Software Leaders Face New Era of Data Control

The US government earlier this year instructed diplomats to push back on data sovereignty and data localization measures put forth by overseas regulators, especially in the EU. The US, which dominates the cloud computing and AI industries, fears that these measures could hinder the development of AI services by disrupting global data flows and increasing operational costs and cybersecurity risk, according to a report by Reuters.

For software companies, the debate is really about who controls data, where it is stored and processed and under whose laws it operates. This matters more than ever, because those questions increasingly inform product architecture, customer trust, and the ability to expand into regulated and sovereignty-conscious markets. The challenge is especially relevant to software companies in the US, as it basically dictates where they can and can’t do business and under which controls.

Far from being an isolated diplomatic spat, the US government’s latest attempt to lobby against how US technology companies handle foreign citizens’ data is being backed up by action on both sides. For example, the EC has expressed many times in recent years its desire to become more technologically independent. This has forced major cloud providers like Amazon, Microsoft, and Google to provide EU data residency for clients in the bloc. However, data residency isn’t the same thing as data sovereignty: for instance, the US CLOUD Act, enacted in 2018, grants US law enforcement the right to compel US-based companies to disclose data stored on their servers, regardless of where it physically resides or who it pertains to. The EU’s data privacy and sovereignty laws, such as GDPR, are in direct conflict with the CLOUD Act.

In an effort to reduce its reliance on US tech companies, the EU has taken several practical steps. One of the most recent was a €75 million investment in a federated infrastructure over which US regulators would have no direct nor indirect control. The project is explicitly tied to the bloc’s data sovereignty ambitions, whereby the EU’s Data Union Strategy supports international data flows but on terms that are fair, secure, and aligned with European interests.

The implication isn’t necessarily that every company must build a fully sovereign technology stack, but that they increasingly need to think in terms of regional hosting and governance, particularly if they’re operating in sensitive industries like finance or healthcare. After all, achieving absolute sovereignty is, as Capgemini’s CEO recently claimed, unrealistic because no country controls the full technology value chain. A more achievable aim, they argue, would be for software companies to be more selective in their approach to sovereignty in areas like data and operations for regulated workloads.

While it’s true that data residency measures can increase data-management costs significantly due to inherently more complex governance and technical requirements, sovereignty also presents a market opportunity to software vendors interested in doing business globally. Because of this, sovereignty is becoming a boardroom priority as leaders weigh up the pros and cons of accommodating regulatory and customer demands for greater control. The winners will likely be the vendors that can balance cross-border scale with regional trust and control.