New research suggests data sovereignty is moving beyond compliance and becoming a core consideration in enterprise AI and cloud architecture. Despite growing concern, many organisations still lack formal sovereignty strategies and visibility into who controls or accesses their data. 

[For more news, click here] 

Enterprise technology decisions have largely revolved around scalability, security and cost. The most important question now is who ultimately controls the data?  

New research from Everpure highlights data sovereignty is rapidly moving from regulatory concern to something fundamental, a question of enterprise architecture, technology procurement and increasingly, AI strategy.  

Everpure’s Global Data Sovereignty Report 2026, based on a Vanson Bourne survey of 2,100 C-suite and IT leaders across eight countries, found that 90% of organisations now view data sovereignty as a business concern. More dramatically, 88% of C-suite respondents believe a sovereignty failure could cost senior decision-makers their jobs. 

What is interesting to note that, despite the perceived stakes, 64% of organisations still operate without a formal data sovereignty strategy, while 62% lack complete visibility into who can access, control or manage their data. More than half have no mitigation plans for geopolitical data exfiltration or service disruption. PR Newswire 

Often the discussions around sovereignty revolve around where information is physically stored. Even though that question is still important specially for regulated industries and governments, but the journey through modern AI is much more complicated.  

Data residency is no longer enough

A single AI workload can involve source data, vector databases, embeddings, external APIs, model providers, inference infrastructure, prompts, logs, telemetry and third-party agents. Data may be duplicated, transformed and passed between systems long before a user sees an output. Knowing where the original database resides therefore tells an enterprise increasingly little about the total exposure surrounding that data. This is where sovereignty starts to become less about geography and more about control. 

A study by IBM reached a similar conclusion in separate research earlier this year. In a study of 1,000 senior executives, 91% said they did not fully understand their organisation’s dependencies across AI vendors, models and infrastructure, while 71% said switching their primary AI vendor or model would be difficult.  

One of the most consequential findings in the Everpure research is how rapidly sovereignty is moving into technology purchasing decisions. In its survey, 85% of respondents said they are willing to compromise on functionality to work with a local sovereign provider. And 40% have already limited use of SaaS platforms dependent on non-domestic infrastructure.  

This impacts procurement decisions, and a regional provider may not need to match every feature of a global technology product. But that does not make global cloud providers irrelevant; it only suggests that the enterprise technology stack is becoming increasingly segmented. The question would be: which cloud for which data? 

Data Visibility is a Challenge

However, the first challenge here is data visibility. If organizations cannot fully see who accesses, controls or managers their data, then sovereignity becomes difficult. Data is often spread across SaaS applications, public clouds, on premise systems and various AI tools. A database may be hosted locally while a generative AI application sends parts of that data elsewhere for processing. Backups are elsewhere and Metadata is handled by a different provider.  

The European Commission’s 2026 Cloud Sovereignty Framework assesses providers across multiple dimensions including legal and jurisdictional sovereignty, data and AI, supply chains, technology, operations and security rather than treating physical data location as the sole measure of control.  

Building separate domestic environments, maintaining multiple cloud providers, creating regional data architectures and complying with different regulatory systems can fragment enterprise technology. 

That can mean higher costs, duplicated infrastructure and additional skills requirements. 

Everpure itself finds that 56% of organisations lack the skills and capacity required to deliver sovereignty initiatives, while cost, regulation and competing strategic priorities remain significant obstacles.  

A more practical approach maybe selective sovereignty: identifying which data, models and systems are genuinely strategic and applying additional controls to those assets while continuing to use global infrastructure elsewhere. In short, taking control of the assets that matter most and having the capability to change providers when things change.  

One thing to note here is that Everypure’s study does not include the Middle Eastern markets, and so its percentages are not representative of enterprises in Saudi Arabia, the UAE or the wider Gulf.  

That makes sovereignty part of a much bigger conversation about the architecture of the AI economy. The more important question here is whether an organisation still has the ability to control what happens to its information once the technology around it begins making decisions of its own. 

Related Articles

Exclusive: Who Do You Trust? Rethinking AI Sovereignty
Exclusive: Why Saudi Arabia’s Tech Growth Can’t Be Measured by Funding Alone
Microsoft Brings its Bug-Hunting AI, MDASH, to UAE Government Systems