Quick answer: Data sovereignty is not about where data is physically stored. It’s about which government can legally compel access to it, which laws govern the infrastructure processing it, and whether an organisation can retain operational control if that infrastructure provider is ever forced to comply with a foreign legal order. In 2026, storing data in a local data centre no longer satisfies that bar on its own, because U.S.-headquartered providers remain subject to the U.S. CLOUD Act even when their servers sit on foreign soil.
That distinction has moved from a compliance footnote to a board-level risk conversation. What used to be a simple checkbox of “is our data stored in-country?” has become a much harder question: who, ultimately, can be compelled to hand it over?
The Residency Illusion
For years, “data residency” and “data sovereignty” were treated as interchangeable. Keep the servers in Frankfurt, Toronto, or Sydney, and you were considered compliant.
That assumption doesn’t hold anymore. Analysts now describe this gap explicitly as the “residency illusion” — the belief that a local data centre footprint alone satisfies sovereignty requirements. As Kiteworks puts it in its 2026 sovereignty research, a cloud region in Frankfurt doesn’t solve the problem if U.S. authorities can still issue a CLOUD Act request that compels disclosure “regardless of where the servers are physically located.” Kiteworks: Sovereign AI — Residency Is Not Control
The numbers back up the concern. Kiteworks’ 2026 Data Sovereignty Report found that while 80% of organisations say they’re well informed about sovereignty requirements, roughly one in three still experienced a sovereignty-related incident in the past 12 months. Kiteworks 2026 Data Sovereignty Report Being informed and being protected turned out to be two different things.
Geopolitical and Supply Chain Risk
The pressure isn’t just legal. It’s geopolitical.
Governments are increasingly uncomfortable with critical infrastructure and citizen data sitting under the jurisdiction of a handful of foreign tech giants.
The EU has responded with an expanding Tech Sovereignty agenda, including proposals aimed at restricting U.S. cloud platforms from processing sensitive government workloads, and frameworks like DORA (Digital Operational Resilience Act) and NIS2 that push financial services and critical-infrastructure operators toward stricter, often EU-controlled, hosting arrangements. Together, DORA, NIS2, and the EU AI Act have effectively turned sovereign infrastructure from a preference into a compliance requirement for a growing list of regulated workloads. DORA, NIS2, and the EU AI Act Are Making Sovereign Cloud Mandatory
F5’s 2026 State of Application Strategy research based on responses from over 1,100 IT decision-makers frames this as a structural shift: organisations now need real control over where AI and application infrastructure runs, because residency, sovereignty, and operational independence have become non-negotiable requirements rather than nice-to-haves. F5: Data Sovereignty — New Pressures Force Organisations to Rethink Risk
AI Has Made This Harder, Not Easier
Generative AI has added a new layer of complexity that most sovereignty frameworks weren’t built for. Training and fine-tuning workloads increasingly require aggregating datasets that stretch into the petabyte range, processed across environments that may span multiple clouds, vendors, and jurisdictions. Data Centre POST: Getting Control Over AI Cloud Data with On-Premises Object Storage
That raises a question few organisations had to answer five years ago: where, exactly, does the model run, and who has legal authority over the environment it runs in? Data Centre POST frames sovereign AI infrastructure as a strategic imperative precisely because AI workflows multiply the number of places sensitive data can leak across a jurisdictional boundary. Data Centre POST: Why Data Sovereignty Is Becoming a Strategic Imperative for AI Infrastructure
What Real Control Looks Like: In-Jurisdiction Encryption
If residency alone isn’t enough, what is? The emerging consensus among sovereignty researchers is architecture-level control, not just geographic placement. That means:
- Local encryption key custody: keys held in-jurisdiction, so a provider structurally cannot decrypt or hand over what it doesn’t hold the keys to.
- Verifiable operational control: knowing exactly who (which citizens, which legal entity) can access the environment, not just where the hardware sits.
- Manageable exit costs: the ability to leave a vendor or platform without prohibitive egress fees or lock-in.
Kiteworks summarizes it directly: “the only sovereignty that survives a legal demand is sovereignty enforced in the architecture.” Kiteworks: Sovereign AI — Residency Is Not Control
Where On-Premises Infrastructure Fits
This is exactly the gap on-premises storage is built to close. When data lives on infrastructure your organisation owns outright, not leased from a U.S.-headquartered hyperscaler and subject to a third party’s terms of service, the CLOUD Act exposure that follows even “sovereign” cloud regions simply doesn’t apply. There’s no foreign parent company that can be legally compelled to produce your data, because there’s no foreign parent company in the chain at all.
That’s the core of Nexsan’s position in this conversation. Nexsan has spent over 25 years building on-premises storage platforms like E-Series, BEAST, Unity, and Assureon designed for organisations that need to know, with certainty, exactly where their data sits, who can touch it, and under whose laws it lives. Nexsan: The Pros and Cons of On-Premises Storage Solutions For regulated industries, government contractors, and any organisation now re-reading its cloud contracts in light of DORA, NIS2, or the EU AI Act, that’s not a nostalgia play. It’s a structural answer to a structural problem.
The Bottom Line
Data sovereignty in 2026 is a control question, not a location question. Storing data locally is necessary but no longer sufficient. Organisations that want a real answer, not just a compliant-looking one, are increasingly looking at infrastructure they own and operate themselves, in-jurisdiction, with no foreign corporate parent in the chain.
Next in this series: How the €890 million Google fine turned tech sovereignty into a geopolitical flashpoint, and why nearly 9 in 10 enterprises are bringing workloads back on-premises.
Sources: Kiteworks 2026 Data Sovereignty Report · Kiteworks: Sovereign AI — Residency Is Not Control · F5: Data Sovereignty — New Pressures Force Organisations to Rethink Risk · SoftwareSeni: DORA, NIS2, and the EU AI Act · Data Centre POST: AI Infrastructure Sovereignty