For years, cloud sovereignty was shorthand for data residency. Keep it local, keep it compliant, so the thinking went, and you’ll keep regulators happy. But as AI rewires what organisations actually need from their infrastructure, sovereignty is now more than simply where a server sits.
Ashesh Badani, senior vice president and chief product officer, Red Hat, describes sovereignty, AI and virtualisation as three interwoven threads. Organisations building sovereign environments at present are managing legacy virtual machines that they can’t decommission, and container-based, AI-native workloads are seeing increased usage in leading edge companies. The expectation is that a single platform will now carry both. “No one is setting up a sovereign environment today without thinking about AI,” says Badani. “Customers who are setting up sovereign environments want to make sure they’re supporting both containers and machines, because you have some legacy VMs and these new cloud-native workloads.”
Digital sovereignty isn't a project you finish and tick off. It's a continuous journey where you keep re-evaluating your risks, your cloud estate and your partners as technology and regulations evolve.
Jon Tullett, IDC
A platform that can only address one side creates its own problems. What Badani calls a virtualisation cost crisis – or overspending on proprietary, legacy virtualisation – doesn’t just slow modernisation, it limits what organisations can put toward building AI-capable, sovereign infrastructure.
And no organisation wants to be left behind on AI, with many boards asking questions about whether they’re spending enough to stay competitive. Refusing to fund AI is becoming untenable, which means the discussion about legacy spend and sovereign platform investment now has the attention of the CEO and board rather than staying in IT. There is also the old problem of lock-in to be considered, which is now as much a geopolitical problem as a technical one.
“Given all the geopolitical pressures, every country wants to have some control over their future action,” says Badani. “I don’t know if you can extricate yourself completely, but every country wants some mobility.” Being locked into a single proprietary stack doesn’t just constrain technical options. In Badani’s view, it constrains policy, economic and innovation options at a national level, which is why sovereignty has moved from a compliance consideration to a strategic priority.
The discussion about sovereignty used to take place in your legal department, says Badani. “Now it’s also happening in your architecture review.” Regulators in financial services, healthcare and government are now all looking more closely at AI, and this has forced a more precise definition of what sovereignty actually means, he says.
This conversation about sovereignty used to happen in your legal department. Now it's also happening in your architecture review.
Ashesh Badani, Red Hat
Badani says cloud sovereignty is concerned with three factors: the ability to choose and run AI models anywhere; the assurance that data used to train and run those models stays under organisational control and within required jurisdictions; and the ability to audit, and, if necessary, override every significant AI decision.
“Real sovereignty isn't defined by geography alone. It's defined by authority,” says President Ntuli, managing director of HPE South Africa. “If your data sits in-country, but the provider remains subject to foreign jurisdiction, then control over who can access that data is partial, at best.” And, it bears mentioning, sovereignty is not a fixed destination. Digital sovereignty is not about residency, and it’s not even about governance, says Jon Tullett, associate research director for IT services and cloud, IDC. “It’s about being in control of your digital future. It’s about taking control of your digital destiny.” This control requires continuous attention rather than a one-time decision.
“Digital sovereignty isn’t a project you finish and tick off,” says Tullett. “It’s a continuous journey where you keep re-evaluating your risks, your cloud estate and your partners as technology and regulations evolve.”
DO THESE THINGS NOW
For many organisations, cloud sovereignty is a principle without a plan. Didier Ongena, VP of global government and EMEA public sector, Microsoft, suggests some practical steps that organisations can follow.
Elevate to board level
Sovereignty isn’t an IT decision. “This is a board discussion, a discussion you need to have at the highest level,” says Ongena. Getting there in practice means putting the CIO, CISO and Data Protection Officer in the same room, since these functions rarely speak to each other by default. When they do, the conversation shifts from theoretical risk to practical ownership, and that’s where a sovereignty strategy actually takes shape. Once those three are aligned, he says: “I know I’m already half there.”
Understand and prioritise the risks
Risk should be mapped by impact and probability rather than by how often it’s being discussed in the press or around the boardroom table, because the two don’t always align. “You need to think about all of them in a holistic way,” says Ongena, before classifying and mapping each one against where it actually sits on that grid. Lawful access requests and sanctions, for instance, tend to dominate conversation precisely because they’re high-impact, even though they’re historically rare, while the operational risks that occur far more often get comparatively little attention. Sorting the loud from the likely is the first real test of a sovereignty strategy.
Apply a proportional mitigation strategy
Once risks are mapped, the response has to scale to match, rather than treating every scenario as equally urgent. “The way you manage those risks is very, very different,” Ongena says, depending on where they land on the impact-versus-probability grid, and that difference should shape how much time, money and architecture gets devoted to each one. A low-probability risk shouldn’t reshape an entire system, while a high-probability one earns daily, active attention. A rare but severe scenario is better served by a disaster recovery plan held in reserve than by a permanent, expensive redesign of how an organisation operates day to day, and proportionality is what keeps a sovereignty strategy sustainable rather than paralysing.
Diversify, plan exits, ensure continuity
Organisations should keep using every capability available to them rather than scaling back out of fear, and that’s the mindset Ongena pushes hardest. “I’m not going to reduce my capabilities now,” he says, describing an approach built around a clear fallback plan that only kicks in if access were ever genuinely lost, covering what’s “absolutely required” to keep functioning, services such as email and document exchange. The continuity plan should protect today’s ambition rather than shrink it pre-emptively. In practice, that means knowing in advance exactly which applications are mission-critical instead of working it out mid-crisis, and building an explicit, deliberate architecture instead of one that accumulated by accident across years of separate procurement tenders.
Be holistic in your assessment
What dominates public debate and what actually gets discussed in the room where decisions are made are often two different conversations, a gap Ongena calls “audio and video”. But inaction carries its own risk, and it’s one organisations tend to neglect. “The risk of not doing it is at least as big as the risk of doing it,” he says, and a genuinely holistic assessment has to balance both sides of the equation rather than defaulting to whichever answer sounds more plausible in the moment. Organisations that lock everything down in the name of safety can end up forfeiting the productivity and innovation gains they set out to capture in the first place.
Preserve openness
Sovereignty shouldn’t mean shutting doors, and Ongena says the approach should be built around choice, whether that’s public cloud, private cloud or hybrid, because no single architecture fits every organisation or every risk. “We don’t want customers to make those trade-offs,” he says. Closing off options, partners or technologies in the pursuit of control tends to leave organisations less prepared, particularly given how quickly the sovereignty conversation itself keeps shifting underfoot. Staying open to new architectures and partnerships, instead of fixing on one model too early, is ultimately what lets a sovereignty strategy keep pace with the risks it’s meant to manage.
* Article first published on www.itweb.co.za
Share
