The State of Sovereign AI in Sri Lanka, 2026
As AI becomes infrastructure, how much of it does Sri Lanka actually need to control?
Artificial intelligence is becoming another layer of critical digital infrastructure. Companies are embedding it in customer service, software development, financial analysis, document processing, healthcare, marketing and internal operations, and governments are doing the same. Beneath almost every one of those applications sits a dependency that gets far less attention: where the intelligence actually runs.
For most Sri Lankan organisations today, using advanced AI means relying on infrastructure outside the country. A request may originate in Colombo, but the model that processes it, the compute behind it, and often parts of the surrounding application stack sit in Singapore, India, the United States or elsewhere.
What would it mean for Sri Lanka to have meaningful sovereignty over AI?
The answer is more nuanced than building a Sri Lankan version of ChatGPT. This report sets out what sovereignty means across five layers, where Sri Lanka’s policy actually stands, what four other jurisdictions have chosen, and, in one section near the end, what we have built. It is written by a company building infrastructure in Colombo, so it has an interest; it tries to keep what exists separate from what is possible throughout.
Sovereign AI is not isolated AI
There is no single accepted definition of sovereign AI. This report thinks about it across five layers, each a question with a checkable answer.
Sovereignty is therefore a matter of degree rather than a switch, and the layers can be held separately. Sri Lanka does not need to own every layer to become substantially more sovereign than it is today.
Where Sri Lanka stands today
Sri Lanka is at an early stage, and its own strategy says so. The National AI Strategy names infrastructure as a gap: the country has no large-scale data centre, no national AI cloud and no high-performance computing capability of the kind advanced AI applications need, and the energy supply behind them is part of the problem.
The direction is changing. In 2026 the proposed GovCloud 3.0 architecture took a position worth noticing: rather than recreating a hyperscaler, Sri Lanka would have global providers operate inside data centres over which the country has greater jurisdiction and control. The Government Cloud Policy takes the same line, naming data sovereignty as a principle while recognising the cost and the appropriate use of cloud infrastructure.
This may be the realistic model for a country of Sri Lanka’s scale: not owning every layer, but having the layers that matter operate under Sri Lankan control.
What the rest of the world is doing
There is no single sovereign-AI playbook. Different countries are choosing very different levels of independence, and the four below span the range.
National AI Strategy 2.0 names compute as one of ten priorities and pairs it with talent and research. The Enterprise Compute Initiative buys companies access through the global cloud providers rather than replacing them.
Secure access to compute; stay connected.
The IndiaAI Mission pooled more than 38,000 GPUs into shared national capacity, with a target of 100,000 by the end of 2026, and funds domestic foundation models alongside it.
Expensive infrastructure can be shared rather than built by every company alone.
AI Factories combine supercomputing, data and expertise; the InvestAI programme funds AI Gigafactories designed around roughly 100,000 advanced chips each, with tens of billions of euros mobilised.
Reduce strategic dependency, at a scale Sri Lanka neither can nor needs to match.
Abu Dhabi’s sovereign cloud runs global technology, Microsoft’s, on locally controlled infrastructure with sovereign controls layered on top.
Sovereignty through partnership: control the infrastructure and the data, keep using the best technology available.
The thread through all four is that AI sovereignty increasingly means controlling critical infrastructure and data while continuing to use the best technology available globally, not technological isolation.
The question is not whether we can build ChatGPT
Replicating a frontier AI lab would take capital, compute, energy and specialist talent on a scale Sri Lanka does not have. That is probably the wrong benchmark. A more useful question is how much of Sri Lanka’s everyday AI workload could run inside Sri Lanka, and the answer is likely to grow quickly.
Open-weight models are increasingly capable. They already handle much of what enterprises actually ask of AI: document extraction, classification, summarisation, retrieval, coding, translation and internal knowledge systems. Not every task needs the most powerful model in the world, and that opens a practical architecture.
Local models where privacy, residency, latency or control matter. Frontier models where maximum capability matters.
Sovereignty then becomes a choice made per workload rather than an absolute.
Geography still matters
Cloud infrastructure can feel locationless. In practice, distance still shows up in application performance, and it shows up twice: once between the user and the service, and again, more sharply, inside the application stack. Both were measured from our own infrastructure rather than taken from a benchmark.
Colombo is about five times closer than Singapore for a user in Sri Lanka. Bangalore is nearer than Singapore on a map and three times further on the network: latency follows routing and peering, not distance alone.
Keeping the application and its database together
The larger difference is between an application and its own database. When the two share a building, a query’s round trip is a fraction of a millisecond; when they sit in different regions it is tens of milliseconds, more than a hundred times as long.
That matters because a single page or request rarely makes one query. A real application makes five to twenty, often in sequence, and the network cost compounds.
