The cloud computing conversation has changed significantly over the past few years. Earlier, enterprises selected cloud platforms mainly for scalability, global reach, agility and cost flexibility. Today, those priorities remain important, but they are no longer sufficient. Governments, regulators, boards and customers are asking a deeper question: where does critical data reside, who can access it, who operates the infrastructure and which legal jurisdiction ultimately governs it? This is the context in which sovereign cloud has moved from a specialist requirement for governments into a mainstream enterprise architecture consideration.

Sovereign cloud refers to cloud environments designed to preserve data residency, legal control, operational independence and regulatory compliance within a defined jurisdiction. In practical terms, it is not merely a cloud region located inside a country. A mature sovereign cloud model includes a combination of local data storage, strict identity and access control, encryption key ownership, local personnel controls, auditability, contractual protections, operational segregation and, in some cases, disconnected or air-gapped deployment options. Its central purpose is to allow organizations to consume cloud and AI capabilities while reducing exposure to cross-border data transfer risk, extraterritorial access concerns and regulatory uncertainty.

Recent trends in sovereign cloud

The first major trend is the shift from data residency to full digital sovereignty. Data residency answers the question of where data is stored. Digital sovereignty goes further by addressing legal jurisdiction, administrative access, operational control, encryption key management and dependency on foreign technology providers. This distinction has become increasingly important as enterprises recognize that locating data in a domestic region does not automatically remove legal or operational exposure.

The second trend is the rapid convergence of sovereign cloud and artificial intelligence. Generative AI and large-scale analytics rely on sensitive enterprise data, customer information, intellectual property, telemetry and domain-specific knowledge. As a result, enterprises are increasingly asking whether AI training, inference, prompts, embeddings, logs and model outputs should remain within national or regional boundaries. Sovereign AI infrastructure is therefore emerging as a natural extension of sovereign cloud, especially in regulated industries and public-sector environments.

In the figure above, you can see each layer builds on the ones before it, moving from a storage question to a question of legal, operational and technological independence, showing sovereignty is cumulative.

The third trend is the rise of hybrid sovereign architectures. Few enterprises can move every workload into a fully isolated sovereign environment without affecting agility or cost. Instead, many organizations are adopting a layered model. Highly regulated workloads such as citizen services, payment systems, healthcare records, defense data and critical infrastructure systems are placed in sovereign or private cloud environments, while less sensitive workloads continue to use mainstream public cloud regions. This approach allows enterprises to balance sovereignty, innovation, performance and economics.

In the figure above, hybrid sovereign architecture model is built as a layered approach that balances sovereignty, innovation, performance and economics.

The fourth trend is the growing importance of local partnerships. Hyperscale providers are increasingly working with regional telecom operators, system integrators, government-backed entities and local infrastructure providers to meet country-specific sovereignty requirements. These collaborations help address demands for local operations, domestic ownership, regional support and compliance with national security policies. At the same time, local cloud providers are refreshing their platforms to offer modern automation, cloud-native services, security tooling and managed operations.

The fifth trend is the growing use of policy-as-code and sovereign-by-design controls. Enterprises want sovereignty to be enforced through architecture, not only through contractual language. This is creating demand for region-locked deployment policies, controlled replication, customer-managed keys, confidential computing, localized identity administration, immutable audit trails and automated evidence collection for regulators and auditors.

Industry adoption of sovereign cloud

Government and public sector organizations remain the most visible adopters of sovereign cloud. Their workloads often include citizen identity, taxation, welfare, defense, justice, digital public infrastructure, border management and national emergency systems. These systems carry high public trust obligations and governments increasingly prefer cloud platforms that provide clear control over data location, local administration, audit rights and national continuity.

Banking, financial services and insurance are also strong candidates for sovereign cloud adoption. Banks handle personal financial data, payment transactions, fraud signals, credit records, trading information and regulatory reporting data. Sovereign cloud helps financial institutions align with central bank expectations, operational resilience mandates, cybersecurity requirements and audit obligations. It also enables safer use of AI for fraud detection, customer intelligence, risk modeling and compliance monitoring.

Healthcare and life sciences organizations are adopting sovereign cloud to protect patient records, clinical trials, diagnostics, genomics data, medical imaging and public health information. The sensitivity of healthcare data makes jurisdictional clarity extremely important. Sovereign cloud can support secure collaboration, research analytics, hospital modernization, AI-assisted diagnostics and telemedicine platforms while maintaining tighter data governance.

