Cloud-Strategy

Sovereignty is no longer just a privacy or data-residency question. It has become a question of strategic control, resilience, and competitiveness across the entire digital stack. The debate is not about decoupling. It is about understanding the levers that others hold over critical operations, and deciding deliberately which ones to accept, mitigate, or neutralize. For CIOs and risk leaders, sovereignty decisions now shape uptime, legal exposure, cost trajectories, and time‑to‑market – not just compliance. ...

— or rather, what looks like control is often just ownership April 2025. The Iberian peninsula loses power. Spain, Portugal, parts of southern France – one of the largest blackouts in European history. The grid is gone for hours in some regions, days in others. When power goes out for long enough, diesel reserves run down. Standard reserves last 24 to 72 hours. Beyond that, every operator depends on resupply. And resupply, during a regional crisis, doesn’t happen on first-come-first-served terms. ...

This is the second of two articles on a sovereignty paradox. The first, Control Isn’t Sovereignty?, argued that delegating to systems with broader resilience can produce more outcome sovereignty than direct ownership. This one is about the harder question underneath. Most sovereignty design follows the same logic. To protect operations against grid failures: Install generators on site. Stock diesel reserves to keep them running through an extended outage. Arrange supply contracts with fuel suppliers for resupply during a crisis. ...

How do you measure whether something is sovereign? Ask it about a real system and the question splits. Can you keep running if conditions turn, or does someone else decide when you stop? Who holds the levers – the access, the keys, the legal authority? And how deep does it go: your provider may be sovereign, but what about their suppliers three layers down? These have different answers, and they don’t move together. A service can be operationally solid and legally exposed. Jurisdictionally clean at the top and dependent on a single foreign supplier underneath. “Is it sovereign?” has no single answer, because sovereignty was never a single property – which is exactly why you can’t put one number on it. ...

Sovereignty done right makes you resilient. But sovereignty you don’t operate is the opposite: a risk. You move a workload in-house to be more sovereign. Your jurisdiction, your rules, no outside provider in the loop. More control – which is the whole point. But the provider you left wasn’t only running the service. They were also keeping it up, patching it, and making sure you could still reach it when something broke. You didn’t see that part, because you never had to. ...

A global company decides to become fully sovereign. Every system in its own data centers, in its own jurisdiction. Foreign providers out, cross-border transfers stopped, the estate air-gapped. Customer data untouchable, IP locked down. Then it goes bankrupt. It was in the pizza delivery business, and the ordering platform was inside the air gap with everything else. Of course nobody would do this. But notice what went wrong: not the ambition, not the execution. They applied it uniformly. The recipe and the order line got the same treatment, and only one of them needed it. ...