Where AI systems and the data they use may run in Indonesia, who controls them, and how to test a supplier's claim of control.

Everything here stands as of 9 November 2026. Rules, statuses, products and licences move; recheck any of them before it decides anything.

This is not legal advice. Where a duty turns on a reading of the law, your own counsel decides. The last chapter, Pending as of 9 November 2026, lists what was not settled on that date.

Every claim carries a label that says how firmly it is known. Read the label before you act on the claim.

Article numbers for PP 33/2026 are marked throughout as coming from law-firm notes. The official text could not be reached when this was written.

For a ministry, agency, regional government, or a vendor working for one.

1. PP 71/2019Public scope must manage, process and store in Indonesia.
2. Permenkomdigi 5/2025: three data classesWhich class your training data, prompts and logs fall into.
3. Offshore, cloud and registrationWhy a commercial Jakarta region is not automatically a compliant home.
4. SPBEThe national data centre, the intranet and open-source preference.
5. The tensionThe rule points to PDN, and PDN takes low-risk services only.
6. UU 27/2022The DPIA is the norm for AI, not the exception.
7. The test setWhat to ask the supplier, with evidence.

For a team about to call a frontier model over an API with data that touches people.

1. Hosted frontier APIsNo documented in-region inference in Indonesia for frontier models.
2. What this means for model APIsA prompt with personal data sent abroad is a transfer.
3. Cross-border transfer in practiceContracts now; consent only as a narrow last resort.
4. Data egressSeven exits, and a control for each.
5. RedactionReduce what leaves before deciding where it may go.
6. The CLOUD ActControl, not location, decides who can compel disclosure.

For procurement, legal and security reviewing a "sovereign" or "local" offer.

1. Six working termsResidency, data, operational, jurisdictional, technological and AI sovereignty are different claims.
2. The CLOUD ActThe test is control and technical ability, not where the server sits.
3. Measured failuresFour cases where residency was not the control that mattered.
4. The test setTen axes, one question each, answered with evidence.
5. The Assurance PackThe one page legal, procurement and compliance ask for.

For a team that wants inference to stay inside its own boundary.

1. Parameter countWrite down the memory, not the parameters.
2. QuantisationThe decision that most often makes self-hosting possible.
3. Cloud regions and GPUsWho rents H100 and H200 GPUs physically in Indonesia today.
4. Sahabat-AI and SEA-LIONWhat the Indonesian and regional models are built on.
5. Self-hosting licencesApache 2.0, MIT, the Llama licence and the Gemma terms.
6. Six licence trapsAn open weight is not an open licence.

PP 33/2026 takes effect on 16 January 2027, with administrative sanctions from that date.

1. PP 33/2026: what is knownDates, and why every article number here is law-firm grade.
2. Automated decisions and recordsThe objection channel and the record of processing.
3. DPIA, transfer and sanctionsA DPIA before go-live; transfers in a fixed order of bases.
4. The missing authorityEquivalence lists and standard clauses wait for it.
5. A position you can take nowThree things to do this week.
6. PendingWhat to recheck before 16 January 2027.

No Indonesian government source gives a formal, citable definition of any sovereignty term. These working definitions come from published foreign frameworks and vendor documents, used as definitions only.

Inference The table is a synthesis. Attribute each row to its source framework; do not present it as a consensus.

Source: European Commission Cloud Sovereignty Framework; ANSSI SecNumCloud 3.2; Gaia-X 24.11 and Labels Document 2024; Google, Microsoft and AWS sovereignty pages. All Official.

The most detailed prior art. It defines sovereignty through eight objectives and five assurance levels, not a single sentence.

Inference SOV-2, 3 and 4 measure control; SOV-5 and 6 measure capability. A provider can score high on control while the buyer has no capability at all.

Source: European Commission, Cloud Sovereignty Framework, 2025. Official.

None of the three hyperscaler definitions makes jurisdiction its own axis.

Analysis Ask a vendor which of these dimensions its sovereign offer covers, and whether jurisdiction is one of them. A three-part vendor split can be met in full while the operator stays within reach of foreign law.

Source: ANSSI SecNumCloud 3.2, Official; arrêté of 12 August 2026 via a law-firm note, Secondary; Gaia-X, Official; Google, Microsoft, AWS pages, Official.

An Indonesian-authored paper drew the line a decade ago: server location gives legal reach and availability; confidentiality and integrity come from encryption.

Ask which of the two a "sovereign" offer improves. Most improve control on paper and leave capability where it was.