Telecommunications providers use sovereign cloud for network functions, 5G core workloads, subscriber data, lawful interception systems, edge platforms and national communication infrastructure. Because telecom networks are often classified as critical infrastructure, sovereignty requirements can influence decisions on hosting, operations, resiliency and supply-chain assurance. Here is a summarized view of various industrial adoption across different use cases.

Manufacturing, energy, utilities and transportation sectors are beginning to view sovereign cloud as part of industrial resilience. Operational technology data, plant telemetry, grid analytics, digital twins, predictive maintenance models and supply-chain intelligence are increasingly valuable assets. For these industries, sovereignty is closely tied to business continuity, cyber resilience, industrial secrecy and national economic security.

Cost implications of sovereign cloud adoption

Sovereign cloud adoption may increase cost when compared with standard public cloud deployment, especially in the early stages. Additional costs can arise from localized infrastructure, dedicated regions, private cloud environments, local operations teams, specialized compliance controls, sovereign connectivity, encryption key management, audit tooling and managed security services. In some cases, organizations may also need to redesign applications to prevent unapproved cross-border replication or dependency on non-sovereign platform services.

However, the cost discussion should not be limited to infrastructure premiums. Enterprises must compare the added cost of sovereign controls with the potential cost of regulatory penalties, reputational damage, business interruption, loss of public trust, failed audits, contractual exclusion from regulated markets and inability to use sensitive data for AI safely. For a regulated enterprise, sovereignty can become an enabler of revenue protection and market access rather than a pure compliance expense.

FinOps discipline becomes essential in sovereign cloud programs. Organizations should classify workloads by sovereignty need, avoid over-engineering low-risk applications, monitor data egress, negotiate transparent pricing, standardize deployment patterns and use automation to reduce operational overhead. A pragmatic cost model normally separates workloads into tiers: highly sovereign, regulated but cloud-friendly and general enterprise workloads. This allows the organization to apply the highest controls where they matter most.

Benefits of sovereign cloud for enterprises

The most direct benefit of sovereign cloud is improved regulatory alignment. Enterprises operating across multiple jurisdictions can demonstrate stronger control over data storage, processing, access and movement. This is especially valuable when serving government clients, regulated sectors or customers with strict data protection expectations.

A second benefit is enhanced trust. Customers, regulators and partners are more likely to support digital initiatives when an enterprise can explain where sensitive information resides, who operates the environment and how access is governed. In sectors such as healthcare, banking, public services and critical infrastructure, trust is not a soft value; it is a commercial and operational requirement.

A third benefit is stronger resilience. Sovereign cloud can support local continuity planning, controlled dependency management, regional disaster recovery and clearer operational accountability. When designed properly, it reduces the risk that geopolitical disruption, foreign legal orders, supply-chain fragility or cross-border service restrictions will affect mission-critical systems.

A fourth benefit is responsible AI enablement. Many organizations hesitate to use AI on sensitive data because of uncertainty about retention, training, inference and cross-border processing. Sovereign cloud provides a more controlled foundation for AI adoption by combining data isolation, model governance, auditable operations and policy-driven controls.

Analyst perspective on future trends

Analyst research indicates that sovereign cloud is becoming a fast-growing part of the cloud market rather than a narrow compliance niche. Gartner forecasts worldwide sovereign cloud infrastructure-as-a-service spending to reach US$80 billion in 2026, reflecting 35.6% growth from 2025 and also notes that sovereign cloud spending could shift a meaningful share of workloads from global to local providers. Earlier Gartner research also projected strong long-term growth for sovereign cloud IaaS, driven by regulatory demand, operational independence and technological autonomy.

Forrester’s recent work on digital sovereignty highlights that organizations are no longer treating sovereignty as a simple data residency issue. Its sovereign cloud platform research emphasizes that different deployment models are required for different risk profiles, ranging from public cloud with sovereign controls to private, partner-operated and disconnected environments. This reinforces an important market reality: sovereignty is becoming a design principle across the IT stack, not a single product category.

IDC’s digital sovereignty research points to regulatory compliance, national and regional legislation, protection against extraterritorial data requests, AI adoption and strategic partnerships as key forces shaping the market. IDC’s infrastructure predictions also caution that sovereignty programs can add cost and complexity, requiring stronger data classification, governance, security controls, partner ecosystems and skills development.

Everest Group’s research frames sovereign cloud as closely connected to sovereign AI, enterprise autonomy, data governance and operational control. Its European sovereign cloud analysis describes a market being shaped by geopolitical tension, stronger privacy mandates, concerns about foreign surveillance laws and the need for clearer sovereignty frameworks across data, operational and technical dimensions. Everest Group’s broader private cloud research also indicates that AI, automation, workload repatriation, hybrid-first strategies and sovereignty mandates are increasing demand for controlled cloud environments.

