TRARDI Framework · Part 03

Sovereign Exposure Review

Can the sovereignty of this system be verified?

Sovereign Exposure Review: six-dimension assessment of effective sovereignty. Hosting, dependencies, extraterritorial exposure, egress, reversibility, traceability. Version 0, 2026.

Sovereignty as a verified property

Sovereignty declared is not sovereignty verified. An AI system declared sovereign because it runs in a European data center may still expose data to extraterritorial legal regimes through a single vendor, a shared control plane, or an unaudited egress path. A Sovereign Exposure Review measures effective sovereignty: what holds under stress, not what a diagram claims.

The six sovereignty dimensions

Each dimension is rated 1 to 5 on an exposure scale where 5 means minimal exposure and 1 means full exposure.

01

Hosting & data residency

Where data physically resides, which legal jurisdictions apply, whether residency is contractually enforced.

Key checks

  • Physical data center location documented and verified
  • Contractual data residency clause in place and enforceable
  • Backup and disaster-recovery sites in compliant jurisdictions
  • Data movement events logged with jurisdiction tagging
02

Vendor dependency graph

Full supply chain of third-party services the system depends on, directly or transitively.

Key checks

  • Full vendor graph mapped, including transitive dependencies
  • Each vendor rated on sovereignty impact and criticality
  • Vendor substitutability assessed per critical dependency
  • Vendor change events trigger sovereignty re-review
03

Extraterritorial exposure

Exposure to foreign legal regimes (CLOUD Act, FISA 702, equivalent laws) and their implications for data access.

Key checks

  • Vendors subject to CLOUD Act or FISA 702 identified
  • Data classified for extraterritorial sensitivity
  • Legal mitigation measures documented (encryption, SCC, BCR)
  • Residual exposure quantified and accepted by named risk owner
04

Access control & egress

Who can technically access the data, what leaves the perimeter, under what conditions egress is authorized.

Key checks

  • Access control at identity, network, and data layers
  • Egress paths enumerated and monitored
  • Logging of cross-border data transfers
  • Zero-trust posture verified against threat model
05

Reversibility & substitutability

Ability to migrate away from current providers, timeframe, cost, and functionality loss estimates.

Key checks

  • Exit plan documented per critical vendor
  • Data portability tested within the last year
  • Time-to-migrate estimated per dependency
  • Substitutable alternatives identified and pre-qualified
06

Traceability

Ability to prove the above properties over time, not only at audit moment.

Key checks

  • Sovereignty posture re-reviewed at defined cadence
  • Change events that affect sovereignty logged
  • Sovereignty evidence pack maintained continuously
  • Automated drift detection where feasible

Auto-elevation rules

Three conditions trigger automatic high or critical severity, regardless of composite score.

Sensitive data exposed to CLOUD Act without encryption key custody

Critical finding

Legal access without technical mitigation is effective loss of sovereignty.

No documented exit plan for a critical vendor

High finding

Irreversibility equals permanent dependency.

Single-vendor dependency on critical path without substitute

High finding

No substitutability means no bargaining power if conditions change.

What you receive

A Sovereign Exposure Review produces five deliverables.

  • 01

    Sovereign exposure map (visual dependency graph with jurisdictional overlay)

  • 02

    Per-dimension scores with supporting evidence

  • 03

    Extraterritorial exposure heatmap

  • 04

    Reversibility timeline per critical vendor

  • 05

    Remediation roadmap with prioritized exposure reductions

Typical duration

One to three weeks depending on dependency graph complexity. Simple single-vendor stacks: one week. Complex multi-cloud architectures with third-party AI models: three weeks.

Scope of this method

A Sovereign Exposure Review produces a private assessment for the client organization. It is not a sovereignty certification, not a legal opinion (legal advice is issued by qualified counsel), and not a substitute for formal regulatory review. It is the TRARDI discipline for measuring effective sovereignty beyond declaration.

Want to measure the effective sovereignty of your AI stack?

Book a 30-minute diagnostic

We will walk you through how the review would apply to a specific system and where the highest-exposure dimensions likely sit. No pitch.

Book a diagnostic