Cognitive Sovereignty in Trade: Governing the Infrastructure That Thinks for Us

Every generation of trade infrastructure has provoked the same underlying question in a new guise: who controls the systems that decide what moves, what stops, and what gets flagged for a second look. In the era of paper documentation, the answer was largely institutional, banks, customs authorities, and chambers of commerce held the pens. In the era of electronic data interchange and early digitisation, the answer became technical, whoever controlled the messaging standard, from SWIFT to EDIFACT, shaped what counted as a valid transaction.

We are now entering a third era, in which the deciding function is neither a person nor a message format but a model: a statistical system trained on data most trade participants have never seen, often hosted on infrastructure most jurisdictions do not own, and updated on a cadence largely determined by a concentrated set of model providers and system integrators, many of them based in a small number of countries.

This shift deserves a name of its own, because the governance problem it creates is qualitatively different from anything that preceded it. I will use the term 'cognitive sovereignty' to describe it: the capacity of an institution, a firm, or a state to understand, audit, and, if necessary, replace the artificial intelligence systems on which its consequential decisions depend.

The stakes of this question in trade are not abstract. A growing range of trade and compliance functions, including correspondent banking risk scoring, anti-money-laundering screening, tariff classification, customs targeting, cargo anomaly detection, and even the drafting and interpretation of trade documents, are migrating toward machine-learning systems. Many of these are hybrid architectures that pair traditional ML classifiers and rules engines with large language models for document intelligence, although supervised models still dominate core risk-scoring. When a customs administration in a mid-sized economy adopts an AI-assisted risk-targeting tool, it is very often adopting not a bespoke national system but a commercial product whose underlying model was trained on data that may bear little resemblance to that country's trade flows. Despite that shortcoming, regulatory and procurement pressures are beginning to require at least partial explainability and audit rights for high-risk deployments. The administration gains speed and, in principle, accuracy. What it may quietly lose, in practice if not in law, is the operational capacity to explain, contest, or modify the basis on which a shipment was flagged. That loss is the crux of the cognitive sovereignty problem, and it is worth being precise about what it does and does not include.

We are now entering a third era, in which the deciding function is neither a person nor a message format but a model: a statistical system trained on data most trade participants have never seen, often hosted on infrastructure most jurisdictions do not own, and updated on a cadence largely determined by a concentrated set of model providers and system integrators, many of them based in a small number of countries.

From Using Technology to Losing the Capacity to Govern It

There is an important and frequently collapsed distinction between using foreign technology and losing the capacity to govern it. Trade has always run on imported technology, container cranes, satellite positioning, telecommunications backbones, without this being treated as an existential sovereignty concern, because in most of those cases the importing institution retained the ability to inspect, maintain, replace, or regulate the technology domestically, even if it could not manufacture it. A port authority does not need to build its own satellites to govern how GPS data is used in its terminal operating system; it can audit the integration, switch providers, and impose local rules on data handling. The concern with cognitive infrastructure is that several of these safeguards are harder to exercise. Foundation models are largely opaque by construction, their behaviour emerges from billions of parameters shaped by training data and reinforcement processes that resist full interpretability. However, techniques such as mechanistic interpretability, SHAP, LIME, and retrieval-augmented generation (RAG) are increasingly enabling enterprises to trace reasoning and inspect sources, though meaningful auditability remains a significant challenge. Switching costs are high because compliance workflows, staff training, and institutional trust accumulate around a specific system over years. And the training data itself is rarely available for inspection, which means an importing institution cannot verify whether the model's judgements about, say, high-risk trade corridors or shell-company typologies reflect a genuine risk signal or an artefact of what the training corpus happened to contain.

This matters acutely for compliance, risk assessment, and customs decision-making because these are precisely the functions in trade that carry legal consequence. A bank that declines a correspondent relationship on the recommendation of an AI screening tool, a customs officer who holds a shipment because an algorithm scored it as anomalous, or a trade finance institution that prices country risk using a machine-generated score are all making decisions that affect market access and, in some cases, due process rights. If the institution making that decision cannot explain the basis for it beyond "the model said so", it has not simply adopted a tool; it has outsourced a portion of its regulatory and fiduciary function to a system it does not govern.

This is the sense in which opaque dependencies differ from ordinary technological reliance: the dependency is not merely operational but epistemic. The institution no longer fully knows why it believes what it believes about a counterparty or a shipment, because the reasoning happens inside infrastructure it cannot open.

