On a mild June morning in Paris, the definition of "sovereignty" was put starkly into question when Anton Carniaux, Microsoft’s legal director in the country, told lawmakers under oath that it could not guarantee citizens' data held through public contracts would remain protected from U.S. authorities without local consent.

To some IT providers and business leaders, Carniaux’s comments forced a can of worms out into the open, filled with fears that true power over data was, in fact, an illusion. Others, however, had long been privy to this idea, with the specter of the U.S. Clarifying Lawful Overseas Use of Data (CLOUD) Act looming large and ultimately lending credence to Noam Chomsky’s 2010 observation: “History shows that, more often than not, loss of sovereignty leads to liberalization imposed in the interests of the powerful.”

In the weeks and months since Carniaux’s comments, the drumbeat of sovereignty as it pertains to the digital domain grew ever louder, culminating in leading European connectivity providers framing it as a means to obtain more favored regulatory, pro-investment support from Brussels during this year's Mobile World Congress (MWC) event.

Of course, we’ve been through similar before, like with the General Data Protection Regulation (GDPR), and its predecessor, the Data Protection Directive of 1995, along with the Electronic Commerce Directive from the turn of the century, and even the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data from the 1980s. These four horsemen of the sov-pocalypse, then, are the ultimate precursors to the concept of digital self-determination we seem to once again find ourselves wrangling with in the wake of Carniaux’s continent-conquering comments.

So why are we talking about this so much now? And to what end are we actually talking about genuine sovereignty? Or are we just victims of the latest geopolitically-induced marketing ploy?

The case against: The fallacy of true control

On the one hand, recent politically charged diatribes about sovereignty have left some, like IDC’s Rahiel Nasir, viewing it as a “distraction” from the true core of digital sovereignty.

“Leave the politics to Brussels,” the analyst firm’s research director for cloud and infrastructure services said in conversation with SDxCentral, adding: “If you're in the IT industry, and you're a technologist, you want a technical solution to a technical problem.”

Nasir argued that the discourse has left vendors feeling they have to offer a “sovereignty solution” in order to do business in Europe, forcing them to build offerings to ultimately make the problem fit the solution instead of building to solve actual customer problems.

But on the customer side itself, Nasir said purchasers of solutions are being left feeling they need to have some kind of sovereign solution because they’re being told they need one, even when the specific offering may not address their actual needs.

“Fifteen months ago, organizations that had never uttered the words digital sovereignty have been coming out of the woodwork and are now suddenly saying, ‘hey, we've got a solution for digital sovereignty,'" Nasir said. "And you lift the lid, what is it? It is just data localization and data residency."

Nasir acknowledged such offerings fit partly under the overall umbrella of sovereignty, but not the be-all and end-all, with security a huge, often overlooked part.

“A lot of organizations conflate security and sovereignty,” Nasir said, “You can have security without sovereignty, but you can't have sovereignty without security.”

A key example the IDC research director referenced was the war in the Middle East, with multiple Amazon Web Services (AWS) data centers targeted and physically damaged by drone strikes from Iranian forces. That flashpoint, Nasir argued, was a true example of how organizations should be viewing sovereignty: as a means to ensure resiliency.

“We used to call it business continuity and disaster recovery. And if you haven't got all your ducks in a row and you haven't got good policy initiatives in place to carry on with your operations, then that's poor IT practice. That's not a new thing," Nasir said. "It's a war today. It was a pandemic yesterday. It's cyberattacks tomorrow, which are going to continue. So, what have you got in place to prevent and continue operations in the event of anything? We talk about it in the context of sovereignty, but it's everybody, whether they want sovereignty with solutions or not; you need to think about resilience today.”

Nasir wasn’t the only one who used the war in the Middle East as a wake‑up call for resilience rather than sovereignty, as Posetiv Cloud CEO Mark Butcher argued that the drone strikes on AWS facilities exposed just how dangerously concentrated and fragile global banking’s cloud dependencies had become.

“If you think about it quite literally, if they really wanted to, the hyperscalers could basically cut out global banking in a heartbeat,” Butcher said. “The attacks actually led a lot of financial services institutions to realize they had a massive dependency on one or two regions for the transit of huge amounts of their traffic globally. And even worse, none of them even considered it, and all their competitors had the same flaw – creating a gigantic, targeted risk vector with absolutely total dependency.”

So while sovereignty is supposedly on everyone’s lips, for firms potentially in the actual firing line, Butcher argues the real problem is the tangible legal and risk issues from becoming entirely too dependent on global hyperscalers. And that dependence isn’t confined to infrastructure, with even supposedly “sovereign” AI services quietly bursting beyond national borders.

Butcher points to Microsoft’s Copilot as another example. Sold to governments and enterprises as region‑bound, the chatbot tool is yet able to spill workloads into other regions should capacity run short, and, in the case of frontier models, sometimes running only from the U.S.

In the case of Copilot, then, Butcher argued it was the most visible symptom of a deeper problem, with sovereignty marketed as a feature, where, in fact, it is delivered as a fiction.

“You actually have no controls over what your users are doing and that your users are going to be dumping customer and personally sensitive data out into a region where it has no controls, where there's no protection and no governance that aligns with how we need to protect things," Butcher said. “Everywhere we look, we're littered with sovereign risks and no one's willing to stand up to the hyperscalers and actually hold them accountable.”

