AI that never leaves the country

The word "sovereign" has become a marketing pitch; let us start by defining it seriously. A sovereign AI, in the sense we mean, brings together three conditions: the models run on infrastructure located in Morocco — your own servers or a qualified Moroccan data centre —, no data travels to a third-party service outside the jurisdiction, and the organisation holds the ability to audit and evolve the whole without depending on a single vendor.

Who genuinely needs it? First, the bodies whose regulatory framework requires it: critical infrastructure falling under Law 05-20, whose sensitive information systems answer to the DNSSI issued by the DGSSI. Next, those whose data by its very nature demands it: defence, internal security, sovereign state data, economic intelligence. Finally, those who make it a strategic choice: banks wishing to process customer data in-house without outsourcing, industrial groups protecting their intellectual property. For everyone else, a hybrid architecture — sovereign for the sensitive, cloud for the rest — is often more rational, and we say so plainly at the scoping stage.

Law 05-20 on cybersecurity has given Morocco a demanding framework for protecting the information systems of government bodies and operators of vital importance. Under the authority of the DGSSI, the National Directive on Information Systems Security translates this framework into concrete rules: classification of systems, segregation, control over service providers, and accreditation of sensitive systems.

For an AI project, these requirements have direct architectural consequences. Hosting: sensitive information systems call for controlled infrastructure on national soil, which points towards on-premise or Moroccan data centres meeting the applicable requirements. Segregation: inference, document indexing and logs must respect the separation of classification levels — a "restricted distribution" corpus does not share its index with public documentation. The software supply chain: open models whose weights are verified, audited dependencies, and controlled rather than automatic updates. We design every deployment so that it can be defended before your CISO and, where applicable, in an accreditation file.

A Hunter BI sovereign infrastructure assembles proven building blocks. The models: latest-generation open weights, selected according to your use cases and the French/Arabic/English trilingualism of your corpora, served by an inference engine optimised on GPUs sized to real load — we calibrate on your volumes, not on theoretical maxima. The RAG: indexing of your document repositories — regulatory texts, procedures, archives — with source citation, so that every answer is verifiable. The agents: tool-equipped automations via MCP on your internal systems, with full logging and human validation on sensitive actions.

The capability gap with cutting-edge proprietary models is real, but it narrows with each generation and, above all, it is rarely decisive for the internal uses being targeted: document search, summarisation, writing assistance, case-file analysis. An open model well equipped on your data beats a cutting-edge model that has no access to it. And the infrastructure stays adaptable: the weights can be swapped out, while the investment in indexing, connectors and governance remains.

Air-gapped deployment — fully disconnected — remains the exception, reserved for classified environments. Most of the sovereign architectures we deploy are connected but controlled: model and software updates pass through a controlled gateway, outbound flows are non-existent or explicitly authorised, and monitoring stays local.

This nuance matters for ongoing operational upkeep. A sovereign AI is not a project you deliver and then forget: models evolve, corpora grow, uses shift. So we structure every deployment with a maintenance plan: monitoring of open models, a qualification procedure for new versions, regression tests on your reference use cases, and skills transfer to your teams — the aim being that your autonomy is real, not merely contractual. That, too, is sovereignty: not replacing a dependency on the American cloud with a dependency on your integrator.