The Structural Concentration Behind the Dependency

This epistemic dependency is compounded by a structural one, because the layers beneath any given AI application are themselves highly concentrated. Advanced AI accelerator chips are designed predominantly by a very small set of firms, with one designer (NVIDIA) accounting for the vast majority of data centre AI accelerator revenue, and fabricated at leading-edge nodes overwhelmingly by a single foundry (TSMC). Cloud infrastructure is concentrated among three global hyperscalers (AWS, Azure, and Google Cloud), with a fourth (Alibaba Cloud) significant in some regions and a small set of specialised neoclouds emerging for frontier training, foundation models with broad, cross-domain reasoning capabilities are now being embedded, often via fine-tuning or API integration, into trade compliance products, which are produced by a comparably small set of labs. This is not a moral indictment of concentration as such, economies of scale in compute are real, and no single national market, with the exception of the very largest, could plausibly replicate this stack domestically at competitive cost. But it does mean that when a trade ministry, a customs union, or a regional development bank builds policy infrastructure on top of AI, it builds on a foundation whose ownership, governance, and continued availability sit substantially outside its jurisdiction.

The consequence for trade policy autonomy is subtle but real. Export control regimes on advanced semiconductors, for instance, do not only affect a country's ability to manufacture AI chips domestically; they affect the terms on which that country can access the cloud compute needed to run or fine-tune models for its own trade administration.

A state that finds itself on the restricted side of such controls does not merely fall behind technologically, it finds a growing share of its trade facilitation and compliance infrastructure effectively licensed to it by decision-makers in another jurisdiction, decisions made primarily for reasons unrelated to that state's own trade objectives, such as national security, geopolitical strategy, or commercial priorities. This is a genuinely new vector of exposure for trade policy, distinct from tariffs, sanctions, or traditional non-tariff barriers, because it operates one layer beneath the policy instruments themselves, in the infrastructure that produces the analysis on which those instruments are set.

The consequence for trade policy autonomy is subtle but real. Export control regimes on advanced semiconductors, for instance, do not only affect a country's ability to manufacture AI chips domestically; they affect the terms on which that country can access the cloud compute needed to run or fine-tune models for its own trade administration.

Digital Rent and the New Competitiveness Gap

It is useful to think about the resulting global landscape in terms of a distinction between cognitive infrastructure owners and cognitive infrastructure tenants.

The owners are a concentrated set of jurisdictions and firms, though this group is expanding as sovereign AI programmes scale to control frontier computers, frontier models, and the cloud platforms on which both run. Everyone else, in practical terms, pays what can reasonably be called digital rent, which involves recurring payment, primarily in currency, with data often serving as an additional input that, under certain contractual and regulatory regimes, can be used to improve the owner's models.

The models themselves are produced, hosted, and updated elsewhere. This is not a wholly novel arrangement, it echoes earlier debates about technology transfer and dependency in development economics, but the AI version has two features that make it more consequential for trade competitiveness specifically. First, the rent is increasingly embedded in functions that determine market access itself, such as automated compliance and risk scoring, rather than merely in productivity tools; a firm or country that cannot access competitive cognitive infrastructure may find its exporters facing higher compliance friction, longer clearance times, or a diminished ability to participate in AI-mediated supply chain visibility platforms that trading partners increasingly expect as a condition of doing business. Second, the rent compounds, because in some architectures and contractual regimes, the data generated by tenant institutions’ use of these systems can flow back to improve the owner’s models, widening the capability gap over time. In others, data residency and sovereign-cloud rules limit or prevent this feedback loop, which means local models cannot improve as quickly, widening the capability gap between the global leaders and local deployers over time. Some jurisdictions have read this dynamic clearly and are responding with sovereign or regional AI infrastructure strategies specifically framed around reducing this exposure, sovereign cloud initiatives in the Gulf, national AI compute strategies in India and Japan, and the European Union’s push for domestic foundation-model capacity and tighter controls on data location and cross-border transfers are all, in different ways, attempts to move institutions from the tenant category toward something closer to co-ownership, even if full ownership of the frontier stack remains realistic for only a handful of economies. What is notable in the trade context specifically is that several of these initiatives are being justified not primarily in terms of general digital sovereignty but with direct reference to the risk that foreign-controlled systems could increasingly mediate customs, sanctions screening, and trade finance decisions, a sign that trade policy communities are beginning to treat cognitive infrastructure as a trade competitiveness issue in its own right, alongside more familiar concerns like logistics infrastructure or tariff schedules.