Source: Nugraha (Oxford), Kautsarina (Kominfo research agency) and Sastrosubroto (LIPI), about 2015, Secondary. The control and capability split is our inference from the EC objectives.

There is no formal definition on record. Officials describe the same two parts, control and capability, and say repeatedly that sovereignty is not isolation.

Analysis When a proposal or a policy cites kedaulatan, ask which half it delivers: control (keys, operators, data location) or capability (talent, compute, models). Officials use the one word for both.

Source: Komdigi releases; Bappenas, data.go.id; press reports of the ICISS and Nezar Patria remarks. Dates as shown.

Inference Official usage leans toward capability and governance rather than localisation, a shift from the PP 82/2012 localisation era. Nobody in government has drawn the control and capability split formally.

The practitioner's test works on any offer: can you refuse, switch suppliers and keep operating when the terms change?

Source: Kemenko PMK page for 6C; Kontan, Katadata and opinion columns as dated.

"Open source" without the specific licence beside it is close to meaningless. Read the licence file, not the licence name.

Source: Our analysis, from licence files read in August 2026.

Research Redis left open source for SSPL and RSAL in March 2024, and returned to an OSI licence, AGPLv3, with Redis 8 in May 2025. Notes from 2024 are wrong today, in the direction that costs options. (Redis, 1 May 2025)

Research Elasticsearch left Apache 2.0 for SSPL and the Elastic Licence in 2021, then added AGPL back as an option in August 2024. It now carries three licences and you choose one; its x-pack folder stays on the Elastic Licence whichever you choose. (Elastic, 29 August 2024)

Analysis Model weights move the same way, and the movement is easy to miss because the family name does not change. Llama ships under Meta's community licence: not OSI-approved, with a 700 million monthly user cap. Gemma 3 and earlier sit under Google's own Gemma terms; Gemma 4 is Apache 2.0. Same name, two legal answers.

Check the version, not the family.

Under the Open Source AI Definition 1.0 (OSI, October 2024), an OSI licence on the weights alone does not make a model open source while the data information behind it is withheld.

• What it is for: the job in the slot, not a feature list.
• Runs: whether you can host it yourself, whether it is a service, or both.
• Main limitation: the thing most likely to make you regret the choice in a year. Where the licence itself is that thing, the column says so.

Every open and source-available licence in these tables was read from the project's own licence file in August 2026, and that reading changed our own notes in eleven places. Assume that rate of drift for any list of this kind. The closed rows have no licence file, so they record the vendor's published terms, a weaker source that moves without announcement.

The context slot has no table, and the absence is the finding: what goes into the window, in what order, what is pruned and what is summarised is code you write against your own material.

Analysis If a vendor claims to solve your context problem, ask which of the four jobs they mean: choosing, ordering, pruning or summarising. Honest answers are narrow.

Seven rows are dimmed. Each was widely recommended once and is now frozen, dormant or shut down. Frozen is the state people miss: nothing breaks on the day it happens.

Frontier providers (slot 1)

Closed weights, called over an API. Four labs, and the capability gap between them changes monthly.

Open weight families (slot 1)

Weights you can download and run. Note how many are not actually OSI-licensed.

As of August 2026. Names, licences and products change fast; recheck before a decision. Dimmed rows are frozen, dormant or shut down.

Model gateways and routers (slot 1)

The AIaaS layer, AI as a service. One interface, several providers, so switching or falling back is configuration rather than a rewrite.

Inference servers (slot 1)

What actually runs open weights. The difference between them is throughput and how much hardware they assume.

Analysis If application code calls one provider's SDK directly, the model is not swappable whatever the diagram says. A gateway on day one costs little.

As of August 2026. Names, licences and products change fast; recheck before a decision. Dimmed rows are frozen, dormant or shut down.

Embedding models (slot 3)

Changing one of these means re-embedding your whole corpus, so it is the least casual decision in this section.

Analysis Choose the embedding model last, then change it as rarely as you can. Changing it means re-embedding the whole corpus, and it cannot be done halfway. Pick the index, the keyword engine and the reranker first; let them tell you what the embedding has to be.

The hosted rows send every document you index outside the building. As of August 2026.

Vector indexes and stores (slot 3)

The honest default is the database you already run.

As of August 2026. Names, licences and products change fast; recheck before a decision. Dimmed rows are frozen, dormant or shut down.

Keyword search (slot 3)

Not optional. This is what finds the invoice number.

