The State of Sovereign AI in Sri Lanka, 2026
As AI becomes infrastructure, how much of it does Sri Lanka actually need to control?
Artificial intelligence is becoming another layer of critical digital infrastructure. Companies are embedding it in customer service, software development, financial analysis, document processing, healthcare, marketing and internal operations, and governments are doing the same. Beneath almost every one of those applications sits a dependency that gets far less attention: where the intelligence actually runs.
For most Sri Lankan organisations today, using advanced AI means relying on infrastructure outside the country. A request may originate in Colombo, but the model that processes it, the compute behind it, and often parts of the surrounding application stack sit in Singapore, India, the United States or elsewhere.
What would it mean for Sri Lanka to have meaningful sovereignty over AI?
The answer is more nuanced than building a Sri Lankan version of ChatGPT. This report looks at sovereignty across five layers: compute, models, data, control and capability. It examines where Sri Lanka stands today, what other countries are doing, and what a realistic path toward greater AI sovereignty could look like for Sri Lanka. It is written by a company building infrastructure in Colombo, so it has an interest; it tries to keep what exists separate from what is possible throughout.
Sovereign AI is not isolated AI
There is no single accepted definition of sovereign AI. This report thinks about it across five layers, each a question with a checkable answer.
Sovereignty is therefore a matter of degree rather than a switch, and the layers can be held separately. Sri Lanka does not need to own every layer to become substantially more sovereign than it is today.
Where Sri Lanka stands today
Sri Lanka is at an early stage, and its own strategy says so. The National AI Strategy names infrastructure as a gap: the country has no large-scale data centre, no national AI cloud and no high-performance computing capability of the kind advanced AI applications need, and the energy supply behind them is part of the problem.
The direction is changing. In 2026 the proposed GovCloud 3.0 architecture took a position worth noticing: rather than recreating a hyperscaler, Sri Lanka would have global providers operate inside data centres over which the country has greater jurisdiction and control. The Government Cloud Policy takes the same line, naming data sovereignty as a principle while recognising the cost and the appropriate use of cloud infrastructure.
This may be a more realistic model for a country of Sri Lanka’s scale: use the best global technology available, while building domestic control over the infrastructure, data and capabilities that matter most.
What the rest of the world is doing
There is no single sovereign-AI playbook. Different countries are choosing very different levels of independence, and the four below span the range.
National AI Strategy 2.0 names compute as one of ten priorities and pairs it with talent and research. The Enterprise Compute Initiative buys companies access through the global cloud providers rather than replacing them.
Secure access to compute; stay connected.
The IndiaAI Mission pooled more than 38,000 GPUs into shared national capacity, with a target of 100,000 by the end of 2026, and funds domestic foundation models alongside it.
Expensive infrastructure can be shared rather than built by every company alone.
AI Factories combine supercomputing, data and expertise; the InvestAI programme funds AI Gigafactories designed around roughly 100,000 advanced chips each, with tens of billions of euros mobilised.
Reduce strategic dependency, at a scale Sri Lanka neither can nor needs to match.
Abu Dhabi’s sovereign cloud runs global technology, Microsoft’s, on locally controlled infrastructure with sovereign controls layered on top.
Sovereignty through partnership: control the infrastructure and the data, keep using the best technology available.
The thread through all four is that AI sovereignty increasingly means controlling critical infrastructure and data while continuing to use the best technology available globally, not technological isolation.
Sri Lanka does not need to build its own ChatGPT
Building a frontier AI lab would require capital, compute, energy and specialist talent on a scale that makes little economic sense for Sri Lanka today. But that is also the wrong benchmark. A more useful question is: how much of Sri Lanka’s everyday AI workload could run inside Sri Lanka? The answer is likely to grow quickly.
Open-weight models are increasingly capable. They already handle much of what enterprises actually ask of AI: document extraction, classification, summarisation, retrieval, coding, translation and internal knowledge systems. Not every task needs the most powerful model in the world, and that opens a practical architecture.
Local models where privacy, residency, latency or control matter. Frontier models where maximum capability matters.
Sovereignty then becomes a choice made per workload rather than an absolute.
Geography still matters
Cloud infrastructure can feel locationless. In practice, distance still shows up in application performance, and it shows up twice: once between the user and the service, and again, more sharply, inside the application stack. Both were measured from our own infrastructure rather than taken from a benchmark; the hosting page carries the database figures.
Colombo is about five times closer than Singapore for a user in Sri Lanka. Interestingly, Bangalore is geographically closer to Colombo than Singapore, yet our measured latency was roughly three times higher. These are measurements from our own test environment, not universal benchmarks.
Physical distance is only part of the equation. Routing and network peering matter too.
Keeping the application and its database together
The larger difference is between an application and its own database. When the two share a building, a query’s round trip is a fraction of a millisecond; when they sit in different regions it is tens of milliseconds, more than a hundred times as long.
That matters because a single page or request rarely makes one query. A real application makes five to twenty, often in sequence, and the network cost compounds.
