For European buyers, sovereignty is “a meaningful differentiator, but it should not outweigh security concerns,” Dai said. Open weights and self-hosting shift responsibility for guardrails, access controls, monitoring and misuse prevention to the operator, he added.

“Sovereignty and security therefore need to be evaluated together, not traded against each other,” Dai said.

Daftary said enterprises self-hosting Large 4 for code audit or vulnerability triage should run it as a controlled component, not an autonomous agent. That means isolated environments, least-privilege access to code and credentials, sandboxed generated code, and human sign-off before any remediation, she said. “Self-hosting can improve data control and operational continuity, but it also makes the enterprise solely responsible for patching, monitoring, evaluation and misuse prevention,” she said.