Data is the foundation on which national economies now run. We have seen global corporations and public sector bodies systemically destabilised by a single breach, with impacts great enough to shift GDP figures. The CrowdStrike outage in July 2024, for example, disrupted airlines, health care providers, financial institutions, and government services around the world, demonstrating how a single point of failure in the digital ecosystem can have far-reaching operational and financial consequences. According to analysis from global reinsurance broker Guy Carpenter, insured losses from the incident were expected to reach $1 billion. 

For a decade, businesses have migrated to the cloud in pursuit of greater efficiency, lower costs, and instant scalability without the capital burden of owning and operating data centres. But in prioritizing operational agility over strategic autonomy, many have also ceded a degree of control over their own data, which now often sits in cloud environments owned by overseas providers, governed by foreign laws and beyond domestic oversight. In many cases, organizations no longer have complete visibility over where their data resides, who can access it, or which legal jurisdiction ultimately controls it.

That trade-off is now being tested in ways many organizations never anticipated, as geopolitical instability, cybersecurity threats, and AI increase both the value of data and the consequences of losing control over it.

Why sovereignty has become an infrastructure challenge

Data sovereignty means very different things to different people. For some, it’s simply about where data is stored – a matter of residency. But that’s a dangerously narrow view. True sovereignty is about the level of control: your ability to retain full legal, regulatory, and operational authority over your data. These are not questions of geography, but of organizational or governmental reliance and autonomy. Data may be hosted within a national border; but if control over identities, administration, and infrastructure sits elsewhere, true sovereignty remains elusive.

Three sets of events have pushed sovereignty to the top of the critical national infrastructure (CNI) agenda. First, acts of sabotage carried out by nation-states – such as the attacks on subsea cables in the Baltic Sea – have exposed the vulnerabilities of digital infrastructure and highlighted the threat to national economies. 

Second, regulations such as NIS2 and the EU Cyber Resilience Act are demanding greater accountability for supply chains and cloud governance. Microsoft’s testimony to the French Parliament that it could not guarantee that domestically-held customer data was beyond the reach of the U.S. government highlighted the limits of so-called “local hosting.” 

Third, large language models (LLMs), AI agents, and cloud-hosted inference environments are processing growing volumes of sensitive intellectual property, customer information, and operational data. Sovereignty is therefore no longer just about where data is stored: it also extends to where AI models are hosted, who can access prompts and outputs, how training data is governed, and which legal jurisdictions ultimately apply.

So how can organisations move towards sovereignty? 

Building resilience through real control

The bottom line is that organizations shouldn’t trust any provider that can’t clearly define and prove the layers of data sovereignty, backed up by enforceable and contractual assurances. For too long, cloud providers have issued comforting but vague statements about customers’ data being hosted in domestic data centers, but they haven’t told the full story. Real sovereignty relies on end-to-end observability across the data plane: on knowing exactly who can access a dataset, how that access is governed, and which laws are being applied.

Governments and regulators are also placing greater emphasis on digital sovereignty, the ability for nations and organizations to retain control over the digital infrastructure that underpins critical services. The U.K.’s AI Opportunities Action Plan, for example, offered a roadmap for safe, scalable digital transformation across the economy. Likewise, France has made digital and AI sovereignty a central pillar of its national AI strategy, investing heavily in domestic cloud, compute, and data infrastructure as governments seek greater control over the technologies underpinning growth. There is growing recognition that organizations must have a clear line of sight over where data lives and who controls it.

Transparency is the foundation of sovereignty

Too often, procurement teams have treated digital infrastructure as a race to the bottom on cost, without fully understanding the associated risks. When contracts go to the lowest bidder, with questions about access and governance sidestepped as complex and expensive, we create a false economy: savings realised during procurement will disappear the moment a cybersecurity incident exposes the costs of hidden dependencies across providers and supply chains.

As digital infrastructure becomes more critical to national economies and business operations, those questions need to become part of every procurement process. Boards and technology leaders should expect clear answers about who controls encryption keys, who has privileged access, where data is replicated and backed up, what legal obligations providers have to foreign governments, and whether those arrangements can be independently audited. 

Cost and speed will always matter, but they can no longer be the only measures of value. Organisations must procure for resilience as well as efficiency.

Sovereignty as an architectural requirement

Sovereignty is not about abandoning the cloud or bringing every workload back on-premises. Nor is it simply about where data is stored. It is about ensuring that organizations have the visibility and governance needed to understand their dependencies, manage risk, and respond decisively when incidents occur.

The real question for decision-makers is no longer whether sovereignty matters, but how much dependency they are willing to accept. In a world defined by interconnected digital infrastructure, sovereignty will never be absolute. But those that build practical sovereignty into their architecture, procurement, and governance today will be far better positioned to navigate the operational, regulatory, and geopolitical challenges of tomorrow.