Skip to Content Skip to Menu Skip to Footer

This is a thought leadership report issued by S&P Global. This report does not constitute a rating action, neither was it discussed by a rating committee.

Highlights

Compute sovereignty has shifted from a compliance concern to a core strategic issue, as AI and advanced computing turn digital infrastructure into a critical utility on par with energy and transportation.

Dependence on hyperscale cloud, frontier AI models and concentrated semiconductor supply chains creates structural sovereignty risks spanning data, software, hardware, jurisdiction and operational control.

Geopolitical fragmentation — including export controls on AI chips, extraterritorial surveillance laws, and expanding regional regulations — is reshaping what technology can be used, where and by whom.

Sovereignty hinges on control of key technology pillars: the control plane, encryption and key management, supply chain, software stacks, and access to reliable, cost-effective energy for AI data centers.

Digital sovereignty — the ability of a government or organization to control its digital destiny unfettered by external influence or dependence — has been part of the IT landscape since the emergence of cloud computing. National and regional sovereign cloud initiatives have arisen to address growing concerns about operational control, data locality and jurisdictional governance.

However, the transformative power of AI raises the stakes: AI models, platforms and underlying infrastructure (data centers, clouds, servers and chips, metals and minerals, energy and power) hold economic, political and strategic power in an increasingly AI-driven economy.

Figure: Defining sovereignty

Digital sovereignty has become a major strategic issue for companies and countries as they seek to exercise control over their data, infrastructure and AI destiny in a landscape characterized by geopolitical volatility, trade disruption, ‘Big Tech’ dominance and fracturing trust. Momentum toward digital sovereignty — and compute sovereignty in particular — appears unstoppable, as it is a key enabler of technology independence, economic competitiveness and strategic autonomy. 

Compute sovereignty in a fragmented world

Compute sovereignty has been reframed from a compliance matter to a major strategic initiative. The convergence of compute infrastructure and AI capability means digital infrastructure carries weight similar to energy, water and transportation networks. Disruption — whether through technical failure, geopolitical action or regulatory intervention — can cascade into cross-sector operational failures. Regulatory frameworks are beginning to reflect this, but enterprise governance is still catching up.

Compute sovereignty drivers

Three structural forces are elevating the importance of compute sovereignty:

AI and advanced computing as strategic assets

AI and advanced computing have transformed digital infrastructure into a strategic asset. Rapid adoption of AI and advanced computing means computing power, specialized chips, frontier models and energy assets have become foundational to autonomy, economic competitiveness and national security. Access to compute capacity, accelerators and cloud services impacts innovation velocity, operational performance and ecosystem development — all of which raise the stakes for availability, cost, business continuity and operational resilience.

Large language models and AI as a service introduce new categories of sovereignty risk. Large-scale frontier models, developed primarily by US- and China-headquartered labs, are offered as managed API services and trained on data that may include enterprise content, representing a dependency that combines software, data, intellectual property and compute risks. Sovereignty issues arise regarding training (where it occurs; who can access data; data provenance), models (who owns and controls the "weights"  that assign importance in AI decision-making; where weights reside), inference (where prompts and outputs are processed; retention policies) and evaluation (auditability, bias testing, security testing).

Geopolitical fragmentation and expanding regulation

Sanctions and export controls on AI chips, cross-border disputes related to data access, extraterritorial legal instruments, and expanding national and regional frameworks spanning privacy, cybersecurity, resilience and AI governance increasingly shape what technology can be used, where, and by whom.

A concrete manifestation is that governments may compel disclosure of data held by companies subject to their laws, regardless of physical data location (e.g., the USA CLOUD Act and FISA section 702), creating legal exposure for enterprises handling personal data, regulated content or commercially sensitive information. Policy responses aim to reduce exposure to extraterritorial reach through ownership and operational constraints, but the effectiveness of such regimes remains an important consideration for risk owners. 

Market concentration in key technology layers

The dominance of US-headquartered firms across the cloud, AI and semiconductor sectors makes sovereignty a matter of strategic autonomy and national economic competitiveness, intensifying perceived concentration and dependency risks. As a result, the sovereignty "surface area" expands beyond data residency to include operational controls and resilience, procurement and supply-chain dependencies, and legal jurisdiction.

Software sovereignty is equally critical but often overlooked. Commercial software licenses can be suspended or revoked, either by the vendor or under government compulsion. Software dependencies — particularly those embedded in managed cloud services — can create invisible ties that make workload migration difficult or impossible, even when the underlying compute infrastructure is portable.

Technology pillars of sovereignty

The transition of sovereignty from abstract principle to architectural implementation raises questions of "where" (workload and data placement) and "how" (operational control and assurance).

