans on foreign vendors.
• Regional pooling — cooperate with neighbours to host shared data centers and research hubs, lowering per-country costs and creating scale. The World Bank’s recent surveys encourage precisely this kind of pooled approach for lower-income countries. 

The costs and risks

Sovereignty is not free. Building local compute capacity and specialist talent is capital-intensive. Heavy-handed localization rules can deter private investment and slow access to the latest models, and excessive protectionism risks isolating domestic researchers from global scientific collaboration. Conversely, doing nothing leaves a country vulnerable to opaque algorithms shaping public services, vendor lock-in, and supply shocks for key hardware. Policymakers must therefore weigh which risks they are best placed to accept and which they must mitigate. 

What Sri Lanka and similar states can do now

Experts and policy documents converge on a practical short list:

1. Operationalize data classification under the PDPA so that critical public datasets receive the strongest controls and procurement rules. 
2. Build a lightweight public AI stack for non-sensitive services — a library of reusable pipelines, language models adapted to Sinhala and Tamil, and model-ops tooling that lowers the barrier for government and SMEs to deploy AI responsibly. 
3. Negotiate stronger vendor contracts that guarantee encryption at rest and in transit, auditability, and transparent incident reporting rather than pursuing blanket bans on foreign clouds.
4. Invest in people through short technical courses, postgraduate scholarships, and incentives for the diaspora to return or collaborate — because sovereignty ultimately rests on talent, not servers. 
5. Pursue regional burden-sharing to host compute and research infrastructure jointly with like-minded neighbours, lowering costs and increasing bargaining power. 

The headline: sovereignty, not seclusion

The emerging policy thread is clear: sovereignty should be selective and strategic. For Sri Lanka — and many other developing countries — the objective is not technological autarky but resilience and agency: keep control over the most sensitive systems and data, create public goods that local businesses can use, and stay plugged into global research and markets where it accelerates national development.

As global competition over chips, platforms and models intensifies, countries that set clear rules, invest in modular public infrastructure, and build domestic skills will be better positioned to steer AI’s benefits toward public goals — without being locked out of the global innovation economy. In short, the next chapter of development policy may be written in code, but its authorship will depend on law, strategy and people.