None of this means a locally hosted application is automatically faster. Architecture, caching, database design, compute and routing all matter. What it shows is narrower and more useful: data residency and performance do not have to be competing objectives. For many workloads, keeping compute, application and data close together gives both greater jurisdictional control and lower latency.
Data sovereignty may be the bigger issue
For many organisations, sovereign AI will matter less because of speed and more because of data. Banks, government institutions, healthcare providers and large enterprises increasingly need to know exactly where sensitive information goes when their employees and applications talk to AI systems.
Sri Lanka’s legal position should not be oversimplified. The amended Act permits cross-border data flows where the applicable requirements and safeguards are met; it does not impose a blanket rule that personal data stay inside the country. Regulated sectors carry more. The Central Bank’s Banking Act Directions No. 16 of 2021 set a technology risk management and resilience framework for licensed banks that reaches their agents and third-party providers, and government policy is moving explicitly toward greater data sovereignty through its cloud and digital infrastructure initiatives.
This makes workload choice the practical question. An organisation may decide that public marketing content can use a frontier overseas model while customer financial records, internal documents or sensitive government information run locally. The infrastructure has to support both, and it has to be able to say afterwards which was which.
What realistic sovereignty could look like
Sri Lanka probably does not need an AI fortress. It needs options: the ability to run important applications, databases, AI gateways and increasingly capable open models domestically, so that sensitive workloads have a credible path to remaining inside the country.
At the same time, Sri Lankan businesses should keep using frontier models and global cloud infrastructure where those provide capabilities that cannot economically or technically be replicated locally. That is not a failure of sovereignty.
It is pragmatic sovereignty.
Singapore secures access to compute while remaining globally connected. India is pooling infrastructure. The Emirates combine sovereign controls with global technology. Europe is investing to reduce strategic dependency. Sri Lanka will need its own version, sized to its economy and its requirements.
Building the first pieces locally
Where we serve models today. One city, one model.
This is the problem we have been working on at Roar AI. Our objective is not to disconnect Sri Lankan organisations from global AI: the gateway provides frontier models from OpenAI, Anthropic and Google, and requests to those necessarily leave Sri Lanka, because the models are not hosted here. The question we wanted to answer was how much of the stack could operate locally.
| Layer | Where it is, September 2026 | Status |
|---|---|---|
| Application hosting | Our own machines in Colombo | In country |
| Databases | Provisioned beside the application, in the same building | In country |
| Backups | Encrypted and moved off the machine that made them; the region is agreed per deployment | By arrangement |
| AI gateway | A Colombo gateway, reached by Sri Lankan clients without leaving the country | In country |
| Model inference | Qwen3.8-27B, served from a GPU in Colombo | In country, one model |
| Frontier models | Claude, GPT and Gemini are answered overseas by their makers; a call to one leaves | Overseas |
For a workload that uses the locally served model, the application, its data and the inference all stay within Sri Lanka, and the gateway records where every call went. Residency as a written arrangement is available now for anyone who needs it (the terms, §9); some platform records are still held outside the country today, as the privacy policy states.
It is early. One locally hosted model is not a sovereign AI ecosystem, and Sri Lanka remains dependent on overseas technology across many layers of the stack. But it demonstrates something: AI sovereignty does not have to begin with a national foundation model or a billion-dollar GPU cluster. It can begin with local compute, local data, open models, strong controls, and the ability to decide when a workload stays here and when it goes elsewhere.
The next phase
The question over the next few years is unlikely to be whether Sri Lanka can become completely technologically independent. It cannot, and arguably should not try. The more important question is whether it can develop enough domestic capability that using overseas AI infrastructure becomes a choice rather than the only option.
Government initiatives such as GovCloud 3.0 suggest that conversation has started. The next stage will be determined by what gets built.
If residency is a requirement for you rather than a preference, it belongs in your contract, and we will put it there. Talk to us
- 1Sri Lanka National AI Strategy · Ministry of Digital Economy, Government of Sri Lanka
- 2GovCloud 3.0: Request for Information, Sovereign Hyperscaler and AI Cloud Platform · GovTech Sri Lanka, with the World Bank
- 3Personal Data Protection Act, No. 9 of 2022, and the Personal Data Protection (Amendment) Act, No. 22 of 2025 · Parliament of Sri Lanka
- 4Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks · Central Bank of Sri Lanka
- 5National AI Strategy 2.0 · Smart Nation Singapore
- 6IndiaAI Compute Capacity · IndiaAI Mission, Government of India
- 7AI Gigafactories call · European Commission
- 8Sovereign public cloud for Abu Dhabi · Microsoft and Core42
- 9Infrastructure measurements, Colombo, 2026 · Roar AI. The runs are in our engineering records and available on request.
Published by Roar AI, September 2026. This report combines publicly available government and industry material with observations and measurements from Roar AI’s work building AI infrastructure in Sri Lanka.