Consider this scenario where an executive of a global enterprise company approves a sovereign cloud contract for the company’s AI workloads. With the growing need for sovereignty requirements, sensitive data needs to stay in the country where the data was generated and under local control. And it is something that the vendor had promised as well. However, months later, a court in the vendor’s home country orders the parent company to produce data held by its affiliates abroad.
The parent complies, and the data leaves the country. It seems pretty straightforward; both parties did what was asked of them – in one case a regulator, and in another a court. Yet when we go one layer deeper, one rule has been met by breaching another, and the big question is who answers for this?
One candidate is the parent company, which may have had no legal choice. Another is the local subsidiary, which signed the assurances but never received the order. A third is the regulator that required sovereignty and licensed the service, and the last is the executive who signed the contract.
These questions do not have straight answers even from those who build, sell, and advise on sovereign infrastructure. Farid Zahran, Senior Managing Director, AI and Digital Transformation at FTI Consulting, described how such a case tends to end today. “The organisation’s executive loses their job,” he said. “At the vendor, senior leadership may well be unaffected.”
Several executives fear and even expect this. A Global Data Sovereignty 2026 report by Everpure surveyed 2100 executive leaders across eight countries, and close to 88% stated sovereignty failure could cost senior decision-makers their jobs. Only 9% rank protection against foreign government data requests as a top priority, and 56% have no plan for data being compelled out of the country or for services being cut off.
Most of these leaders say their jobs are at risk without being able to say who else, if anyone at all, shares that risk.
Sovereignty is now a requirement, not a choice
Enterprises are not adopting sovereignty mainly because it is critical for control, and increasingly they are being required to do so. New regulatory and compliance requirements, and the fines attached to them, are among the top reasons organisations give for taking sovereignty measures, cited by 39% in Everpure’s survey. Some 80% say sovereignty has become more important in vendor selection over the past year. Only 2% treated it as a significant factor before that, against 32% now.
“It arrives as a requirement rather than a question now,” said Alexander Ivanyuk, Senior Director, Technology at Acronis. He said European service providers in the company’s partner network report customers demanding less dependence on a few large foreign cloud platforms, and that some now require disaster recovery to stay inside their own country.
Keeping up with the rules is a challenge in its own right. Some 55% of organisations say they cannot keep pace with changing regulatory requirements. Fred Lherault, Field CTO for EMEA and Emerging Markets at Everpure, which operates in more than 100 countries, said only an organisation’s legal team can decide “whether a given regulation in a country applies to the organisation and in which location.”
Even in heavily regulated sectors such as Saudi banking, he said, institutions set their own levels of sovereignty and security on top of what the rules require. The gap is glaringly obvious; while regulators have made sovereignty an expectation, and companies are complying, nobody is yet sure who is liable, and in what scenarios and situations.
A question that needs an urgent answer
While data sovereignty isn’t a recent ask, AI has made the requirement and this question even more critical. In the pre-generative AI and agentic AI era, sovereignty used to be about where a company’s records were stored; today, it is about the data used to train and prompt AI models, the logs those systems generate, and the agents acting on the data; each of these can bring in another supplier in another jurisdiction.
Lherault said that when Everpure first ran its survey a year ago, respondents could see a problem coming, but “it was really just emerging. There wasn’t a really good understanding of what the challenges were and the consequences.” A year later, he said, it is perceived “at the highest levels” of many organisations. “But they’re not ready.”
Some 92% of the organisations surveyed call sovereignty a critical part of their AI strategy, and 87% plan to move most or all high-risk AI workloads into local or sovereign environments within three years. But only 36% rank governance and control of AI models as a high priority when assessing sovereignty, and 39% admit sovereign AI adds complexity they have yet to manage.
Eng. Hani AlMojel, Chief Corporate and Regulatory Affairs Officer at Etihad Salam Telecom Company (Salam) in Saudi Arabia, said the technology has changed what is at stake. “AI is moving from being primarily a commercial asset to becoming a national security asset,” he said. The parties whose authority must be defined now include “Saudi operators, foreign suppliers, subcontractors and, increasingly, AI agents themselves”.
Even the word “sovereign” is contested
Regulators and buyers ask for sovereignty, but the word has no agreed definition. “‘Sovereign’ isn’t a regulated label with a single agreed meaning,” Ivanyuk said. “Two providers can use the term and mean very different things.”
Zahran separates residency, meaning where data physically sits, from sovereignty, which in his view means control over the data across three layers: technical, legal and operational. “Exposure appears wherever any one layer answers to a foreign jurisdiction,” he said. “When that is the case, residency has been sold as sovereignty.”
A buyer can therefore pass an audit on data location and still be exposed. Until the requirement is defined more precisely, it is hard to say whether a vendor kept its promise or the buyer met its obligation.
The most obvious answer is that the vendor whose parent complied with the order should be responsible. But the difficulty is that the parent may have been obeying its own country’s law.
“On legal control the vendor can promise nothing, because a multinational cannot contract out of its home jurisdiction,” Zahran said. He cited the US CLOUD Act, which allows US courts to compel data held by a company’s affiliates anywhere, and testimony by Microsoft France’s legal director to a French Senate inquiry in June 2025, which he said confirmed that limit under oath.