In Nasir's view, France is one of the few bastions to the contrary.

The French government has made moves against U.S. technology, with public officials barred from using videoconferencing platforms like Google Meet, Zoom, and Teams in favor of software designed by the country’s Interministerial Digital Authority that runs on infrastructure from local cloud provider Outscale.

The IDC analyst pointed to another example from the European crown jewel of hyperscale hassling: OVHcloud.

But in the view of Nasir, sovereignty isn’t as high on the French cloud computing company’s agenda, with OVHcloud feeling that sovereignty is a narrative they've been telling for several years and that it no longer needs to be as high as it used to be on their agenda, despite Nasir believing they still have a strong story to tell and should be making more of it.

Butcher is more ambivalent, acknowledging France is at least pointed in the right direction, but doing it “in the usual French militant way,” more interested in the ideological gesture than building something that lasts.

Another example Nasir offered that’s actually making some strides is T-Systems – the IT arm of Deutsche Telekom. In the IDC analyst’s view, T-Systems is central to the European sovereignty story, but not in an “opposition” role, instead acting as more of a bridge or custodian than someone standing up to hyperscalers.

“T-Systems is a great example because if you look at exactly what T-Systems has done, and years ago, Microsoft beat a path to T-Systems’ door because they thought they'd stumbled upon this idea before we were all talking about sovereignty the way we're talking about it now, they thought you can be our custodians of data," Nasir explained. "Now, when the hyperscalers think about Germany, they all want to partner with T-Systems [because] it’s partnerships that are the success to any ‘sovereignty solution’ in Europe.”

As a result, the German player has secured tie-ups with Microsoft, AWS, and Google Cloud. The IDC analyst highlights that for all of the continental wrangling, European cloud customers don't actually want to abandon the U.S. providers, but nor do they want to go 100% with the local providers, revealing results of the analyst firm’s surveys of customers wanting solely local providers being in the single digits.

For Nasir, the problem ultimately comes down to who gets to define the term.

“Sovereignty is in the eye of the beholder,” Nasir said. “For too long, we've let the vendors define what sovereignty is and what they've ended up doing is creating 'sovereignty cloud solutions' that make the problem fit the solution rather than the solution fitting the problem.”

“Many of the hyperscalers who have now launched sovereign cloud solutions in Europe do so via a dedicated ‘sovereign’ region and/or a spectrum of offerings that vendors," Nasir continued. "While most vendors acknowledge ‘one-size does not fit all’, customers seeking sovereignty need to select from a portfolio of products that meet their precise needs; they end up trying to make the problem fit the solution rather than the other way around.”

The case for: A design, not a feature

Not everyone is ready to write off the concept entirely, however. For Logan Wolfe, a cybersecurity veteran and a senior leader within Kyndryl’s Consult practice, the problem isn't that digital sovereignty is a concept that’s fiction, but more that too many people are looking for it in the wrong places.

“Sovereignty is not a SKU one can buy,” Wolfe told SDxCentral. “It's not a one-and-done kind of situation. It is more of a scale where you have trade-offs.”

The Kyndryl exec defines sovereignty as “the ability to operate a business or critical business functions, mission-critical systems independently of undue foreign influence or disruptions.”

But beyond a standard one-line definition, Wolfe resisted binary thinking and instead leaned on Gartner’s taxonomy of three distinct pillars: data sovereignty, operational sovereignty, and technical sovereignty.

Progress, Wolfe argues, is genuinely achievable on the first two. Customer-controlled encryption keys, locally hosted data, and regionally credentialed operating teams, none of which is smoke and mirrors. Where it gets difficult, Wolfe concedes, is the third pillar: hardware and software supply chains that, if you pull the thread far enough, inevitably end up somewhere uncomfortable.

That analogy is instructive. Cybersecurity, Wolfe notes, has always been a trade-off against usability. You could make your iPhone completely secure by turning it off, locking it in a safe, and dropping it to the bottom of the Pacific … but then you can't use it.

Wolfe argues that sovereignty should work the same way. The question isn't whether you can achieve it in absolute terms, but how far along that spectrum your risk appetite demands you go.

That framing matters because it shifts the conversation away from the binary that vendors have been happy to exploit in the wake of Carniaux’s comments.

Instead of asking whether sovereignty is real or not, Wolfe argues organizations should be exploring what level of sovereignty is appropriate for their specific situation, and then demanding evidence, not slogans.

The Kyndryl exec expressed cautious optimism, arguing the talk around sovereignty was in fact maturing, becoming more sophisticated, and moving beyond being a mere buzzword.

The catalyst for that maturity, in Wolfe's view, compared to prior sovereign-like precursors, has been AI. By embedding decisions and capabilities into mission-critical workflows, AI has moved sovereignty from a policy question into an operational risk that business leaders can no longer afford to abstract away.

That shift, if it does hold, is precisely what the skeptics have been demanding. Whether the market has the appetite to follow through is another question entirely.

“Leaders have kind of realized that we now need controls and evidence, not slogans," Wolfe said. "And so it's really becoming a design discipline, much less so than a cloud feature or an architecture approach. … It's a fundamental risk operating principle. I just think it's kind of here to stay.”

This article first appeared in the SDxCentral Sovereignty Supplement.

To read the Supplement for free, simply register.