Conclusion

Sovereign cloud is best understood as a response to a broader shift in enterprise technology: the movement from borderless cloud consumption to governed digital autonomy. It does not reject public cloud innovation; rather, it asks cloud platforms to operate within clearer legal, operational and architectural boundaries. For enterprises, the strategic question is not whether every workload must become sovereign. The better question is which data, systems, AI workloads and business processes require sovereign protection and how that protection can be delivered without slowing innovation.

The future of sovereign cloud will likely be hybrid, policy-driven, AI-aware and industry-specific. Organizations that treat sovereignty as an architectural capability will be better positioned than those that approach it as a last-minute compliance checkbox. The winners will be enterprises that build a balanced operating model: global where possible, local where necessary and sovereign where trust, regulation and resilience demand it.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Over the course of his career, Jim Reavis has seen cloud and cloud security evolve, and it’s come a long way since being a niche technology in the early 2000s. Now it’s dominant in terms of being the IT foundation, he says, but while the tech is strong, the operating models is where things get messy. Cloud, security, and third-party risk teams look at different parts of the problem, of course, but challenges remain.

“Operational technology worries me a great deal,” he says. “A lot of those systems are isolated and not kept up to date. If we don’t modernize them, we’re going to have huge problems. In a lot of cases, things fall between the cracks and that’s where hackers like to exist.”

So much of what’s around the models is where cybersecurity has responsibility, rather than the provider covering everything. “Data, identity, and applications are shared responsibility areas, and in many cases, the tenant carries most of the control burden,” Reavis says. “If you use a hyperscaler, you may still have about 80% of the responsibility for the controls around what you build.”

And when it comes to AI, the model isn’t the whole problem. What matters is the context around it, the goals it’s given, and the oversight put in place, he says. “We need to think carefully about the harnesses we put around AI and the systems we use,” he adds.

The responsibility model, therefore, is a recurring issue in cloud security breaches tied to misconfiguration and accountability gaps, and some enterprises still aren’t clear about where responsibility begins and ends. “We spent a lot of time on a shared security responsibility model, but when this first started to gain popularity, there were a lot of organizations or SaaS providers you could work with who’d say it’s in the cloud, it’s at Amazon,” he says. “Look at their certifications and SOC2 and how they comply because they’re covering everything.” But when you look at the actual applications, data, and identity, he adds, there’s so much that’s shared responsibility, and the customer’s responsibility.

So how do we make sure information is encrypted properly so it doesn’t become a tenant issue? “There’s still a bit to do, and we think about this not only from whether it’s SaaS, infrastructure, or a particular provider, but at what level is it at the physical, network, or audit level,” he says. “And even from a role-based perspective, what’s the role of internal risk and role of providers?”

Reavis gives further detail about how AI adoption exposes weaknesses in identity, trust, and risk management, and the long-term implications of increasingly interconnected cloud ecosystems. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.

On cloud risk management: When we had the Chat GPT moment, we knew it because AI had been around for a while, but that was a cloud delivered version of AI to the masses, so we saw this going to evolve and you could see it combining in many important areas.

But what we’ve learned is, because this is an interesting predictive rather than deterministic technology, we’re living in a world of two exponentials, and you’re seeing model capabilities growing so quickly. There’s this feeling from a security perspective that we have to look to the model itself and fix every hallucination and everything else when that’s built into how it works. It’s actually working as intended. So that’s a new lesson. Models are going to get more powerful, but it’s so much of what’s around the models where cybersecurity has responsibility, and we don’t rely on frontier model companies or using open-weight models. Rather, what’s the context, oversight, and information we’re providing them, what do we do in terms of goals we give them, and what are the harnesses we put around AI and the models we deal with?

These are going to be the big areas to think about, but we have to understand the parts we can control. We’ve got to think carefully about the harnesses, transparency, and using supply chain shared responsibility. SaaS and cloud providers are all AI enabled now. You’re not using any software of any significance that isn’t using AI to some degree.

On AI identity, trust, and control: One of the areas that we’ve championed is zero trust as a philosophy. It was initially more of a networking type of approach at the network layer, or an idea that you use identity to understand network access. But it’s evolved more to an idea that anything can be breached, so you assume that. Then you think about how to make systems resilient, and build up confidence and protection.