Rerankers (slot 3)

The largest single quality gain on the read path, paid for in latency.

As of August 2026. Names, licences and products change fast; recheck before a decision. Dimmed rows are frozen, dormant or shut down.

Retrieval frameworks (slot 3)

Glue that saves weeks and costs you some control.

Retrieval over a graph of entities sits beside these categories rather than among them: it is a different index, and it earns its place when the relationships between entities really are the question.

As of August 2026. Names, licences and products change fast; recheck before a decision. Dimmed rows are frozen, dormant or shut down.

Text-to-SQL (slot 3)

Question in, SQL out. Measure accuracy on your own questions before believing any demo of these.

Semantic layers and metric stores (slot 3)

Where "revenue" gets one definition. The category this whole area depends on and the one most often skipped.

Analysis Fund the semantic layer first. Twenty certified metric definitions is about a week of one person's time, and it keeps its value even if the AI part is abandoned.

BI and analytics assistants (slot 3)

Where the dashboard question actually gets answered.

Data catalogs (slot 3)

How the system finds the right table among thousands: the schema retrieval problem, as a product.

As of August 2026. Names, licences and products change fast; recheck before a decision. Dimmed rows are frozen, dormant or shut down.

Tool connectivity (slot 4)

MCP is the interface standard; these are what sit on either side of it.

Workflow tools (slot 5)

A fixed sequence you define. Cheaper, faster and more debuggable than an agent whenever the sequence really is fixed.

A workflow tool is right when the sequence is fixed, which is more often than the market suggests. As of August 2026.

Agent frameworks (slot 5)

The model picks the next step. This layer turns over fastest of all.

Research AutoGen now opens with a maintenance notice: no new features, community managed, pointing to Microsoft Agent Framework. (microsoft/autogen README, August 2026)

This layer turns over fastest. Keep business logic in your own code, with the framework as a replaceable adaptor.

Observability and tracing (slot 6)

What was actually sent, what came back, what it cost, how long it took.

Evaluation (slot 6)

The set of cases you re-run whenever anything changes. Cheap to start, and the thing that makes model swapping safe.

The hosted rows keep your prompts and outputs with a third party. As of August 2026.

Analysis Five of thirteen rows are dead or dormant. Before adopting one, ask what happens to your prompt history when it closes, and prefer tools whose data you can export or whose store you already run.

Models under one billion parameters take 83 per cent of all-time downloads on the largest hub; models over one hundred billion take 1 per cent.

Analysis Those shares say what people download, not what answers well. For a system that has to run inside the client's own building, a four billion parameter model under Apache 2.0 is the shape the field reaches for first.

As of August 2026.

There is no AI-specific hosting rule. AI systems fall under the general rules for electronic systems and data, plus sector rules.

Inference An AI system run by or for a government body, including one a vendor runs for it, is public scope: its data, model hosting and processing all fall under 20(2). The only route abroad is the committee test, and no record of that committee being constituted was found.

Source: PP 71/2019, JDIH Kemenkeu, Official (first 100,000 of 127,717 characters read).

The public-scope regulation, enacted 18 March 2025, obliges every public-scope operator to classify its data by risk (Pasal 62(1)) and sets three classes (Pasal 64).

Inference For a government AI system, the training data, prompts, outputs and logs that are classified data must stay in Indonesia. Open and limited data go to the national data centre. Only closed data may sit in the agency's own encrypted facility.

In the portion read, the regulation does not use the abbreviation PDN and does not mention artificial intelligence.

Source: Permenkomdigi 5/2025, Official (first 100,000 of 141,013 characters read; most of the Lampiran unread).

Inference On the text read, a commercial cloud region in Jakarta is not a compliant home for public-scope data unless the provider is a registered third-party provider operating inside the national data centre. No class of public-scope data is freely storable abroad. Whether hosting a frontier model could ever pass the Pasal 88 test is untested.

The list of registered third-party providers was not found, and whether any hyperscaler region is on it was not established.

Source: Permenkomdigi 5/2025, Official, partly read. The date of entry into force is not recorded, so the one-year deadlines cannot be dated here.

For private operators, Komdigi sets no location rule. Residency comes from sector regulators and from the personal data transfer rules.

• Permenkominfo 5/2020 took effect on 24 November 2020 and is listed as in force. It requires registration and access to systems and data for supervision and criminal law enforcement.
• It is still the enforcement basis in 2026: on 16 September 2026 Komdigi wrote to 25 private operators (23 domestic, 2 foreign) citing its Pasal 2 and 4, with a 22 September deadline and access blocking as a possible sanction.
• The one 2026 Komdigi regulation found, Permenkomdigi 9/2026 of 6 March 2026, concerns child protection under PP 17/2025 and amends neither 5/2020 nor 5/2025.