Compute infrastructure, control planes and security

The control plane — IT software that manages compute resources, directs data flows and enforces policies — is the most sovereignty-sensitive technology component. Whoever controls the control plane controls the infrastructure. In hyperscale cloud environments, the provider operates the control plane, and customer access is limited. And when the control plane resides outside local jurisdiction, sovereignty can be compromised. Sovereignty requires either operational authority over the control plane by local, trusted personnel or the technical ability to verify and constrain what the control plane can do.

Ownership and operational control of physical compute infrastructure — servers, networking equipment, storage — represents one path to compute sovereignty, but it involves capital expenditure and operational complexity. Private cloud and on-premises deployments operated by trusted entities can offer strong sovereignty guarantees but require significant investment and may fall short of hyperscalers' global reach, performance and breadth of services.

Encryption, key management and secrets management are crucial to sovereignty, ensuring that the data owner maintains legal and operational control. Encryption backstops data residency regulations by rendering data unreadable to unauthorized entities. Cloud service providers are increasingly highlighting cybersecurity measures as part of the sovereign cloud value proposition.

Technology supply chain

The global technology supply chain is concentrated and geopolitically exposed. Most silicon-based semiconductors and microprocessors are manufactured in Taiwan, the US, Mainland China and the Far East, and chip export limits can curtail local AI model training. Advanced chip designers and semiconductor manufacturers (NVIDIA, TSMC, Intel, AMD, ARM) wield structural power through hardware supply, with export controls shaping regional AI capabilities. Networking hardware is similarly concentrated, with some vendors facing persistent — if largely unsubstantiated — concerns about potential hidden access capabilities in defense and national infrastructure contexts.

The current US administration’s shifting positions on semiconductor export controls illustrate how chip supply can be used as a geopolitical instrument. The 2022 CHIPS Act restricted NVIDIA GPU exports (primarily to China) to limit access to frontier AI compute capabilities. Subsequent Trump administration modifications have shifted the focus from subsidies promoting domestic semiconductor manufacturing to export tariffs. Enterprises operating globally must recognize supply chain concentration risk and prioritize supply chain diversification.

Further, US-based AI model builders (OpenAI, Anthropic, Google, Meta, xAI) dominate, with emerging competitors in China (Qwen, DeepSeek) and notable exceptions including Mistral (France) and Flacon (UAE).

Software stacks and open source

Software is an often-overlooked dimension of the sovereignty discussion. Access to software-dependent cloud services can be suspended or revoked, either by vendors or at the direction of their home country governments. As noted above, software dependencies embedded in cloud services can significantly hinder workload migration.

The EU’s emphasis on open source and open digital ecosystems reflects the homegrown technology dimension of its digital sovereignty strategy. However, open source requires skilled personnel, may lack the managed service capabilities of commercial offerings, and can itself develop concentration risks around a few dominant contributors.

Governments and enterprises increasingly look to open-source software to mitigate sovereignty risk and vendor lock-in. Technologies such as Kubernetes for container orchestration and the Linux operating system provide vendor-neutral foundations that can be deployed, modified and supported by any competent technical team. At the AI layer, open-weight models from Meta (Llama), Mistral, and the broader Hugging Face ecosystem provide alternatives to proprietary API services.

Energy and capital

Energy, once background infrastructure in the technology landscape, has become a foundational component and constraint in the AI era. Compute sovereignty for AI and cloud requires a massive, continuous and secure electricity supply to power data centers and the AI factories housed within them. Jurisdictional controls and data residency and processing requirements necessitate localized infrastructure, which, in turn, requires reliable access to cost-efficient power and associated infrastructure (e.g., generators, power distribution, cooling and battery energy storage systems). Energy access is emerging as a determining factor in the feasibility and cost of compute sovereignty.

The energy intensity of GPU-based compute for large-scale AI training and inference is well documented. The figure below shows the estimated power capacity required for IT equipment in current and announced data centers at regional and select country levels.

Energy access and reliable grids are prerequisites for AI development and compute sovereignty. We estimate the global buildout of planned data center facilities could exceed $200 billion per year, notably excluding the cost of IT equipment and electrical infrastructure (see figure below).

Tech sector stakeholders and sovereignty-minded governments recognize that AI is a winner-take-most opportunity. As a result, AI projects are attracting capital from technology vendors and AI-adjacent energy infrastructure investors as developers and national governments seek to meet aggressive tech timelines, address the realities of power generation and establish a measure of compute sovereignty.

Process pillars of sovereignty

Data locality and jurisdiction

Data locality — storing and processing data within a geographic boundary — is the most widely understood compute sovereignty principle and the one most directly addressed by existing regulation. For example, GDPR prohibits the transfer of EU residents' data to jurisdictions that lack adequate protection. Sectoral regulations (financial services, health, government) frequently impose additional localization requirements. However, locality alone is insufficient for sovereignty. A server in Germany administered by a US-headquartered company can be subject to US legal processes. As such, jurisdiction follows ownership and operational control, not just physical location. Enterprises must assess both where data is stored and under what legal authority it is held.

