Forrester: Sovereignty is now an AI design requirement

Geopolitical tensions and tighter regulation are pushing organizations to define data residency and sovereign AI requirements before new technology projects begin, according to Forrester. The shift is particularly pronounced in Europe, where US companies dominate cloud and AI infrastructure and domestically developed hyperscale AI platforms are scarce.

Dario Maisto, a principal analyst at Forrester, said sovereignty is becoming an architectural requirement rather than a late-stage compliance check.

“The organisations that succeed will treat sovereignty as an architectural principle from the start – establishing clear governance, maintaining control across the AI stack, and designing flexible operating models that can adapt to evolving regulatory and geopolitical conditions.”

Buyers are now looking beyond where data is stored. Forrester says they are also asking:

Recommended reading

Faster AI is not fixing the trust problem

• Who controls the encryption keys?
• Who has operational access?
• Where are models trained?
• Which laws apply to the system and its operators?

Europe’s sovereign AI push

The European Union’s pressure to build domestic capability is also visible in its plans for up to seven AI gigafactories. The projects are expected to receive up to €10 billion in EU and national funding, with at least €20 billion more anticipated from private investors.

In June, the EU introduced a Technological Sovereignty Package aimed at strengthening the bloc’s digital autonomy. One proposal is Union Assurance Levels (UALs), an auditable four-level framework that assesses control over jurisdiction, data processing, supply chains, and security.

Gartner analyst[s] warned that UALs could add confusion for cloud providers and buyers already dealing with multiple sovereignty frameworks.

European providers currently account for only around 15 percent of the region’s cloud infrastructure market, leaving the dominant US suppliers subject to American jurisdiction. The risk is not theoretical: last year, International Criminal Court prosecutor Karim Khan lost access to his work-based Microsoft services after the US government imposed sanctions on him.

Forrester’s Maisto said Europe is becoming a key proving ground for sovereign AI, as customers seek control over how systems are built, governed, and operated without giving up access to global innovation. Gartner forecasts that European spending on sovereign cloud infrastructure services will more than triple between 2025 and 2027.