A private AI provider may host abroad. What it cannot do is refuse supervision and access, and it loses the freedom to host abroad wherever a sector regulator or a strategic-data designation applies.

Source: Komdigi JDIH abstract of Permenkominfo 5/2020, Official; Komdigi enforcement letter report, September 2026; Permenkomdigi 9/2026 metadata, Official.

Inference Perpres 95/2018 and Permenkomdigi 5/2025 point the same way: a government AI deployment is expected to run on the national data centre, connect through the intranet and connector, and prefer open source. That bears on choosing open-weight models over closed APIs, though the Perpres says nothing about AI.

Source: Perpres 95/2018 and Perpres 82/2023, Official, read in full.

Perpres 39/2019 matters to AI as the source of training and retrieval data across agencies. It says nothing about where data must sit.

Location follows PP 71/2019 and Permenkomdigi 5/2025. Satu Data decides how good and how shareable the data is, not where it lives.

Source: Perpres 39/2019, Official, read in full on a regional government host; Perpres 82/2023, Official.

Inference An AI system that processes bank data offshore, for example through a foreign-hosted model API, raises a placement or processing question under POJK 11/2022 Pasal 35 and 39 and needs an OJK permit, which the listed purposes may not cover. The same reasoning applies to payment processing. Clinical AI on medical records must keep them domestic if a third party stores them.

Source: POJK 11/POJK.03/2022 (in force three months after 7 July 2022), Official; PBI 22/23/PBI/2020 (in force 1 July 2021), Official, partly read; Permenkes 24/2022 (31 August 2022), Mirror.

The temporary national data centre PDNS 2 in Surabaya was taken down by ransomware. Domestic hosting gave neither availability nor resilience.

Analysis Location did not protect availability. Ask any host, PDN included, where the backups sit, who holds them, and when a restore was last tested.

Source: DPR Commission I hearings, June and July 2024, Secondary; GovInsider (names Brain Cipher, a LockBit 3.0 variant), Secondary.

No rule specifically requires government AI workloads to run in PDN, and no source mentions GPU or AI capacity there. The general rules do the requiring.

Source: Komdigi at National Cybersecurity Connect, 28 October 2026, Official; Antara; DPR Commission I, January 2026; Kominfo, February 2024.

This is the key practical finding for anyone putting AI into a government body.

Inference A public-scope AI system that handles limited or closed data has, on the text read, nowhere fully compliant to go in PDN today. This reading treats PDN's "low-risk services" as matching the regulation's low-risk (open) class; nothing in the record shows Komdigi equating the two.

Analysis Ask the ministry in writing which class your data is, and where it expects that class to run now. Record the answer. It is the evidence you will need if the arrangement is questioned later.

Removing the sending tool is not enough. A URL is a message: everything after the question mark is chosen by whoever wrote the instruction.

A tool description is text the model reads on every request. The server supplies it, not you, and it can change after you approved it.

The question is not "are we using AI" but "what data leaves, through which exit, and who logs it". Closing one exit and leaving the others open is the pattern met most often.

An agent adds no new exit; it multiplies every exit above it by the number of steps. Our analysis; not legal advice.

Signed 17 October 2022. The two-year adjustment period ended on 17 October 2024.

Inference A typical AI deployment meets Pasal 34(2) on automated decisions, systematic evaluation and new technology together, so the DPIA is the norm for AI, not the exception. Pasal 10 bites only where a decision is solely automated, which makes human review the lever you control.

Source: UU 27/2022, OCR scan of the official text, JDIH Kemenkeu, Official.

Criminal exposure exists today, whether or not the authority exists. The administrative lever depends on the authority.

A mirror annotation says Putusan MK 151/PUU-XXII/2024 held "dan" in Pasal 53(1)(b) conditionally unconstitutional; the decision was not read, so its effect on the DPO trigger is unconfirmed.

Source: UU 27/2022, Official; criminal and Pasal 72 provisions read on pasal.id, Mirror.

Read this first. The official text of PP 33/2026 could not be reached: the government hosts refused the connection or returned an empty page. Every article number in this chapter comes from law-firm notes, press and mirror metadata, checked against each other. Treat each as "law-firm notes, official text not read".