The owners are a concentrated set of jurisdictions and firms, though this group is expanding as sovereign AI programmes scale to control frontier computers, frontier models, and the cloud platforms on which both run. Everyone else, in practical terms, pays what can reasonably be called digital rent, which involves recurring payment, primarily in currency, with data often serving as an additional input that, under certain contractual and regulatory regimes, can be used to improve the owner's models.

The Regulatory Paradox

The instinctive policy response to opaque AI dependency is to legislate transparency, auditability, and accountability requirements, and this instinct is broadly correct. Yet there is a genuine paradox embedded in how such rules tend to be designed, one that anyone drafting trade-adjacent AI governance needs to sit with rather than wave away.

Robust auditing regimes, model documentation requirements, and liability frameworks for high-risk AI systems are, almost by construction, expensive to comply with.

The compliance burden of demonstrating that a model meets a defined standard of explainability, bias testing, or documentation is one that large incumbent providers, with dedicated legal and compliance teams and the scale to amortise the cost across millions of users, can absorb far more easily than a smaller or newer entrant, let alone a public-sector body attempting to build sovereign capacity. The European Union's approach to high-risk AI systems, which explicitly captures credit scoring and certain law-enforcement and critical-infrastructure uses that often intersect with trade-related compliance, illustrates the tension well: the intent is unambiguously protective, but the practical effect of the high fixed compliance costs, despite some SME-targeted proportionality measures, is often to raise the barrier to entry for the dominant providers. The same dynamic recurs in miniature whenever a trade body proposes certification standards for AI-assisted customs or compliance tools; well-meant standards, if drafted without attention to who can realistically meet them, risk becoming a mechanism that entrenches the very concentration they were meant to counterbalance.

This does not argue against regulation; it argues for regulation designed with sovereignty and market structure explicitly in view, not only safety and consumer protection. Tiered compliance obligations calibrated to institutional scale, public investment in shared auditing infrastructure and open evaluation benchmarks, approaches already floated in EU policy debates, that smaller providers can use rather than having to build proprietary equivalents, and procurement rules that require a demonstrated minimum of explainability and portability rather than mandating a specific technical architecture, are all approaches that preserve accountability without quietly reinforcing incumbency. Trade institutions writing standards in this space, customs unions, regional trade bodies, and standard-setting organisations adjacent to digital trade documentation, have a genuine opportunity to get this balance right before the market structure of AI-mediated trade compliance calcifies further.

Robust auditing regimes, model documentation requirements, and liability frameworks for high-risk AI systems are, almost by construction, expensive to comply with.

Toward an Institutional Definition of Cognitive Sovereignty in Trade

None of this implies that every trading nation needs its own general-purpose foundation model with frontier-level capabilities, which is neither realistic nor, for most economies, an efficient use of capital.

Cognitive sovereignty, properly understood, is not technological autarky. It is closer to a set of institutional capacities: the ability to audit a system's outputs against domestic legal and risk standards even when the system was not built domestically; contractual and technical arrangements that permit switching providers without catastrophic disruption to compliance operations; a minimum in-house technical literacy sufficient to interrogate a vendor's claims rather than accept them uncritically; and participation, through regional coalitions where individual capacity is insufficient, in the governance conversations that set the standards these systems will eventually have to meet.

For trade institutions specifically, this suggests a practical agenda: treating explainability and portability as procurement requirements rather than aspirations, investing in shared regional auditing capacity rather than each jurisdiction attempting to replicate it alone, and insisting that AI-mediated decisions with legal consequence, a held shipment, a declined correspondent relationship, a denied preferential origin claim, remain contestable on grounds a human institution can articulate, not merely on the authority of a score. The infrastructure of intelligence is going to keep concentrating; the question worth settling now is whether the institutions that depend on it retain enough leverage to govern it or simply enough access to rent it.

Cognitive sovereignty, properly understood, is not technological autarky. It is closer to a set of institutional capacities: the ability to audit a system's outputs against domestic legal and risk standards even when the system was not built domestically; contractual and technical arrangements that permit switching providers without catastrophic disruption to compliance operations; a minimum in-house technical literacy sufficient to interrogate a vendor's claims rather than accept them uncritically; and participation, through regional coalitions where individual capacity is insufficient, in the governance conversations that set the standards these systems will eventually have to meet.