Postcards from the Future 5: How we shifted to the sovereign clouds

Postcards from the future No. 5

This postcard looks back from 2031, a time when sovereign clouds are commonplace and functioning smoothly. Geopolitical shifts and technology advances drove the change. Business, technology, and government leaders had to make the call on what sovereign cloud really means, and how to build it.

Insights

• Sovereign cloud is a path for nations and companies to take control and set rules on data, digital operations, and access to systems.
• Location should not be conflated with jurisdiction.
• Accountability is a key proof that operational sovereignty has been achieved.
• The path to sovereign cloud starts with data and process classification.

Dear 2026,

It’s time for a language lesson. Do you know the difference between le nuage, yún, a nuvem, and pilv?

Those are what people in France, China, Brazil, and Estonia call cloud today. It’s similar to what you know, but when cloud crosses into a different nation, it shifts to that state’s own rules, platforms, standards, and processes.

That sounds complicated, but you just need to understand your own localized cloud and digital sovereignty rules for your place. Who has access to your data and what you can do in your cloud are set by local laws and the clearly defined jurisdiction governing cloud infrastructure, data, applications, and platforms.

When you make a purchase from overseas or need information from another region, you follow your local connections and their standards for interoperability. No need to parse every standard for every possible platform, provider, and province. It’s all pretty chill. My data, cloud operations, and technology options follow our clear local rules.

Version 1.0 of the World Wide Web had its regulations and rules that suited the slow and limited 20th-century internet. But as the internet became a global business tool, it got tough for regulators to keep up. Looking back, different rules for different regions and political systems seem inevitable.

The wild wide-open web of 2026

It’s wild for me, sitting in 2031, to think back on how open and unstructured things were in your time. But in June 2025, a Microsoft executive told a French Senate hearing that the company could not guarantee that French citizens data would stay out of American hands. Under the US CLOUD Act, an American company could be compelled to hand over data no matter where the servers were.

Citizens of France today would start a grève générale if an American hyperscaler had access to all their data based on American rules. That grew into a serious data sovereignty concern in 2025 after the International Criminal Court chief prosecutor reportedly lost access to Microsoft services in response to US government sanctions.

The signs were there earlier, even if business leaders didn’t want to read them. A research report by MIT Technology Review Insights found that companies that committed to controlling their own data were getting better returns on their AI investments. McKinsey argued that a good portion of AI value depends on sovereign or nearly sovereign infrastructure.

For multinational companies, setting up a sovereign cloud in a region with its own data and access rules would not be enough. The domicile of the enterprise and rules governing many (American-made) software platforms would take precedence over an off-the-shelf sovereign cloud.

When citizens and government leaders realized that a technology services platform or the nation-state where it is domiciled could potentially take your data or brick your operations, the move to sovereign cloud began in earnest.

This wasn’t the first time technology had moved faster than the rule-making process that should govern and keep it safe. But this shock came on the heels of a broader global decoupling influenced by geopolitical shifts. Individuals, institutions, and enterprises each had been giving economic routines and traditional trade relationships a hard rethink.

Entities with big cloud and data systems (nation states, regional economic blocs, and international enterprises) all suddenly faced three urgent tasks: get control of all your data, determine the rules and laws that govern operations, and obtain control over what technologies your organization can use.

Europe was a little ahead of the curve. Billions of euros had already been invested in developing digital sovereignty and sovereign cloud. As early as 2026, customer relationship management platforms revised their architecture to support local data.

In addition to hazy rules globally, few operations had sovereign architecture, and organizations weren’t set up to manage sovereignty.

An Accenture survey of 1,928 executives across 28 countries around that time found that most companies still handed sovereignty decisions to a chief data officer or a legal or IT compliance team, not to executive leadership or the board. You had the value sitting in one place and the decision sitting in another. Closing that gap is something we’ve been working on for the last five years.

Speaking of work in progress, I figure I should mention sovereign AI, given that AI hype was at its peak in 2026. We still don’t have a clear definition of “sovereign AI,” primarily because the people who build these models can’t get the models to reliably follow their own rules. That’s orders of magnitude harder than setting infrastructure controls to align with local rules, so call this unfinished business.

What we really mean by sovereign

For the longest time, data sovereignty basically hinged on “Where’s the data center?” By extension, cloud sovereignty questions could be answered by asking “Where’s the cloud infrastructure?” Nobody looked much harder.

But as the 2025 episode in France illustrated, location and jurisdiction turned out to be two very different things, and a lot of sovereign offerings on the market at the time were only solving for the first one.

Those early days of sovereign clouds were also slowed by the notion that sovereign decisions were always binary: either you were on a global public cloud, or fully isolated in your private space.