Source: RSM, Hogan Lovells, Rajah & Tann, Conventus, SIP Law client notes; PPC Land; IAPP (October 2026); mirror metadata. All Secondary or Mirror.

Reported examples of significant impact: credit refusal, employment refusal, differential pricing, targeting that strongly affects vulnerable groups. This wording is PPC Land's paraphrase only.

Source: Law-firm notes and PPC Land, official text not read.

Inference From 16 January 2027, an AI system that scores or decides about people without human review needs a DPIA before go-live, an objection channel that discloses the technology used, and a human route once an objection is accepted.

Source: Law-firm notes, official text not read.

As of 5 November 2026, the personal data protection authority had not been established.

• Komdigi said the draft Perpres had gone to the President through the State Secretariat. Komdigi carries out the functions in the meantime, with a transition task force.
• The body is to be independent, outside Komdigi, reporting to the President through Komdigi. No formation date has been given.
• A July 2026 target of about two months later has passed. Its formal name (Badan PDP, Lembaga PDP or OPDP) is not settled.

The equivalence list, the standard contractual clauses, approval of binding corporate rules and the enforcement mechanics all wait for the authority. The duties and the penalties do not.

Source: Katadata, quoting Komdigi, 5 November 2026, Secondary; Komdigi and PPC Land, July 2026. No report of signature between 5 and 9 November 2026 was found; coverage after 5 November is thin.

In Case 137 the Court treated control of transfers as part of data sovereignty, read Pasal 56(3) as allowing transfer where the foreign standard is not equal provided binding protection prevents harm, and called controllers the state's "perpanjangan tangan" (extended arm). The government told the Court there was no binding Indonesia-US data transfer agreement, only a non-binding framework.

Inference Because Case 153 was disposed of on form, the Court has not ruled on whether the missing deadline is unconstitutional. The question stays open, possibly in Case 236.

Analysis Do not plan on the Court setting a date for the authority. Plan for the duties as they stand, and for transfers resting on binding safeguards, as Case 137 allows.

Source: Decisions read on pasal.id, Mirror; hearing reports, Secondary; mkri.id pages not reached.

The first two routes in Pasal 56 depend on instruments only the authority can issue, and neither exists yet. Contracts carry the load now; consent is a narrow last resort.

Before PP 33 appeared, businesses used consent as an interim route; one author called it temporary because the law intended transfers without individual consent (opinion, April 2026).

Source: Hogan Lovells, RSM, Rajah & Tann client notes, Secondary; Komdigi to Commission I, May 2026; ELSAM and ICSF statements, Secondary. The trade agreement text was not read.

No Komdigi statement, law-firm note or DPO guidance found names hosted model APIs or LLM providers. Everything on this slide is our inference.

Inference A prompt or file containing personal data, sent to a model API hosted outside Indonesia, is a transfer to a processor outside Indonesia's jurisdiction under UU Pasal 56(1).

Inference It then needs a processor agreement meeting PP Pasal 14, subprocessor approval under Pasal 15, a record-of-processing entry naming the destination (Pasal 74) and a pre-transfer assessment (Pasal 161).

Inference Because the PP limits consent to non-repetitive transfers, consent cannot carry routine, continuous API traffic once the PP is in force. Binding contractual safeguards are the only usable route until the authority publishes an equivalence list or clauses.

Inference On Bedrock in Jakarta, Claude is reachable only through global cross-region inference: stored data and logs stay in Jakarta, processing may run in another region. On this reading, that traffic is a transfer. Banks need an OJK permit for offshore processing as well.

Not addressed by any source: whether in-Indonesia hosting by a foreign provider, with remote access from abroad, counts as a transfer.

Analysis Treat Pasal 56 as a live obligation. Rest each transfer on contractual and technical controls written to bring the destination to the level Pasal 56 asks for, documented as such, not on an equivalence assessment nobody can issue yet. A lawful basis for the processing is a separate duty and does not answer the transfer question. Write down the decision and the reasoning.

Three things to do this week. List the exits with your own systems filled in (Data Egress). Decide log retention before go-live. Make sure permission filtering happens at search time.

Pasal 56 asks for protection "equal to or higher than" the law provides. Quoting the statute rather than the European word "adequacy" keeps a procurement conversation off definitions. Not legal advice.

Inference The binding duties on AI and personal data are the general ones: lawful basis, DPIA, objection rights, transfer and processor rules. There is no AI carve-out to wait for. Any sanction before the authority exists would most likely rest on Komdigi's electronic-systems powers, because Pasal 57(4) names the authority as the imposing body; no source confirms this.

