Data residency isn’t the same as data sovereignty

Keeping data within national borders can meet an important requirement, but it does not, on its own, establish who can access that data, how it is protected, or whether it can be moved when circumstances change. Those questions are becoming more pressing as AI workloads span multiple environments and depend on a wider network of providers and technologies.

We can’t deny that location matters. Regulated industries can't ignore residency rules, and 62% of European organisations are now actively pursuing sovereign solutions in response to geopolitical uncertainty. But, if you view sovereignty purely through a geographic lens, and you will build new limits at exactly the moment AI workloads are becoming more distributed, not less.

AI systems rely on data models and computing resources that may be spread across different environments. The important question is whether organisations can adapt to where those components are run without losing oversight. Sovereignty depends on being able to make those choices while maintaining governance and control.

The mobility test

The truth is that portability is complicated. Once data and workloads depend on a provider’s native services, moving them can be difficult, or in some cases, impossible. Mobility doesn't happen by default; it has to be deliberately designed, and then tested, before it is needed.

Without that groundwork, sovereignty becomes another constraint. An architecture designed only for residency can struggle when business changes or new regulation arrives. The more useful framing is flexibility under control. Organisations should be able to decide where a given workload runs based on performance, cost, risk, and compliance, while keeping a coherent view of the data, the model, and the decision trail.

This is one reason we're seeing the emergence of Neocloud providers across Europe. They are built for AI workloads, around the assumption that organisations need advanced AI infrastructure without losing control of where data resides and how it moves.

That same tension of sovereignty ambitions running up against real-world dependency is seen beyond AI compute. The NHS's Federated Data Platform, built specifically to unify UK patient data under UK control, was awarded to Palantir. This prompted sustained debate over whether sensitive health data can genuinely stay sovereign under a foreign provider's contract, It highlights the need for a more nuanced approach as vendors increasingly launch dedicated sovereignty solutions, such as NetApp’s Keystone Sovereign.

It's a reminder that intending to keep control and actually retaining it are two different things, and true sovereignty needs both to be effective.

Duplication doesn’t equal protection

A sovereignty strategy can create an unintended cost: making data available across more environments may mean creating more copies. Each one adds storage, lifecycle-management and governance overhead. I call this the “copy tax”. At petabyte scale, the multiplier matters more than the unit price.

None of this is new. Standardising on one platform tends to look simple and cost-effective until ownership, licensing, or commercial priorities shift, at which point many organisations discover their dependency runs deeper than they realised. Leaving is slower, messier and pricier than anyone planned for. A massive AI estate locked into one provider's native storage format carries the same shape of risk, only with much larger datasets.

The UK’s competition regulator has already looked at how this plays out in the wider cloud market. The Competition and Markets Authority concluded that egress fees and technical barriers discourage customers from switching, and in March this year Microsoft and Amazon set out voluntary actions on egress charges and interoperability.

Sovereignty is supposed to expand your options. Passing today's compliance check tells you almost nothing about whether your data is truly sovereign. The real test is: can you show a regulator that you've genuinely moved a production dataset - and on what timeline?

Regulators want evidence not intent

Regulatory expectations are shifting in exactly this direction. Financial institutions operating under DORA must now show they can recover from a segregated copy and move off a provider entirely if required. Although it is EU legislation, it is relevant to UK firms with operations in the EU. In the UK, the Prudential Regulation Authority has expected banks and insurers to maintain tested exit plans for material outsourcing since 2022, with its latest requirements due to take effect in March 2027. An exit plan must work in practice, not just exist on paper.

Control must be able to be demonstrated, through where sensitive data is held, how it is protected, and whether operations can be restored from an immutable, segregated copy. Object storage alone does not provide ransomware protection; recent large-scale retail incidents have made the consequences of inadequate recovery planning clear.

Sovereignty as an ongoing practice, not a milestone

When organisations can demonstrate control, mobility, and recoverability, sovereignty can strengthen both regulatory confidence and business agility. If any of those capabilities are missing, choices may narrow and responding to change can become harder. As AI workloads spread across environments and trust domains, these capabilities matter more.

For IT and infrastructure leaders assessing AI platforms, the key question is not only where data is stored. It is whether the organisation can move it when needed, maintain governance along the way, and avoid disrupting operations.

Sovereignty is not a status to declare once. It is the ability to make choices and prove you can act on them.