None of this means a locally hosted application is automatically faster. Architecture, caching, database design, compute and routing all matter. What it shows is narrower and more useful: data residency and performance do not have to be competing objectives. For many workloads, keeping compute, application and data close together gives both greater jurisdictional control and lower latency.
Data sovereignty may be the bigger issue
For many organisations, sovereign AI will matter less because of speed and more because of data. For banks, government institutions, healthcare providers and large enterprises, understanding where sensitive information is processed, stored and backed up is becoming increasingly important.
Sri Lanka’s legal position should not be oversimplified. The amended Act permits cross-border data flows where the applicable requirements and safeguards are met; it does not impose a blanket rule that personal data stay inside the country. Regulated sectors carry more. The Central Bank’s Banking Act Directions No. 16 of 2021 set a technology risk management and resilience framework for licensed banks that reaches their agents and third-party providers, and government policy is moving explicitly toward greater data sovereignty through its cloud and digital infrastructure initiatives.
This makes workload choice the practical question. An organisation may decide that public marketing content can use a frontier overseas model while customer financial records, internal documents or sensitive government information run locally. The infrastructure has to support both, and it has to be able to say afterwards which was which.
What realistic sovereignty could look like
Sri Lanka probably does not need an AI fortress. It needs options: the ability to run important applications, databases, AI gateways and increasingly capable open models domestically, so that sensitive workloads have a credible path to remaining inside the country.
At the same time, Sri Lankan businesses should keep using frontier models and global cloud infrastructure where those provide capabilities that cannot economically or technically be replicated locally. That is not a failure of sovereignty.
It is pragmatic sovereignty. The goal should not be independence from global AI. It should be reducing unnecessary dependence on it.
Singapore secures access to compute while remaining globally connected. India is pooling infrastructure. The Emirates combine sovereign controls with global technology. Europe is investing to reduce strategic dependency. Sri Lanka will need its own version, sized to its economy and its requirements.
Building the first pieces locally
Where open models are served today: Colombo.
This is the problem we have been working on at Roar AI. Our objective is not to disconnect Sri Lankan organisations from global AI: the gateway provides frontier models from OpenAI, Anthropic and Google, and requests to those necessarily leave Sri Lanka, because the models are not hosted here. The question we wanted to answer was how much of the stack could operate locally.
What can run locally today
| Layer | Where it is, September 2026 | Status |
|---|---|---|
| Application hosting | Colombo | In country |
| Databases | Colombo, beside the application | In country |
| Backups | Residency agreed per deployment | By arrangement |
| AI gateway | Colombo | In country |
| Open-model inference | Roar AI infrastructure in Colombo | In country |
| Frontier models | Operated overseas by their providers | Overseas |
Local models can keep the complete workload inside Sri Lanka. The hosting side of that table is what any application gets; the model side is what the gateway comparison is about. Frontier models such as GPT, Claude and Gemini are operated overseas by their respective providers, so requests to those models leave Sri Lanka; the gateway records where every call went. Residency as a written arrangement is available now for anyone who needs it (the terms, §9); some platform records are still held outside the country today, as the privacy policy states.
It is early. A locally hosted open model is not a sovereign AI ecosystem, and Sri Lanka remains dependent on overseas technology across many layers of the stack. But it demonstrates something: AI sovereignty does not have to begin with a national foundation model or a billion-dollar GPU cluster. It can begin with local compute, local data, open models, strong controls, and the ability to decide when a workload stays here and when it goes elsewhere.
The next phase
The question over the next few years is unlikely to be whether Sri Lanka can become completely technologically independent. It cannot, and arguably should not try. Government initiatives such as GovCloud 3.0 suggest the conversation has started; the next stage will be determined by what gets built.
Sri Lanka does not need to reproduce the global AI stack. It needs enough local compute, infrastructure, talent and control that organisations have a genuine choice about where their applications, data and AI workloads run.
The measure of AI sovereignty will not be whether Sri Lanka can operate without the rest of the world. It will be whether using the rest of the world is a choice rather than the only option.
If residency is a requirement rather than a preference, it belongs in the architecture — and in the contract. Talk to us
- 1Sri Lanka National AI Strategy · Ministry of Digital Economy, Government of Sri Lanka
- 2GovCloud 3.0: Request for Information, Sovereign Hyperscaler and AI Cloud Platform · GovTech Sri Lanka, with the World Bank
- 3Personal Data Protection Act, No. 9 of 2022, and the Personal Data Protection (Amendment) Act, No. 22 of 2025 · Parliament of Sri Lanka
- 4Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks · Central Bank of Sri Lanka
- 5National AI Strategy 2.0 · Smart Nation Singapore
- 6IndiaAI Compute Capacity · IndiaAI Mission, Government of India
- 7AI Gigafactories call · European Commission
- 8Sovereign public cloud for Abu Dhabi · Microsoft and Core42
- 9Infrastructure measurements, Colombo, 2026 · Roar AI. The runs are in our engineering records and available on request.
Published by Roar AI, September 2026. This report combines publicly available government and industry material with observations and measurements from Roar AI’s work building AI infrastructure in Sri Lanka.