Who the Data Belongs To

Augmentation means something about data too. A system that genuinely extends people's capability gives them more agency over their work — including over the information that flows through it.

Most cloud AI deployments do not do this. Data transits foreign servers, passes through inference pipelines operated by large commercial interests, and contributes — through terms of service that few people read carefully — to training pipelines that benefit someone other than the client.

The Sovereignty Gap

This is no longer a minority concern. Civo's Digital Sovereignty Revolution report, based on a survey of over 1,000 UK IT decision-makers, found that 84% are concerned about geopolitical threats to data access, and 82% would switch from big tech for more data control. The same research revealed a striking visibility gap: just 35% of respondents said they have full insight into the jurisdiction where their organisation's data is hosted.

The legal dimension is not theoretical. With sweeping legislation such as the US CLOUD Act still in effect, many organisations find themselves unable to guarantee that their data won't be accessed or transferred without their knowledge, even if hosted outside US borders by big tech hyperscalers. Senior Microsoft employees acknowledged as much to the French senate in June 2025, admitting that the company cannot guarantee the sovereignty of European data stored and processed in its services.

Mark Boost, CEO of Civo, has stated the problem plainly: "Data sovereignty has become a marketing term and there is little to no legally agreed definition of what it means right now." The gap between what vendors claim and what organisations can actually verify is where the risk lives.

The Question Nobody Is Asking About SaaS

There is a question sitting underneath all of this that almost nobody in the SME technology conversation is willing to ask directly.

The major SaaS productivity platforms — Microsoft 365, Google Workspace, Salesforce — have been the operational backbone of UK small business for over a decade. Microsoft launched Office 365 in June 2011. That means the businesses who moved earliest have been running their email, documents, meetings, client communications, and financial data through these platforms for ten to fifteen years. More than 300,000 UK companies use Microsoft 365 alone.

The combined operational picture of UK small business, assembled across these platforms over a decade, represents an extraordinary concentration of commercial intelligence inside a small number of corporations.

Now consider what the leadership of those same corporations is saying. Mustafa Suleyman, CEO of Microsoft AI, has predicted human-level performance on most professional tasks within 18 months — naming accounting, legal, marketing, and project management as specifically vulnerable. His employer spent $80 billion on AI infrastructure in 2025 alone. Every major SaaS vendor is racing to embed AI agents directly into the workflows their customers already depend on.

The question nobody is asking is this: at what point does a platform vendor with ten or fifteen years of your operational data — your client communications, your pricing, your workflows, your supplier relationships — and the AI capability to understand and replicate all of it, become a competitive threat rather than a technology partner?

This is not a paranoid question. It is a structural one. The more unsettling long-term question is not whether AI replaces individual roles inside SMEs, but whether it eventually makes the SMEs themselves redundant. Why serve a market when you can model it?

What Locally Hosted AI Actually Means

For SMEs in Wales handling sensitive information about their clients, their staff, and their community, the data is not abstract. It is a small business's customer records. A care provider's service user notes. A solicitor's correspondence. Nearly half of those surveyed by Civo are already actively considering repatriating from the cloud — and that is among large organisations with dedicated IT functions.

Our locally hosted AI infrastructure is built around a different principle. Client data stays on our hardware, using open-source models that are publicly auditable and not connected to commercial training pipelines. When we tell a client their data stays here, we mean it literally — not as a promise about contractual terms, but as a description of the architecture. There is no CLOUD Act exposure. There is no ambiguity about jurisdiction.

Augmenting people means giving them more capability and more control. Shipping their data to a server farm in Virginia while building them a productivity tool is not augmentation. It is a trade-off that has not been made explicit — and it is one that a growing number of UK organisations are no longer willing to make.