Vendors offered an answer by launching sovereign cloud-as-a-service. AWS, IBM, Google, and Microsoft each rolled out sovereign cloud products targeting the European market. The pitch: once you buy our sovereign cloud, shift your software and platforms there, and call it air gapped. This didn’t account for the software and processes. As we in 2031 know, the most durable architecture for sovereign cloud, sovereign data, and real operational sovereignty is a hybrid cloud setup.

The reality is that operational digital sovereignty is a continuum on the data, operations, technology, and organizational fronts. Sitting here in the future, I can tell you that operational sovereignty boils down to the ability to monitor, operate, and control the entire technology landscape with processes defined by jurisdiction and people in and subject to that jurisdiction.

What we’ve built

All this sovereign talk is much less dramatic today than it was in 2026. Sovereignty is not one big decision where you put yourself fully in the hands of a platform vendor or bear down and build your own compliant private cloud.

The reality of business is that some data needs to be heavily protected and controlled, and other data is most valuable when shared. Same with operations and technologies. Each of these will vary with changes to rules and business climate. Hybrid systems are now our standard model, and it allows for adjustment in ways that full hyperscaler or full isolation would not.

If you’re sitting in 2026 and worried that hybrid equals messy and poorly integrated, let me remind you of something that Infosys CTO Rafee Tarafdar said back in 2025. Open-source infrastructure systems were key to building hybrid environments that foster resilience. Looking back, they also proved essential to enabling operational sovereign clouds.

It took open-source tools and a combined architectural and organizational approach to achieve operational sovereignty. We knew we were there when we could say who operated the environment, who had privileged access (and under what approval chain), and where the support desk sat when any incident cropped up.

Further proof that operational sovereignty is real: Five years in the future, accountability has teeth. Before the rise of the splinternet, accountability and digital compliance functions were frequently tacked on in an “accountability sink” that dissipated the heat of responsibility across committees, vendors, and frameworks.

Do you remember who was to blame for the July 2024 CrowdStrike outage, which crashed 8.5 million computer systems, grounded airplanes, halted bank transactions, and shuttered retailers? Yes, CrowdStrike shipped a faulty cybersecurity update for Windows computers, but Microsoft blamed the European Commission for requiring it to give security companies kernel-level access to its operating system. (The European Commission denied that claim.) In your timeline, Microsoft, CrowdStrike, Delta Air Lines, and a class action complaint from stranded passengers remain in litigation, and nobody has been made to answer for the outage itself.

But after regulators and political leaders started asking technologically astute questions, accountability became a real threat that couldn’t just be ventilated. Today in 2031, companies, CIOs, CTOs, CEOs, and boards can be held accountable for sovereignty shortcomings.

More than anything, that individual accountability built sovereign clouds into the functional systems we have today. Maybe you’ve been in a shop or restaurant that posts the manager’s name, photo, and contact information? Sovereign accountability works just like that now.

How to start

Since you’re still at the leading edge of this, here’s how to start. Figure out what data and workloads are most critical. This will be data and processes that are essential to your business or carry regulatory or legal exposure. Not all your data and processes are equally sensitive. Treating everything as most critical and most sensitive can be expensive.

Let those classifications guide your enterprise architecture decisions. Spoiler alert: You’re going to end up with a hybrid multicloud architecture. Your actual mix of systems will vary based on industry, level of regulation, and those first-step classifications. For example, France’s BNP Paribas includes on-premises data storage linked to hybrid cloud infrastructure to give it control and capability.

Infosys Consulting recommends companies assess their AI maturity and sovereignty layer-by-layer, including reviews of applications and agents, operations, models and inference, data, cloud, compute, energy, and talent.

For each layer, apply a consistent set of questions:

• Location: Where is the capability physically or logically located?
• Jurisdiction: Which governments and legal regimes can exercise authority over it?
• Access: Who can access the capability, data, or underlying systems?
• Control: Which decisions remain under the organization’s direct control?
• Substitutability: How readily could the component be replaced if circumstances changed?

Learn from regulations: Heavily regulated industries such as financial services are a good place to learn about sovereign clouds and operational sovereignty. Even in your time, IBM has already developed cloud platforms for financial services and other heavily regulated industries such as healthcare, telecommunications, and government services.

Balance rules and guardrails with interoperability and portability: The whole point of business cloud was to allow for wide open commerce, sharing and connecting. Operational sovereignty has to still allow for interoperability and portability.

Finally, get personal: This is key in terms of getting processes correct and establishing accountability. Develop thoughtful answers to who has privileged access, from where, and under what authority. These processes must be technologically, legally, and strategically correct. Accountability must be at the sign-your-name and leave-your-contact-info confidence level.

From your seat on the wide-open web of 2026, this might seem daunting. But go through the process and it will grow comforting. Sovereign cloud and operational sovereignty will give your company control in the face of things beyond your control.