So zero trust tells us that with human identity, we can ask what our digital identity is, and now we’re in a very interesting area for identity management and associating that with agents and AI systems. People might have just one view of it, but agents are as diverse as humans. So we think about different identities and least privilege, and how to prevent them from escalating privileges. We need to introduce new concepts like least autonomy, and think about an agent that has certain tasks and use identity to make sure the actions it takes are within a defined scope. Because while we’ll see a lot of security incidents with AI, proportionately we’ll see more misconfiguration and bad things that happen because of broken processes. And the AI system just deletes things because it thought that’s what it’s supposed to do.

So it’s important to make strides in how we think about identity and agents, and the idea of digital workers. How do we manage and treat those? If we think about them too much in either one of those realms, we’re going to fail. So we have to understand what’s the right blend. It’s a new area and very exciting.

On risk and legacy systems: When I think about operational technology, sometimes systems are isolated and not kept up to date. That concerns me a great deal. We’re going to have huge problems there. We have concerns about existential risks, where people don’t want to use the latest technologies and be aggressive adopters of AI. I think that’s going to create real scale issues with organizations.

So we have to understand where we are, where we’re going, and have a vision that serves something between human and technology, maybe a hybrid, but we’ve got to make our peace with it and understand the appropriate harnesses and direction where humans should always be in the loop with control. But it’s appearing in some new areas of cybersecurity where we haven’t traditionally thought about. Software development looks very different now than it did 12 months ago, and 12 months from now, cybersecurity is going to be really different, too.

On cloud security and implementation: Cloud security is cybersecurity for all intents and purposes. We have so much tooling and technology that’s really good, but there’s a lot of inconsistencies with the operating models organizations have. Even way back with CSA and NIST defining this, it was clear that SaaS was a layer on top of infrastructure as a service. But we diverged, and you see in a lot of enterprises there’s diffused ownership where you have cloud and security teams, and then you have third-party risk that deals with the SaaS team. Then there are inconsistencies in how risks are managed, so internal development and expectations from our partners can really diverge. They have a lot of regulations to deal with, so it creates vetting and investment challenges while striving for consistent models.

Some security teams might still use older checklists to talk to their cloud teams, but scaling with new tech becomes an issue if you’re not thinking about operations. It ends up being a human and a structure problem that makes it harder to take advantage of all the great technology that’s out there.

Kyndryl and Broadcom on Thursday rolled out new consulting services for VMware Cloud Foundation (VCF), tweaking the initiative to be an AI program and pledging to invest in the skills development of several thousand certified Kyndryl consultants, architects, and delivery specialists to enable agentic workflows.

“Against the backdrop of rising sovereignty demands, enterprises are rationalizing their hybrid and private cloud environments, and they require a pragmatic, outcome-driven approach,” said Giovanni Carraro, global strategic alliances leader at Kyndryl, in a news release. “By expanding our partnership with Broadcom and investing in VCF skills, we will help customers build modern, resilient, private clouds that enable AI adoption, support data modernization, address the risk of AI-identified vulnerabilities and deliver real business value.”

Analysts and consultants said the partnership expansion was fairly mundane in itself, but they did think there was meaningful potential in the consultant program.

Mike Leone, a VP/principal analyst at Moor Insights & Strategy, thought that the significant part of the partnership is in the skills investment.

“Enterprises moved onto VCF pretty quickly, and now they’re at the harder stage of actually modernizing it,” he said. “More companies than you think have lost their deep VMware talent, so that work stalls out. Broadcom putting real money behind training a few thousand Kyndryl consultants is a direct answer to that.”

He noted that it isn’t glamorous, but delivery capacity is usually what decides whether a platform gets used well. “Kyndryl’s a logical partner for it too,” he said. “They already run a huge amount of VMware for customers, so this resources a relationship that was already there.”

But Sanchit Vir Gogia, chief analyst at Greyhound Research, questioned how much is really new with this announcement. 

“This is neither a new alliance nor a new platform. Kyndryl and VMware expanded their partnership in November 2021, and managed-services status followed in August 2023, so the relationship is old and the packaging is new,” Gogia pointed out. “What has been announced is scaffolding: consulting, certification, and managed operations built around VMware Cloud Foundation 9.1, with no disclosed financial commitment, no exclusivity, and no named launch customer.”

Gogia said this shows strong interest in private clouds from these two vendors, but he questioned how much enterprise interest exists today in private clouds.

 “No broad enterprise migration from public cloud back to private cloud is visible, and this announcement does not establish that one is needed,” Gogia said. “The defensible reading is selective workload placement. The announcement does not prove that enterprises must shift to private cloud, it proves that Broadcom and Kyndryl want a larger role when enterprises decide where workloads run.”

