IBM Bets on Built-in Data Compliance to Meet Digital Sovereignty Needs

IBM’s launch of Sovereign Core, a new cloud stack, reflects rising attention on digital sovereignty in data management, especially in regions like the EU as governments tighten control over where and how their data and AI workloads run.

It will be available in tech preview in February, with general availability planned for mid-2026.

Unlike many existing cloud offerings, which offer local hosting to meet data residency requirements, IBM’s approach reflects a growing shift towards full data sovereignty by allowing companies to deploy the stack on their own hardware or regional clouds, typically via local service partners. This keeps data and encryption keys under their own jurisdiction and control.

The launch of Sovereign Core, and other cloud offerings like it, are designed to mitigate risks from laws like the U.S. CLOUD Act. The act grants law enforcement extraterritorial reach with the right to compel any U.S.-headquartered company (which includes all the major cloud hyperscalers) to surrender data, regardless of where it physically resides or who it pertains to, following a warrant or subpoena.

While the CLOUD Act was enacted in 2018, the focus on digital sovereignty has since surged, following rising geopolitical instability and disagreement between the EU and US over data-sharing frameworks. Sovereignty has also received renewed interest in Europe following the rapid growth of AI and the growing focus on local computing power as a major competitive advantage.

Despite the demand for digital sovereignty, the vast majority of SaaS tools and platforms, including those headquartered outside the U.S. remain heavily dependent on cloud infrastructure provided by U.S.-based hyperscalers like AWS, Azure, and Google Cloud. The problem is especially pronounced for smaller companies, including those based in Europe and those based in the U.S. that nonetheless seek overseas expansion.

The fintech and financial services sector, being among the most heavily impacted by digital sovereignty demands, face some of the biggest compliance challenges. Fortunately, emerging solutions like IBM’s Sovereign Core offer embedded compliance and operational control, even if they’re running on third-party clouds. Moreover, by providing a software stack that allows businesses to build their own clouds, it helps avoid the worrying trade-off between agility and compliance. For fintechs dealing with highly sensitive and regulated financial data, having that degree of control has become a practical and legal necessity.