Sovereign AI is more than a pin on a map

Most conversations about sovereign AI still begin with a map. If the data sits inside the UK, or inside a particular cloud region, control is assumed and the box gets ticked. That view is understandable, but it only gets you halfway.

 

Location matters. Regulated industries cannot ignore residency requirements. But treat sovereignty as geography, and you create new limits just as AI workloads become more spread out.

 

An enterprise may train a model in one environment and run inference in another, while its most sensitive data stays on premises. Sovereignty becomes a question of controlled choice. Where data lives, where compute runs, and what can move between them without losing governance or control.

 

Data that cannot move becomes data that limits you

Portability is hard. Once data and workloads depend on a provider’s native services, moving them can be difficult, or in some cases, impossible. So, mobility has to be designed for and proven.

 

Without that, sovereignty becomes another constraint. An architecture designed only for residency can struggle when business changes or new regulation arrives. The more useful framing is flexibility under control. Organisations should be able to decide where a given workload runs based on performance, cost, risk, and compliance, while keeping a coherent view of the data, the model, and the decision trail.

 

This is one reason we’re seeing the emergence of Neocloud providers across Europe. They are built for AI workloads, around the assumption that organisations need advanced AI infrastructure without losing control of where data resides and how it moves. Britain has seen just how quickly capacity promised in one place can slip. Stargate UK was announced in 2025 as sovereign AI infrastructure, with up to 8,000 GPUs planned through the neocloud Nscale. In April, OpenAI paused it, citing energy costs and regulation.

 

The direction of travel is not the point. Sometimes the model moves to the data; sometimes only the working set is cached next to GPUs. Either way, there should never be a separate, ungoverned copy.

 

Every extra copy of your data carries a tax

There is a quiet risk in the current sovereignty conversation. In the effort to meet residency and control requirements, some architectures trade one dependency for another. This is what I call the copy tax. Every new place that consumes data can demand its own copy, with its own storage cost, lifecycle, and governance overhead. At petabyte scale, the multiplier matters more than the unit price.

 

We have seen this pattern before. A common platform can initially deliver simplicity, consistency and attractive economics. But when ownership, licensing models or commercial priorities change, organisations often discover that their dependency runs deeper than expected, and that leaving is slower, more complex and more expensive than planned. A massive AI estate locked into one provider’s native storage format carries the same shape of risk, only with much larger datasets.

 

The UK’s competition regulator has already looked at how this plays out in the wider cloud market. The Competition and Markets Authority concluded that egress fees and technical barriers discourage customers from switching, and in March this year Microsoft and Amazon set out voluntary actions on egress charges and interoperability.

 

Sovereignty should expand choice. Passing today’s compliance check tells you little about that. The better test is whether you can show a regulator that you have actually moved a production dataset, on what timeline, and with what disruption.

 

That requires a consistent data layer across environments, with the same governance and protection in each of them while data moves between them.

 

Assertion is no longer enough

Under the Digital Operational Resilience Act (DORA), in force since January 2025, supervisors expect evidence that a financial institution can recover from a segregated copy and that it could move off a provider if required. DORA is EU law, but it reaches UK firms with operations in the EU. Moreover, the Prudential Regulation Authority has expected UK banks and insurers to maintain tested exit plans for material outsourcing since 2022, with the most up-to-date iteration effective March 2027. An exit path that exists only on paper doesn’t count.

 

Demonstrable control comes first. A firm has to show where its sensitive data resides and how it is protected. Recoverability too, meaning the ability to restore operations from an immutable, segregated copy. Object storage offers no ransomware protection of its own, and recent large-scale retail incidents made the cost of that gap very public.

 

When these elements are present, sovereignty supports both regulatory confidence and business agility. When any one of them is missing, the organisation eventually pays for it later, in narrower choices or slower response to change. AI is making these trade-offs harder to ignore because workloads that once lived in a single environment now span multiple locations and trust domains.

 

Sovereignty should provide flexibility under control, not simply put a pin on a map.

 

---

 

Jurgen Hofkens is CTO and VP Solutions Engineering for EMEA/LATAM at NetApp

 

Main image courtesy of iStockPhoto.com and Galeanu Mihai