Source: Komdigi Director General's written statement, 28 December 2025, Secondary; SE 9/2023, Official; Bisnis headline, 4 November 2026.

Analysis These four are routinely presented as a stack to comply with in sequence. They answer four different questions; the useful move is to work out which question you are being asked.

None of the four tells you whether the system you built works: whether retrieval returns the right passage, citations resolve, or the agent terminates. Governance requires that evidence and does not produce it.

Source: Gibson Dunn and Pinsent Masons omnibus analyses; dates as at 14 September 2026. Research.

Surat Edaran Menkominfo 9/2023 on AI ethics, 19 December 2023, signed by Minister Budi Arie Setiadi, listed as in force on the Komdigi JDIH.

Inference Treat the SE as advisory. Use it as a drafting basis for internal policy, not as a compliance obligation. No source says whether it will be revoked when the AI Ethics Perpres is signed.

Source: SE 9/2023 on JDIH Komdigi, Official (values read through imperfect OCR; check the PDF before quoting); Komdigi Legal Bureau, Official; DPR brief, Official.

Inference Four officials, four framings of an unpublished draft. Do not present any of them as the official structure until the signed text exists. The period has settled on 2026-2029.

Source: Komdigi JDIH and Legal Bureau, Official; OECD.AI; press as dated, Secondary.

One on the National AI Roadmap 2026-2029, one on AI Ethics. Unsigned at the latest confirmed report, 21 October 2026; not confirmed after that.

Inference With no sanctions in a Perpres, the binding teeth for AI misuse remain the ITE Law as amended by UU 1/2024, the KUHP and UU 27/2022. The drift from "end September 2025" to "this year" supports a cautious "pending" label.

Source: Komdigi JDIH, Official; Kontan, Selular and other press, Secondary, as dated.

Perpres here is the Presidential Regulation. Treat the "awaiting signature" box as a forecast, not a fact.

Source: SE Menkominfo 9/2023, JDIH Komdigi, Official; status of the Perpres updated to 21 October 2026.

Every OJK AI instrument found is guidance (panduan or pedoman), not a POJK or SEOJK.

Inference A bank can treat the April 2025 guide as the reference for its AI governance, knowing it is guidance. Track the November 2025 policy: its form was not confirmed, and it may become something firmer.

Before the banking guide's launch, OJK said human judgment stays for larger credit decisions and small ones may be automated. October 2026 statements on innovation room and a self-acting AI model are headline only.

Source: OJK press releases SP-172/GKPB/OJK/XI/2023 and SP 67/GKPB/OJK/IV/2025, Official; press, Secondary.

Outside OJK, no AI-specific rule from any regulator was found. For payments, health and elections, the general rules and the sector's existing data rules apply.

Source: Bank Indonesia release No.28/213/DKom; Kemenkes; Komdigi releases; press as dated.

Inference In late 2026 the binding legal layer for AI is general law: the ITE Law, PP 71/2019, UU PDP, the KUHP and the Copyright Law.

Source: DPR brief, Official; Komdigi, Official; Jakarta Post and CDO Magazine on the ASEAN guides, Secondary; press on bilateral talks, Secondary.

Start with the inventory. When the Perpres tiers arrive, it is the list you will sort into them.

Our analysis.

The boundaries move every year. A document that says "use an SLM" with no parameter count and no target hardware has not said anything.

Analysis For a proposal, write down the memory, not the parameters. "Runs on one 80 GB card at int8" is a specification. "70B" is trivia.

At fp16 every parameter needs two bytes: a 7B model needs about 14 GB for its weights alone, a 70B model about 140 GB. The KV cache is paid again for every simultaneous user, and it grows with the context you actually use.

Quantisation is the single decision that most often makes self-hosting possible, and with it, keeping data inside your own boundary.

Research Until about 2020, scaling model size, data and compute together brought loss down predictably (Kaplan et al., 2020). Chinchilla (2022) showed most models were too big and under-trained; practice has since moved to over-training smaller models, such as Llama 3 8B on 15T tokens.

Analysis Since 2024, mixture of experts, distillation and reasoning at inference time have finished the shift. A vendor that opens a 2026 presentation with a parameter count is quoting the least informative number it has.

Inference Renting H100 or H200 GPUs physically inside Indonesia is documented from at least four suppliers: AWS Jakarta, Azure Indonesia Central, Biznet Gio and Lintasarta.

