Enterprise AI · Sovereign cloud

Sovereign cloud, explained.

What people mean by sovereign cloud, why it's in the news, and what it could mean for your organisation. A neutral guide that doesn't argue for or against any option.

Talk it through →See it in a playbook

In short

What sovereign cloud means

Sovereign cloud is a broad label for cloud services set up so that an organisation, or a country, keeps more control over its data and the systems that run it.

Control can mean four different things: where the data is stored, whose laws apply to it, who runs and can access the systems, and whether you could carry on, or move, if a supplier changed course.

There's no single legal definition in the UK. Providers use the word in different ways, so it's worth asking each one exactly what they mean by it.

You'll often see the word “hyperscaler” in this debate. It means the three largest global cloud providers: Amazon Web Services (AWS), Microsoft Azure and Google Cloud. All three are headquartered in the US. All three also sell sovereign options of their own.

Four meanings

Four things people mean by it

When someone says “sovereign”, they usually mean one or more of these. Each one goes further than the last, and usually costs more effort.

01

Data residency

Where your data is physically stored and processed. A UK region keeps data in UK data centres. It's the easiest of the four to achieve. On its own, it doesn't change which country's laws can reach the data.

02

Data sovereignty

Which country's laws apply to the data, and who could be legally required to hand it over. That depends on where the provider is incorporated and headquartered, as well as where the data sits.

03

Operational sovereignty

Who runs the service day to day: who can log in, who provides support, and who holds the encryption keys. Some offerings limit this to staff living in a given region, or to a separate local company.

04

Technical or digital sovereignty

Whether you could keep running, or move, if a supplier changed its prices, its terms or its ownership, or stopped serving you. It covers open standards and portable software and, at the far end, where the hardware comes from.

Why now

Why it's in the news

  • Laws that reach across borders. The US CLOUD Act of 2018 confirmed that US authorities can require providers under US jurisdiction to hand over data they control, wherever it's stored. Others point to the legal safeguards, and to how rarely this happens to business customers. Part 2 sets out both sides.
  • Concentration. In July 2025 the UK's Competition and Markets Authority (CMA) found that two providers hold most of the UK cloud market. In July 2026 HM Treasury designated AWS, Google Cloud, Microsoft and Oracle as “critical third parties” to the UK financial sector, which puts their services to it under direct oversight by the Bank of England, the PRA and the FCA.
  • Outages. In October 2025, separate faults at major public clouds disrupted many services for several hours, including in the UK. Smaller providers have had serious failures too.
  • New products. AWS opened its European Sovereign Cloud in January 2026. Microsoft and Google have expanded their sovereign offerings, and European providers such as IONOS, OVHcloud, Scaleway and STACKIT compete for the same work.
  • UK policy. The government launched its Sovereign AI Unit in April 2026, with up to £500 million to invest in UK AI companies. It has also designated five AI Growth Zones for large new AI data centres.

If you also operate in the EU

The EU side

The EU is moving faster than the UK on formal rules. If you operate in both, these are worth knowing.

  • The European Commission now scores cloud providers on sovereignty when it buys for EU institutions. Its Cloud Sovereignty Framework has eight objectives, and levels from SEAL-0 to SEAL-4. It awarded four sovereign cloud contracts under it in April 2026.
  • In June 2026 the Commission proposed a Cloud and AI Development Act. It would create a single EU-wide way to assess cloud and AI sovereignty, with a mechanism to steer public sector buying. It's a proposal, not yet law.
  • The EU's planned cloud security certification scheme, known as EUCS, has been held up for years by disagreement over whether to include sovereignty requirements.
  • The EU Data Act gives customers in the EU a right to switch cloud provider. From 12 January 2027, providers can't charge for switching.
  • Data in an EU region is EU residency, not UK residency. For UK personal data, the UK treats the European Economic Area as adequate, so transfers there are allowed under UK GDPR.

This guide

What's in the other three parts

01

Why it matters, and why it may not

The main arguments, each set next to its strongest counterpoint: jurisdiction, resilience, regulators, cost and capability, and AI models.

02

Your options

From a public cloud region in the UK, through the hyperscalers' sovereign offerings and European and UK providers, to private cloud, on-premises and hybrid. What each gives you, and what it doesn't.

03

How to decide

A workload-by-workload approach, the questions to ask each time, and the design patterns that keep your options open whichever way you go.

Where I stand

I deliver on any of them

I've designed, built and run systems on AWS, Azure, Google Cloud, on-premises and hybrid estates for over 20 years. I don't sell any platform. I don't have a view on which country or provider you should trust. That's your decision.

What I bring is experience of making each option work well: the architecture, the security, the migration and the day-to-day running. In my Enterprise AI playbooks, every solution is shown three ways: on AWS, on Azure, and on an open, portable “sovereign or on-prem” stack. IONOS appears there as one example host, not a recommendation.

The rest of the guide

Keep reading.

Why it matters, and why it may not

The main arguments for sovereign cloud, each set next to its strongest counterpoint. Neither column is the right one. Which carries more weight depends on your situation.

Your options

Sovereignty isn't a yes or no. It's a spectrum, and each option gives you more control in some areas and less in others. Here's what each gives you, and what it doesn't.

How to decide

You don't need one answer for the whole organisation. Decide workload by workload, ask the same questions each time, and design so you can change your mind later.

FAQ

Questions people ask

Something not covered here? Ask me directly →

Is sovereign cloud a legal requirement in the UK?

Not as a general rule. No UK law says all data must stay in the UK or with a UK-owned provider. Specific rules apply in some areas: UK GDPR controls transfers of personal data abroad, some government and defence work has its own handling rules, and regulated firms must manage the risks of their cloud suppliers. Your contracts may add requirements of their own.

Does using a UK region make my data sovereign?

It gives you data residency: the data is stored in the UK. On its own, it doesn't change which country's laws apply to the provider. Whether that matters depends on your data and your risk assessment. Part 2 sets out both sides.

Is this about leaving AWS, Azure or Google Cloud?

Not necessarily. All three now sell sovereign options of their own, and many organisations use a mix of providers. For most, the real question is which workloads need which level of control.

Is sovereign cloud only for government?

No. Banks, insurers, healthcare, defence suppliers, law firms and companies with sensitive intellectual property all ask about it. Plenty of organisations look at it carefully and decide a standard public cloud region suits them.

Sources, checked 9 November 2026

Whichever way you go, it has to work.

There's no single right answer. It depends on your data, your regulators, your risk appetite and your budget. I'll help you weigh it up, then lead or support the delivery of whichever you choose.

Book a call →How I work alongside your team
Sam Naseem
Sam NaseemBirmingham, UK · UK & Europe
Available now