No place like on-prem

For years, cloud sovereignty came down to one question: where is my data stored? It was quick to answer, simple to audit and easy to put into a tender document: keep it in the country and the box is ticked. But sovereignty now stretches beyond where data is actually stored to how it's governed, protected and used. "For years, I've reminded people that the P in GDPR stands for protection, not privacy," says Didier Ongena, VP of global government and EMEA public sector at Microsoft. "There can't be sovereignty if there is no cybersecurity."

The World Economic Forum's Global Cybersecurity Outlook 2026 says that two-thirds of organisations have already adjusted their cybersecurity strategies in response to geopolitical instability, with AI now seen as the most significant driver of cybersecurity change. The difficulty is that some approaches to sovereignty and security can pull in opposite directions. A sovereignty strategy is built to keep outsiders out. That's the whole point, after all; limiting which foreign providers can reach your systems and who outside your jurisdiction can see what's running. Security works the other way around because it depends on visibility. "Security is a signals game," says Ongena. "The more you close yourself off from signals, the less prepared you are." Signals in this context mean attack data—the information collected by a security provider in its customer base. If a new attack method breaks through, it gets identified and blocked for everyone else on the platform. But those signals only help if something can process them at the speed they arrive, and Ongena's view is that without AI in the security tooling, an organisation can handle neither the volume nor the pace.