Public sector senior leaders, such as mission and program executives, CIOs, CTOs, and CAIOs, have always faced a dual mandate: drive technology-enabled innovation while controlling risk. Private sector IT and business leaders have historically leaned more toward innovation, although leaders in regulated industries have faced pressures similar to those in the public sector.

That tension has escalated over the past twelve to eighteen months. The potential benefits and disruptive impact of AI have raised new questions about how to manage its risks. At the same time, geopolitical turbulence has made strategic autonomy in technology choices, control over data, and operational resilience paramount. These forces have converged in the sovereign AI debate.

In a recent conversation with senior government officials in a major Asian country, IDC found that the country’s vision is to build national AI infrastructure capabilities that they can “control in time of crisis.” While they recognize they cannot manufacture everything overnight, they “cannot accept dependency without a plan.” At the same time, their goal is “not to lock data away so tightly that no one can innovate,” but to find the right balance.

How the sovereignty debate is evolving from control to strategy

That tension between speed and control, and between innovation and sovereignty, sits at the heart of today’s digital and AI strategies. It also reflects how the conversation around sovereignty has evolved.

Early digital and cloud sovereignty discussions were driven by a specific concern: that sensitive data could be accessed by foreign jurisdictions. That narrow focus has now expanded into something much broader. Sovereignty has become a strategic imperative that shapes how organizations design their entire technology stack.

Today, sovereignty is no longer just about where data resides. It is about control over data, infrastructure, operations, and even the supply chain. AI sovereignty extends this further, encompassing control across the entire AI lifecycle, from model development to deployment and governance.

IDC research shows that market signals are clear. Governments are investing in sovereign AI capabilities, from national cloud infrastructures to domestic AI ecosystems. They are incentivizing local data centers, funding native-language AI models, and defining guidelines that will shape how sovereign solutions are acquired and deployed. For policymakers, AI is no longer just a technology. It is an instrument of economic competitiveness and national security.

For organizations, this creates a new reality. Senior business and IT leaders are no longer designing a single global architecture. They are navigating a fragmented, multi-sovereign world.

Choosing the right sovereign AI deployment approach

Faced with this complexity, many leaders look for a single answer: which deployment model is the most sovereign?

The reality is that the market offers a spectrum of deployment archetypes, ranging from public cloud to fully air-gapped environments. Each comes with different levels of control, agility, innovation speed, and cost. There is no one-size-fits-all approach.

A highly regulated AI workload may require a sovereign or even air-gapped environment. A customer-facing application may benefit from the scalability of the public cloud, combined with added sovereign controls.

The real challenge is selecting the right model for different use cases, or even different components of the same use case. For example, one deployment model may be used for AI training, another for retrieval-augmented generation, and a third for an agentic AI orchestration layer.

This is why hybrid architectures are emerging as the dominant pattern across both the public and private sectors. According to IDC’s 2025 Digital Sovereignty survey of more than 900 IT and business leaders, 37% of respondents say on-premises is currently their main environment and that sovereign cloud is, or will be, the only type of cloud they use. At the same time, 55% say sovereign cloud is, or will be, part of a multicloud or hybrid strategy.

IDC predicts that by 2028, CIOs at multinational organizations will increase investments in modular, sovereign-ready cloud and data localization environments by 65% to future-proof operations against rising sovereignty demands. Additionally, by 2026, 55% of governments will adopt hybrid sovereign cloud stacks, blending hyperscaler scale with national control to ensure compliance, security, and strategic autonomy for AI.

Public and private sector leaders are not retreating from the cloud. They are reshaping it. By combining global hyperscaler capabilities with local control layers, they are creating what IDC describes as sovereign-ready environments.

This approach reflects a deeper truth: sovereignty is not about isolation. It is about choice and control.

What leaders need to know about sovereign AI strategy

The conversation around digital and AI sovereignty is often framed as a trade-off between control and innovation. The organizations that will succeed are those that reject this binary thinking. They understand that sovereignty is not about limiting innovation, but about enabling it on their own terms.

In a world where AI is becoming the backbone of economies and societies, IDC research helps connect the dots between technology providers offering cloud and AI solutions and the business and IT leaders who must select the right deployment approaches to achieve their sovereignty goals.

Massimiliano Claps - Research Director - IDC

Massimiliano (Max) Claps is the research director for the Worldwide National Government Platforms and Technologies research in IDC's Government Insights practice. In this role, Max provides research and advisory services to technology suppliers and national civilian government senior leaders in the US and globally. Specific areas of research include improving government digital experiences, data and data sharing, AI and automation, cloud-enabled system modernization, the future of government work, and data protection and digital sovereignty to drive social, economic, and environmental outcomes for agencies and the public.

Rahiel Nasir - Research Director, European Cloud Practice, Lead Analyst, Digital Sovereignty - IDC

Rahiel Nasir is responsible for leading and contributing to IDC's European cloud and cloud data management research programs, as well as supporting associated consulting projects. In addition, he leads IDC's worldwide Digital Sovereignty research program. Nasir has been watching technology markets and writing about them throughout his professional life.