AI means CIOs need sovereign cloud more than ever | Daily Reports Online
The modern, cloud-powered digital economy has as its dynamo the ease with which data is shuttled all over the world.
This information globalization has had momentous impacts from supercharged business performance and strategic adaptability through accelerated co-creation and collaboration, to economies of scale and huge net cost savings.
Today, however, organizations face a very different imperative: the requirement for data sovereignty: that is, the need to restrict data movement and stored location to specific countries or regions.
Sammy Zoghlami is a Senior Vice President at Nutanix where he leads the EMEA organization.
With the rush toward AI tools revolutionizing the ways in which we handle, query and repurpose data, every organisation of scale needs to consider how it can maintain a “sovereign cloud” with complete oversight of digital asset, application and data accessibility.
The contemporary focus on sovereignty is already having significant strategic IT impacts. Gartner has predicted that 75 per cent of non-US enterprises will need to have a digital sovereignty strategy by 2030. It is also impacting IT deployment options as the same analyst has stated that 61 per cent of IT chiefs will increase their dependence on local cloud providers in that timeframe.
Data thinking is changing but not new
Data sovereignty isn’t new of course. Think of international laws such as the EU’s GDPR, various iterations of “Safe Harbour” rules, the US’s Cloud Act, Germany’s ‘C5’ rules, France’s Cloud de Confiance initiative and many industry and national or regional codes. These have created a climate of awareness as to where data is stored and where it travels en route. But we also need to understand sovereignty in a broader sense…
Sovereignty is about more than implementing geofencing or other location-based guardrails. It involves everything from culture and education, through core infrastructure and development, to delivery, deployment, maintenance and updates. And with AI, Machine Learning and LLMs becoming a central tenet of IT and process change, organizations now must control the entirety of their AI journeys.
Ultimately, AI touches on everything an organization does but we can boil this down to suggest that it involves, broadly, three areas pertaining to sovereignty. First, maintaining local and vertical market controls; second, enhancing their sense of self-reliance; and third, feeling confident in data security and governance compliance.
Let’s look at these in a little more detail.
1. Localization
Organizations need to ensure that their data assets are the right fit for local languages, cultures and vertical industry needs.
Sovereignty can create a ‘bubble wrap’ around those assets with supervision of data controls tweaked for the local environment and specific industry (or even unique organisation).
2. Self-reliance
Enterprises will opt largely to use familiar software architectures, LLMs and other AI foundational models and building blocks from blue-chip partners as a comfort factor and to gain a fast start. This is a pragmatic preference over the cost and complexity of a build-your-own or ‘unique/boutique’ approach.
But large organizations will also be desperate to maintain intellectual property and to tailor for their specific requirements. This will mean that they will insist on the need for specific sovereignty controls to be built into programs and projects.
3. Governance, Risk and Compliance (GRC)
Laws and codes specify data never leaving borders or other locations for many reasons relating to GRC and security.
Such rules often apply to personally identifiable information (PII) but they also cover intellectual property, organizational processes, trade secrets, HR information, financial data and other sensitive information. This has major implications for companies that rely heavily on public cloud.
Public cloud providers offer ubiquitous data/application access, significant economies of scale and improved performance by moving data round the world to maximize value and minimize network latency. However, for the reasons outlined above, organizations increasingly demand granular controls over this movement.
Wanted: A return to order
Data sovereignty is a many-headed beast and it means that organizations must create sovereignty rules for each country or region in which they operate to stay compliant, low-risk and in control of their futures. The triple-fold need for localization, self-reliance and data sovereignty forces organizations to look again at IT deployment and operational models.
That includes a potentially higher dependence on on-premises IT infrastructure and ‘backshoring’: that is, returning data to its country of origin. Many CIOs are also exploring private clouds and using public clouds tactically where there is an appropriate fit, rather than adopting a blunt, ‘cloud-first’ strategy that was so fashionable 10-15 years ago.
Organizations today need to build notions of sovereignty into their planning and their cultures. The risks of not making sovereignty a ‘by default’ setting are high and growing: loss of strategic control, misaligned campaigns and infractions, data losses and financial penalties among them.
Note also that all of this is happening at a time when strategic deployments of AI are only just entering mainstream production environments at most enterprises. For CIOs and their peers, this timing has a bonus advantage, however. By starting with a (relatively) clean sheet of paper, sovereignty and governance can be built into new architectures, cultural patterns, processes and workloads, rather than having to be retro-fitted in clunky fashion.
But there are challenges too. CIOs and privacy executives need to deal with waves of rules and complex maneuverings. Germany, for example, is famously strict on privacy and data management. Also, considering localization, many languages, cultures and verticals are yet to be adequately served by AI foundational models and training data. And in terms of self-reliance, organizations and states must think creatively to avoid being locked in to key silicon, platform or other core IT providers.
In this context, airgapping, dark sites that operate offline, open source software foundations that can quickly be disassembled and reconfigured, and of course multicloud solutions with layers of protection, are sensible options to examine.
For business and technology planners, the obvious strategy is to build platforms that are open and adaptive. We can’t yet write a formula for the future of AI and its relationship with data sovereignty but wise leaders will err on the side of caution and adopt platforms and partners that can flex with whatever comes next.
We rank the best cloud storage software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:
