A new Forrester report evaluating 15 of the largest sovereign cloud providers highlighted a significant evolution in how enterprises manage sensitive data as they move away from plug-and-play solutions.

Analysts found that organizations are opting for diverse architectural models, including public clouds with data boundaries, hybrid private clouds, and fully air-gapped environments.

The newly released Forrester Wave, Sovereign Cloud Platforms report also identified several industry leaders, most notably Google Cloud, Microsoft, and Amazon Web Services (AWS) for their distinct approaches to digital autonomy.

The findings highlighted that digital sovereignty has become a central pillar of global cloud strategy, no longer being a niche requirement for the public sector. This is a result of the market shift from simple data residency toward a sovereignty-by-design approach that balances high-speed AI innovation with rigorous regional compliance.

In its 2026 evaluation, Forrester noted that the ability to deliver AI capabilities in a sovereign framework is a "true differentiator" for teams.

The report suggested that digital sovereignty has shifted from being a specialized bonus feature to a mandatory requirement for entry, noting that leaders in the space are those that can provide consistent sovereign controls across multiple environments without sacrificing the agility of modern cloud services. This allows regulated industries, such as defense, intelligence, and health care, to leverage generative AI while maintaining strict operational autonomy.

Google Cloud, Microsoft, and AWS as market leaders

The evaluation identified several industry leaders, with Google Cloud, Microsoft, and AWS topping the list with their distinct approaches to digital autonomy.

Google Cloud was lauded for its roadmap of delivering sovereignty as a standard feature. Its strategy spans three distinct tiers: a public cloud data boundary for commercial enterprises, a dedicated cloud managed by local partners for operational sovereignty, and the Google Distributed Cloud (GDC) for physically self-contained, air-gapped deployments.

Microsoft secured its leadership position by providing consistent controls across its public and private cloud offerings. By using Azure Local and Azure Arc, Microsoft allows organizations to operate and secure workloads identically across connected or disconnected environments, preventing the fragmentation of tools and teams.

AWS was recognized for its sovereign-by-design philosophy, specifically focusing on providing deep technical capabilities rather than rushing to market. The report also highlighted AWS' commitment to offering the same level of innovation in sovereign environments as in its standard public cloud.

Oracle was also recognized as a strong leader in this space, praised for its ability to extend cloud services directly into a client's physical location. Notable offerings include its Fully Isolated Regions that disconnects operations for mission-critical tasks, and its Exadata Cloud@Customer and Compute Cloud@Customer, which allow organizations to run Oracle’s sovereign cloud capabilities in their own data centers.

Tencent Cloud was distinguished as the only Chinese hyperscaler to maintain a "consistently deliberate" sovereign cloud strategy, catering to the specific regulatory demands of its primary markets.

Tencent Cloud Europe GM Fred Sun told SDxCentral during the recent Mobile World Congress (MWC) 2026 event that sovereignty was a "very important topic" for Tencent, with the company compliant with Germany's Cloud Computing Compliance Criteria Catalogue (C5) and the Europe-wide General Data Protection Regulation (GDPR), as audited by third-parties such as the Cloud Infrastructure Service Providers in Europe (CISPE).

"We place the highest importance on compliance in all the regions Tencent operates in," Sun claimed, adding the cloud market has diversified away from "monolithic public cloud" in pursuit of sovereignty.

Overall, Forrester’s research emphasized that modern sovereignty is best achieved through a combination of technical controls, such as customer-managed encryption keys, operational practices, local personnel and independent oversight, and contractual commitments.

Additional reporting by Giacomo Lee.