AI sovereignty has become a line item businesses are prepared to pay for

Seventy-nine per cent of Australian businesses say it's important for their AI tools to store and process data within Australia. Among organisations with 250 to 500 employees, that figure rises to 90%. That's not a fringe concern. It's close to consensus.

And this concern has started showing up as spend.

Seventy per cent of businesses say they would pay more for AI services hosted entirely in Australia, and 83% of larger organisations would.

Those are the headline numbers from Decidr's 2026 State of AI for Australian Businesses, a survey of 1,006 SMEs and 318 enterprise businesses.

Together these figures mark a shift: sovereignty has moved from a compliance checkbox to a line item businesses are prepared to pay for.

We've argued before that the real sovereignty question is who controls the rules your AI actually runs on, the decisions it makes, the steps it follows, the judgement calls it's been given, not just who owns the underlying data.

This report is the first hard evidence that Australian businesses agree, and are prepared to put a number on it.

What AI sovereignty actually means, beyond hosting

"Where's the data stored?" only answers the easiest part of the question.

It tells you which country the servers sit in and which jurisdiction's laws apply. It's also the layer providers are keenest to market, because it's the simplest to solve.

It doesn't tell you who can access the data once it's inside the platform, whether it's used to train the provider's models, or which subcontractors touch it along the way.

A business can host its data in Sydney and still have no real visibility into how that data moves once it enters the system.

Go deeper and there's a harder layer underneath.

Every time a business configures an AI system with prompts, decision rules, workflow logic, exceptions and escalation paths, it's exposing something that took years to build: customer context, pricing judgement, internal process, the exceptions and lessons learned the hard way.

That's not a data point. It's accumulated business intelligence, and once it's inside a provider's tools, the provider can capture it, turn it into reusable capability and diffuse it across other tools and platforms the business doesn't own or govern.

The business doesn't just risk losing access to its own knowledge, it risks its workflows becoming absorbed, codified and sold back to it at a rising price, the way the internet's biggest platforms once did with the data people freely handed over.

You can't protect knowledge you can't see

Decidr’s report also reveals that fewer than one in four SMEs have current and complete information about people, processes, customers, rules or governance in a single connected system.

That's not just an efficiency problem. It's what makes the IP exposure worse.

A business that can't see its own knowledge in one place has no way to know what's actually being fed into an AI system, and even less power to stop a provider absorbing it once it's in.

Additionally, AI cannot compound knowledge the business itself cannot see, and knowledge the business itself cannot see is knowledge it has even less power to stop a provider from capturing.

Why this changes how you should structure AI systems

This is where a decision system built on your own ontology, rather than a provider's, changes the maths.

Schema is what makes this possible: a governed, structured definition of what your business is and how it decides, that you control regardless of which model sits underneath it.

That's the structural difference between exposing your knowledge to a provider and keeping it as your own asset, and it's the same principle behind an agentic organisation: the organisation keeps the knowledge even as the tools underneath it change.

What leaders should actually do with this

Decidr's report doesn't ask businesses to solve sovereignty before they invest in AI. It asks them to make it part of the decision, which is a much lower bar and a much more useful one.

Start by mapping the information and workflow logic that would hurt most to lose.

Classify which workloads genuinely need Australian processing and which don't.

Then ask what happens to your business knowledge once it enters a provider's system, not just where your data sits.

A contractual promise about data location means very little if your operating knowledge is still being absorbed on the way through.

The next phase of AI adoption will be decided on control, not capability

Every business in the report already knows AI can deliver results. The businesses that come out ahead over the next two years won't be the ones with the flashiest pilot. They'll be the ones who Read the full findings in the 2026 State of AI for Australian Businesses.