Your AI stack needs an ownership policy, not another model subscription

Most businesses are still asking the wrong AI question.

They ask: which model should we use?

Claude? GPT? Gemini? DeepSeek? Qwen? Something local? Something routed through OpenRouter because the invoice from the frontier lab has started to look like a ransom note?

Fair question. Not the first one I would ask.

The better question is this. Who owns the AI system after the work is done?

Not the subscription. Not the login. The system.

Who owns the customer context? Who owns the prompts that actually work? Who owns the memory built up across campaigns, sales calls, support tickets and client work? Who owns the logs? Who can see which model touched which data? Who decides that this job can run on a cheap routed model, but that job has to stay inside a controlled environment? Who approves an agent before it sends, publishes, changes, quotes, deletes or spends?

That is the bit people keep skipping.

Over the last couple of days, a few separate AI stories pointed in the same direction.

Marketing School ran an episode on AI sovereignty. Strip away the bunker theatre and the useful question is simple: who controls your AI marketing stack? If an agency builds workflows for a client, does the client own the memory, data and operating context, or is it all trapped inside the agency’s private setup?

CNBC reported that US companies are using more Chinese AI models because the economics are hard to ignore. OpenRouter data cited in the piece put Chinese-model usage by US companies above 30% of tokens each week since February, well up from where it was before. Vercel reported fast uptake of GLM 5.2. Treat the exact numbers as reported platform data, not gospel, but the direction is obvious: teams are starting to route work to whatever model is good enough and cheap enough.

Google, meanwhile, expanded Managed Agents in the Gemini API: background execution, remote MCP server integration, custom functions and credential refresh. In plain English, agents are becoming workers that can run for longer, connect to real tools, keep state and refresh their own access as they go.

Anthropic published a case study from the Government of Alberta, where Claude Code scanned 466 million lines of government code in 20 hours with around 50 agents working in parallel. The important detail is not the big number. It is that findings cited exact files and lines, fixes were reviewed, tests were created where needed, and humans approved patches before anything shipped.

So the pattern is not “AI got smarter”. Fine, it probably did. That is not the useful bit.

The useful bit is that AI work is moving out of the chat box.

It is moving into model routers, background workers, document runtimes, CRM workflows, codebases, analytics pipelines, paid-media accounts, content systems and customer records. It is starting to remember things. It is starting to take actions. It is starting to touch systems that used to have a human sat in the middle with a spreadsheet, a browser tab and a mild sense of dread.

That changes the website brief. It changes the marketing brief. It changes the agency brief.

A business that uses AI properly is going to need an ownership policy for the operating layer around the model.

This does not mean every SME should go and buy GPUs or build a sovereign cloud. For most companies, that would be cosplay with a terrifying electricity bill.

It means you need boring answers to boring questions.

Where does the customer data live? Which parts of the business can be sent to external models? Which work can use a cheap model because it is low-risk, reversible and easy to check? Which work needs a stronger model because the reasoning actually matters? Which work cannot leave the stack at all? Where is the memory stored? Can the client take it with them? Can you show what happened if a customer, regulator, investor or angry founder asks?

That last one matters more than people admit. The early AI services market has a nasty habit of hiding the work. A client gets an output. Maybe a doc. Maybe a dashboard. Maybe a campaign. Underneath, there is a mess of chats, prompts, files, copied context, API keys, shared drives and random automation glue.

That might work for experiments. It does not work as infrastructure.

If an agency is building an AI marketing system for a client, the client should own the useful context. Not every internal implementation detail. But the durable business layer: sources, rules, memory, approved prompts, workflows, access policies, logs, evaluations and handoff docs.

Otherwise the agency has not built a system. It has built dependency.

This is where the post-agency model gets interesting.

The old agency sold output: campaigns, pages, ads, posts, designs, reports.

The lazy AI agency sells cheaper output: more campaigns, more pages, more ads, more posts, more reports, all vaguely smelling of the same model.

The better version builds operating layers.

That means a campaign system where research, positioning, assets, publishing, follow-up, measurement and learning are actually connected. It means a search visibility system where proof lives across pages, reviews, transcripts, third-party mentions and machine-readable sources. It means an agent-ready website where machines can read, cite, act, pay, log and escalate safely. It means a data policy that says what can go where. It means model routing with rules, not vibes.

And yes, it means sometimes using the cheap model.

There is no moral victory in paying frontier-model prices for work a cheaper model can do safely. There is also no cleverness in spraying sensitive customer context through whichever cheap lane happened to benchmark well on X this week.

Model choice is becoming a procurement detail. The operating layer is the moat.

So here is a simple test for any business owner. Can you answer these without calling a panic meeting?

What customer data is allowed into AI tools? Which model providers are approved for which kinds of work? Where does AI memory live? Who owns the prompts, workflow rules and source maps? What agent actions require approval? What gets logged? How would you prove what happened last Tuesday?

If the answer is “Dave knows, I think”, you do not have an AI stack. You have scattered tool use.

That is fine as a starting point. Everyone starts messy.

But the next step is not buying another subscription. It is drawing the ownership map.

What do we own? What does the vendor own? What does the agency manage? What can the client export? What is private? What is public? What can machines use freely? What needs attribution? What needs payment? What needs approval? What is completely off-limits?

That is not glamorous. It will not get as many clicks as “this one prompt replaced my team”.

Good.

The grown-up AI work is mostly unglamorous. It is sources, permissions, logs, routing, checks, handoffs and receipts.

Which is exactly why most businesses will avoid it until something breaks.

---

Jason Sibley is the founder of Cleo, a post-agency marketing and AI company. JasonVsTheNoise is where he writes about what is actually happening with AI, marketing, and how businesses should be thinking about both.