Source: Providers' own pages as read in 2026; Huawei and Tencent via press.

No source gives a current, operating total of AI accelerators in Indonesia. Danantara's CTO says customers wait six months to a year for data-centre space.

Inference MW is not a GPU count, and the sources mix contracted IT power, AI capacity and undefined capacity: do not add them up. An organisation planning for 2026 to 2027 depends on existing hyperscaler and GPU-as-a-service capacity.

Source: CoreWeave, Official; Indosat via DCD, Secondary and sponsored; NeutraDC and MoU via press, Secondary.

"Sahabat-AI" names two things: open-weight models on Hugging Face (2024 to 2025), and a consumer app launched with Komdigi on 25 February 2026 whose underlying models and hosting are not disclosed. Keep them apart.

SEA-LION v4 also ships Qwen 32B, 8B and 4B, Gemma 4B and Apertus 8B variants, with quantised versions. No government-owned Indonesian foundation model was found.

Source: Hugging Face model cards and collections, Official; Komdigi and Indosat app launch, Official.

The question is never about the Indonesian model. It is about what the Indonesian model was built on, answered per variant.

Inference Whether an MIT label on a Gemma derivative removes the Gemma flow-down obligations is a legal question the research did not settle. Check both texts before relying on the MIT label. The Sahabat-AI v1 licences are presumably the Llama 3 licence and the Gemma terms; not confirmed.

Analysis We found no measured comparison of Indonesian-language quality across these and the general multilingual models. The claims exist; the measurement does not.

The documented route to in-country inference for capable models is self-hosting open weights on in-country GPUs, not hosted frontier APIs.

Source: AWS blog (24 February 2026, reviewed October 2026) and Bedrock user guide, Official; Google and Microsoft documentation, Official.

Inference For an Indonesian buyer that is not China-headquartered, the binding US constraint appears to be the existing advanced-computing licence regime plus diversion diligence, not a country quota. This rests on the absence of any Indonesia-specific rule, not on a positive statement. GB300-class builds depend on US export clearance, and no source discusses theirs.

Source: BIS press release, 13 May 2025, Official; Commerce guidance, May 2026, Secondary.

Inference For commercial self-hosting with the fewest flow-down obligations, Apache 2.0 or MIT bases carry fewer terms than the Llama licence or the Gemma terms.

A licence that lets the licensor restrict use remotely is a sovereignty question, not only a legal one.

Source: Apache 2.0, Llama 3.1 Community License and Gemma Terms of Use, primary texts, Official.

Source: Hugging Face model cards, Official; Biznet Gio, AWS and Lintasarta pages, Official. Estimates derived from the 70B card.

The model is the processor. Context is working memory. Knowledge is storage; loading contents only when a step needs them is demand paging. Tools are system calls, and the line between reading and writing is a permissions model. The loop is the scheduler. The wrapper is the shell, the login and the audit log.

The analogy earns its place because it predicts things.

If an AI system failure surprises you, the operating-system version of the same failure usually explains it.

It does not mean renting GPUs. Hosting is a separate question.

Analysis Swapping is only safe if you can tell whether the swap made things worse, and that takes an evaluation set. Without one, a model change is a leap of faith wearing the costume of a configuration edit.

A model gateway sits between your system and several providers and presents one interface to all of them. The bottom row is where the data-residency answer is enforced once, instead of being remembered by every developer.

Analysis The evaluation set is what makes the third try honest. A fallback can also drop a guarantee: constrained decoding belongs to the provider serving the request, so falling back to one without it turns a guaranteed schema back into a request for one.

If everything a vendor offers sits in the first slot, you are being sold a commodity at a premium. If they fill several of the other five, they are selling an operating system: worth more, and much harder to leave.

Both can be reasonable purchases. Confusing them is not.

Analysis Whatever moat exists is in slots two to six, and none of it arrives with the model. That is good news if you own the data pipeline, the permissions and the workflow. It is bad news if the plan was to be first to a model everyone else can also call.

For sovereignty, the same reading applies: control of slots two to six is what lets you change the model, or its location, later.