Operational control (data and metadata)

Operational sovereignty means that the people and processes responsible for system administration are subject to the legal authority of the relevant jurisdiction. This includes access to customer-generated metadata, which can be as sensitive as primary data itself, and which hyperscale providers routinely collect and may be compelled to disclose.

Suppliers offer a range of bring-your-own-key (BYOK) and hold-your-own-key (HYOK) encryption models that are better than provider-managed keys in a sovereignty context, but are not the complete picture. Encryption at rest and in transit does not protect against a provider that may be legally compelled to maintain service while providing access to decrypted data. Confidential computing technologies, which protect data in use within secure processor enclaves, represent a more complete technical solution, though they add complexity and are not universally available.

Personnel (locality and nationality)

The nationality and location of personnel with privileged access are key sovereignty considerations. Individuals with administrative access to critical systems can be subject to the jurisdiction of their country of citizenship or residence, regardless of where the system is located. Sovereignty frameworks specify requirements for the nationality, security clearance and location of personnel with access to sensitive systems — particularly for government and defense workloads. With hyperscaler sovereign offerings in Europe, for example, operations are typically limited to EU-based staff subject to local employment laws.

National and regional regulation and oversight

In Europe and elsewhere, controls are increasingly codified through regulatory frameworks spanning privacy, cybersecurity and resilience.

The EU’s regulatory architecture — GDPR, NIS2, DORA, the AI Act, the Data Act and the Data Governance Act — defines a comprehensive sovereignty framework for enterprise technology (see the figure below for a summary of selected countries’ cloud, AI and data regulatory and strategic frameworks).

Certification and attestation

Certification programs provide third-party assurance that a cloud provider or technology solution meets defined sovereignty standards. The EU Agency for Cybersecurity (ENISA) has developed the European Cybersecurity Certification Scheme for Cloud Services (EUCS), which defines assurance levels for cloud sovereignty. Additional attestation mechanisms include France’s SecNumCloud and Germany’s BSI C5 certifications, the UK’s Cyber Essentials and G-Cloud frameworks, NATO’s cloud security standards, and various national critical infrastructure certification schemes.

Sovereign cloud solutions

US-headquartered hyperscale cloud providers (AWS, Microsoft, Google) have introduced localized stacks, operational processes and data protection commitments that address governments', regulators' and critical infrastructure operators' concerns about regulation, cybersecurity and digital resilience. However, most remain subject to US legal jurisdiction and retain architectural dependencies that limit true sovereignty and may not fully address strategic autonomy and national technology development objectives.

For the most sensitive workloads, on-premises or private cloud deployments operated by trusted national entities may be the only option for full sovereignty. However, EU-native providers such as OVHcloud, IONOS, Scaleway, T-Systems and S3NS that offer legal independence lack the scale and AI capabilities of the major US platforms.

In Europe, regulatory compliance is the primary sovereignty driver, while in the Gulf States and Saudi Arabia, rapid AI data center and power development is funded by state-led sovereign wealth investment. Various sovereignty approaches are emerging in Asia-Pacific, including reliance on state-backed national champions and hyperscaler partnerships.

The figure below highlights measures that enterprises are taking to comply with national and regional data sovereignty requirements.

Looking forward: Sovereignty and the increasing politicization of digital technology

The digital landscape is a highly politicized ecosystem where control over data, AI and infrastructure has become a proxy for economic and strategic power. AI’s transformative power has created a complex system of stakeholders vying for influence.

The path forward requires a fundamental shift in perspective. Sovereignty cannot be viewed as a simple IT or compliance issue. It must be a core tenet of corporate strategy, risk management and long-term resilience. Enterprises face a choice: proactively design their architectural and procurement strategies for a sovereign future, or have their operations dictated by the unpredictable tides of politics and regulation. The commitments may be significant, but the cost of inaction will undoubtedly be higher.

AI acceleration has raised the stakes. Increasing reliance on GPU compute, AI models, power and managed AI services introduces new categories of dependency risk.

Geopolitical fragmentation is accelerating. Export controls, sanctions, extraterritorial surveillance laws and shifting trade relationships are creating a risk environment in which yesterday's approved vendor may become tomorrow's compliance problem.

Regulatory frameworks are tightening globally. Data localization requirements in India, China, Saudi Arabia and elsewhere are raising the bar for enterprise technology governance.

Full sovereignty, encompassing legal independence, hardware ownership and technical portability, requires additional architectural and procurement commitments that most enterprises have not yet made.

Contributors: Matt Tompkins and Mahnoor Haider

Content Type

Special Reports