Justin Greis, CEO of consulting firm Acceligence, disagreed, and said that he found the announcement interesting, “because they are trying to make that private portion of the equation behave more like cloud rather than simply resurrecting the old corporate data center. Automation, policy as code, container support, developer experience, AI inference and agent governance are all part of that proposition.”

However, he said that the boost in personnel is potentially significant. 

“I think the investment in thousands of trained Kyndryl people may ultimately be more consequential than some of the technology language in the announcement,” Greis noted. “Enterprise infrastructure is already incredibly complicated. Add AI agents, multiple models, new governance requirements and hybrid infrastructure, and the skills required to operate all of it become a major constraint. Technology vendors can build increasingly sophisticated platforms, but enterprises still need people capable of turning those platforms into reliable operating environments.”

Shashi Bellamkonda, a principal research director at Info-Tech Research Group, added he saw another element in the statement.

“I see a double-edged irony in this. Broadcom’s post-acquisition VMware pricing is itself what pushed many tech leaders into pain and dependency, and the product it now sells is the antidote,” Bellamkonda said. “VCF, marketed as the route to sovereignty from governments and hyperscalers, leaves buyers just as dependent on Broadcom commercially as they were before. Sovereignty from a jurisdiction is not the same as independence from a vendor.”

This article originally appeared on NetworkWorld.

Brands like Snickers, M&M’s, and Twix are familiar to most consumers, but Mars Inc. doesn’t just produce snacks. The family-owned company, with a revenue of approximately $65 billion, is also one of the largest manufacturers of pet food and ready meals, and its more than 100 production facilities operate around the clock. Of course, this places considerable demands on its IT.

“Our team must ensure that every system, including production lines, runs at maximum performance so we can continuously deliver the products and services our customers value,” says Luciano Batista, the company’s VP of enterprise services delivery.

However, Batista and his team realized that the existing data infrastructure could no longer reliably support operations, especially during peak periods such as Halloween and the pre-Christmas shopping season. So with the support of hybrid, multi-cloud data storage service Everpure, Mars is rebuilding its data and IT infrastructure.

“The Everpure platform met all our requirements,” says Batista. “It’s a scalable platform that futureproofs our operations and integrates seamlessly with our hybrid cloud infrastructure.”

Unified storage environment 

Mars initially consolidated its complex network of storage systems for business-critical databases like Oracle and applications like SAP onto a single Everpure Flash Array system. These software-defined, all-flash storage arrays are available in versions for different workloads, and typical use cases include databases, virtualized environments, SAP applications, and AI and analytics applications. 

Mars has since expanded its flash array infrastructure and now supports mixed workloads, including VMware, Windows, and Linux in areas of production, development, and quality assurance. It also uses Everpure Flash Blade as the basis for the global SAP file system. And while Flash Array is optimized for structured data, the scale-out systems of the Flash Blade series are designed for unstructured information.

“At peak times, Everpure supports up to 300,000 IOPS without any performance degradation,” says Lincoln Silva, product owner for Linux and on-prem storage at Mars. From his perspective, another point speaks favorably of the new platform in that he estimates his team saves approximately three months of planning time thanks to the Evergreen subscription model. This is because the vendor provides regular updates for the storage platform’s hardware and software. As a result, Mars’ IT professionals can focus on more critical tasks. 

Basis for hybrid cloud strategy

Mars also works with choice vendors to implement its approach to cloud. Dedicated local storage capabilities, for instance, are being integrated into Microsoft Azure cloud workloads, which simplifies restore processes and increases resilience.

Snapshots from the local environment can be replicated to the cloud, too. Recovery point objectives (RPEs) of four to 24 hours are available, depending on system priority. “Our success is also the success of our partners,” Batista says. “We embrace a spirit of reciprocity to get the most out of our collaboration.”

The hybrid cloud allows Mars to run VMware workloads and extend its IT infrastructure to the cloud as needed. And the company aims to expand its use of cloud-native applications via Microsoft Azure at a lower cost.

“We’re seeing a data reduction ratio of 18 to one. That’s nine times the expected compression rate,” Batista adds. “This puts us on track to save up to 50% on cloud storage costs. We can now work more efficiently and make better decisions thanks to intelligent solutions and automation.”

Fewer racks and lower power consumption

By consolidating on the flash platform, Mars has also reduced the space requirements and power consumption of its data centers so they only use one sixth of the power, and the number of racks has decreased significantly.

“We’re shaping a sustainable future by changing the way we work,” says Batista. “The decisions we make today will impact the world we leave behind, and Everpure aligns with our commitment to thinking in generations, not just business quarters.”