Vendors say they can control how they respond to an order, not whether they receive one. Ivanyuk said Acronis checks government requests for legal basis, authority and scope. It narrows or challenges those that fall short, and limits disclosure “to the information required by law”. It notifies customers “where legally permitted”, which is a condition that a foreign order may override. As a result, a buyer may not learn that its data has been handed over until well after it has happened.
The local subsidiary: liable on paper, not yet in practice
Zahran’s answer is the local subsidiary, because it is the entity the buyer actually contracted with. “The organisation never contracted with that parent. It contracted with the local subsidiary, under local law, and that is where responsibility has to land,” he said.
He would go further than most current contracts. The subsidiary would carry full liability for its sovereignty assurances, backed by a corporate guarantee from the parent as a condition of its licence to operate. Its country chief executive and general counsel would be named as personally accountable under local law. “Liability caps that exclude disclosures ordered by a foreign court should be unenforceable in sovereign contracts,” he said.
However, in practice this theory has limitations. For example, Ivanyuk said Acronis contracts carry liability limits, “as nearly all enterprise software contracts do”, with sovereignty-specific terms negotiated deal by deal. He also questioned whether liability is the right remedy at all. “A liability payment arrives after your data has already been somewhere it shouldn’t be. It doesn’t undo the disclosure, and it won’t satisfy your regulator,” he said.
The regulator: the source of the requirement, not yet of the answer
The regulator is the most natural candidate, because it set the requirement in the first place and is the only party that can put pressure on a foreign parent. Zahran argued that buyers should codify sovereignty in contracts, and that for government and regulated entities it belongs in regulation. He proposed that regulators use licence revocation, exclusion from government procurement and mandatory reporting of any home-country order within a fixed number of hours.
Though there is some groundwork here, it nevertheless isn’t the complete answer. Ivanyuk pointed to the EU Data Act, which since September 2025 has given cloud customers in Europe a legal right to switch providers. However, he noted that it “doesn’t dictate where data must be stored”. AlMojel said technology partnerships must operate “in compliance with local data protection requirements”.
Lherault said regulation will push organisations towards sovereignty, but that compliance alone is not enough. “It’s one thing to be sovereign because the regulation tells you to, but every organisation should make a risk assessment,” he said, deciding which data are its “crown jewels” and how much risk it will accept.
AI adds parties no regulation was written for
AI adds data that most sovereignty rules and contracts were not written for. Ivanyuk said that where customers hold their own encryption password, Acronis “generally cannot decrypt the protected backup content”.
Yet account information, operational metadata and service logs “may be subject to different technical and legal considerations”. AlMojel said partnerships should spell out how data can be retained, used for model training and shared with third parties. Without that, he said, strategically important information “could be used, transferred or retained in ways that are inconsistent with” national requirements.
Agents make the picture less clear still, “Someone needs to be responsible for the actions taken by an agent,” Lherault said, but who that is will be decided “on a case-by-case basis” for now. “It’s a very evolving field. There’s going to be regulation here.” He noted that a software bug gets a patch, whereas a misbehaving agent gets updated guardrails and a retrained model, which is a much harder fix to verify.
Kurt Muehmel, Head of AI Strategy at Dataiku, said the controls are being built while the systems are already in use. Agent management “is going to have to be to some degree the product of on-the-ground learnings”, he said, much as cybersecurity developed alongside the early internet rather than ahead of it.
He also pointed to the difficulty of regulating AI across borders: deciding what counts as unacceptable use is contested, because “different societies would have different approaches to what that is.”
That leaves the buyer, which carries the risk by default. It is the party its regulator holds to the requirement, and the only one within reach of its own board. “Sovereignty is not received from a vendor,” Zahran said. “It is enforced by the organisation that holds the data.” If the buyer holds its own encryption keys, identity systems and privileged access, a foreign order served on the parent, he said, “finds nothing to produce”.
Ivanyuk’s questions for buyers point the same way. “Can you hold your own encryption keys? Can the service run on hardware you control? Can you leave and take your data with you?” However, most buyers are not yet able to answer them. Everpure found that 62% lack full visibility into who can access, control and manage their data. Ivanyuk said buyers who cannot say what must stay where tend to want “a location and a reassuring logo”, and risk “spending on a reassuring label and still failing the audit”.
Proof is also a problem, AlMojel said consequential AI actions must be traceable “to their information sources, the specific model versions involved, the permissions granted and the approvals obtained”. Muehmel said complete logging and auditability are what let an organisation establish, after an incident, “what happened and how to resolve it”.
Without that record, a buyer facing its regulator cannot show whether data left through a foreign order, a supplier’s access or an agent acting outside its permissions. It carries the blame without the evidence to show where the failure happened.
So who answers for a data breach ordered by a foreign court? For now, in most cases, the buyer does. That is not because any regulator has decided it should, because sovereignty rules currently stop before the point where one country’s law collides with another.
The people interviewed for this story broadly agree that this is an incomplete outcome, but there is no consensus on what should replace it. AI will continue to make the answer to this question harder.
AlMojel’s test for critical services sums up the position: “Can essential services continue when external support is withdrawn?”
