Tech buyers are baking in sovereignty from day one, says Forrester
Forrester says organisations are increasingly treating digital sovereignty as a core design requirement for new cloud and AI projects, rather than addressing it later. This matters particularly in Europe, where regulatory and geopolitical concerns are heightened by reliance on US technology providers and limited domestic hyperscale AI capacity.
Buyers are examining not only where data is held, but also control of encryption keys, operational access, model training locations and applicable laws. The EU is seeking up to seven AI gigafactories with up to €10 billion in public funding and €20 billion in expected private investment, while European providers hold about 15 per cent of the region’s cloud infrastructure market; Gartner expects sovereign-cloud spending to more than triple from 2025 to 2027.
In short
- Sovereignty is becoming a starting point for cloud and AI procurement.
- European firms face greater reliance on US technology suppliers.
- EU investment aims to strengthen domestic AI and cloud capabilities.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Treating sovereignty as a design requirement from the outset can help organisations protect sensitive data, maintain operational continuity and meet changing legal obligations without costly retrofits. Supporters argue that control over encryption, access and AI training reduces exposure to foreign jurisdiction, geopolitical disruption and concentrated dependency on a few global providers, while encouraging European technical capacity and competition.
The case against
Making sovereignty a primary requirement from day one can narrow supplier choice and raise costs, particularly where domestic alternatives lack the scale, features or security investment of leading global providers. Critics argue that robust contractual safeguards, encryption and risk management can often address legitimate concerns without fragmenting cloud and AI systems, and that overly rigid localisation rules may slow innovation, collaboration and access to the best technology.
Explained simply
Digital sovereignty is about how much control an organisation or country has over its data and the technology used to process it. For cloud and AI services, that can depend on where data is stored, who holds the encryption keys, where models are trained and which country’s laws apply.
European organisations often use technology from large US providers, while European companies have a smaller share of the region’s cloud infrastructure. The EU is backing plans for AI computing facilities, known as gigafactories, as demand for computing power grows.
These choices matter because laws and international tensions can affect who can access data and how services are run. Building sovereignty requirements into a project from the start can shape which providers and systems organisations choose.
AI Americas Europe Technology World