• Llama is not open source. Above 700 million monthly users you need Meta's grant, which will not bind you. Three conditions will: display "Built with Llama", name derived models beginning "Llama", and the licence ends if you bring an IP claim against Meta.
• Gemma depends on the version. Gemma 4 (April 2026) is Apache 2.0. Gemma 1 to 3 and every variant are on Google's own terms with a prohibited use policy, last modified 1 April 2026.
• A non-commercial licence looks like an open one. jina-embeddings-v3 sits on the same leaderboard as the rest and is CC BY-NC 4.0.
• AGPL is not permissive. Ultralytics YOLO is AGPL-3.0 or paid; its licence page says internal business tools, SaaS, edge devices and custom-trained models need an enterprise licence.
• Derived models inherit. An adapted model carries its base licence.
• Most models carry no licence at all. Close to 70 per cent on the largest hub. Absence is not permission.

Source: Licence files and vendor terms as read in 2026. Research.

The largest hub passed 3 million models in August 2026, with 1 million datasets, growing by about 2,700 to 3,000 models a day.

Three million models is not three million choices.

Source: Hub statistics, August 2026. Research.

The standard serialisation format executes code on load, and that has been exploited.

• One security firm reported roughly 100 models carrying real payloads, one opening a reverse shell to a hard-coded address.
• Another found two models in February 2025 that evaded the platform's own scanner by compressing broken pickle files with 7z, so the payload ran before deserialisation failed.

Analysis Treat a downloaded model as untrusted input. Prefer safetensors over pickle formats, scan before load, and pin a revision hash rather than a tag, because a tag can be moved under you.

Self-hosting moves the model inside your boundary. It also moves the supply-chain risk inside with it.

No Indonesian regulation names the CLOUD Act or addresses foreign-law reach into Jakarta-hosted regions. No Komdigi, BSSN or OJK document discusses it.

None of these levers addresses compelled disclosure by a provider's home state.

Source: Permenkomdigi 5/2025 and POJK 11/2022, Official; ICSF and ELSAM statements, Secondary; Komdigi to Commission I, 18 May 2026.

Inference Two questions decide exposure: is the operator, or anyone who controls it, subject to US jurisdiction, and can it technically produce the data? Location answers neither. Customer-held keys outside the provider's reach remove the "can produce" half, not the jurisdiction half.

Source: 18 U.S.C. §2713 via Cornell LII, Mirror; DOJ CLOUD Act white paper, Official; provider statements via press and Google, Secondary and Official.

• Section 702 allows programmatic targeting of non-US persons reasonably believed to be abroad, under annual court-approved certifications, with no individual order per target. Providers can be directed to assist.
• Title VII was automatically repealed on 12 June 2026. Existing directives continue until they expire, which for a March 2026 certification means about March 2027. The court can enforce them through contempt.
• Whether Congress reauthorised Section 702 between 13 June and 9 November 2026 could not be confirmed.

Do not describe Section 702 as dead in November 2026.

Source: Congressional Research Service Legal Sidebar LSB11444, 22 June 2026, Mirror; press, Secondary.

Inference None of the four shows residency failing as such. Each shows that residency was not the control that mattered. No source documents a CLOUD Act or Section 702 order executed against data in a "sovereign" region.

Source: The Register (Senate inquiry, July 2025) and press on the ICC and DoD cases, Secondary; ProPublica; DPR hearings and GovInsider for PDN.

Questions are our synthesis, one per axis, to be answered with evidence. Clauses come from EU and French instruments and vendor controls: prior art to adapt, not binding in Indonesia. The right-hand column is an editorial mapping; none of those rules was written as a sovereignty test.

Inference Both features argue for evidence-backed answers over vendor attestations, though no quoted rule says so.

Indonesian procurement has no standard sovereignty clause set. LKPP model contracts and SPBE cloud rules were not researched; adapt the clauses with your counsel.

Source: European Commission Cloud Sovereignty Framework; SecNumCloud 3.2 §3.3.2. Official.

For a first system that reads company documents and answers questions, with no write tools.

Read the project's own licence file, not the licence name. Closed products have no licence file; their published terms are a weaker source that moves without announcement.

Then the residency question, which usually decides the shortlist: whether the documents the system reads have to leave the building to be read at all. For a bank, a hospital or a public body, that removes most of the market before any quality comparison starts.

Settle residency in the first meeting. It is cheaper than a comparison you will have to throw away.

Prompt injection has no complete fix, and saying so is more defensible than a filter that claims to catch 95 per cent of attacks.

They are not alternatives. ISO 42001 certifies the organisation, not the system. The MLOps maturity models are the right shape and pre-date LLMs: they measure retraining automation, not evaluation or retrieval.

None of this is legal advice. Whether data may leave the building is a question for a lawyer in your organisation.

When one of these is settled, recheck the chapter it belongs to before relying on it.