Digital sovereignty is no longer a concept reserved for governments. Banks, insurers, public administrations, critical operators, hospitals, and large companies are starting to look at the cloud with a different question: not just where the data is located, but who can access it, under which jurisdiction, with what controls, how the operation is audited, and what happens if connectivity to the public cloud is unavailable.
Kyndryl and Microsoft have announced an expansion of their partnership to meet this demand. The proposal combines Kyndryl Sovereignty Solutioning with the capabilities of Microsoft Sovereign Cloud, aiming to help regulated organizations design, build, and operate cloud architectures tailored to data residency, operational control, compliance, and modernization needs—including AI use cases.
The agreement aligns with a fundamental shift. For years, talking about “sovereign cloud” almost always referred to the physical location of data centers. Now, the conversation has become more technical: privileged access control, local operation, isolation, auditing, encryption, portability, recovery, continuity, and the ability to run sensitive workloads in hybrid or disconnected environments.
Sovereignty is No Longer Just about Data Residency
The collaboration covers a broad range of deployments. Kyndryl offers evaluation, architecture, implementation, and operation services; Microsoft contributes its sovereign cloud approach, which includes public cloud capabilities, Microsoft 365, Azure, and private environments based on Azure Local. The goal is for an organization to combine public cloud, private cloud, regional infrastructure, and on-premises systems without losing the control framework required by regulators or its own risk model.
Microsoft defines Sovereign Cloud as a unified offering for public cloud, private environments, and partner-operated clouds. The focus is on controlling where data resides, how access is governed, and how cloud operations are executed—without forcing all workloads into a separate cloud environment.
This distinction is important. A company can have data hosted in Europe and still fail its sovereignty objectives if management, support, keys, operations, or recovery depend on processes outside its control. Mature sovereignty is measured not just by the chosen cloud region, but by the ability to demonstrate who governs each layer.
| Sovereignty Layer | What needs to be resolved |
|---|---|
| Data | Residency, classification, encryption, retention, and lifecycle |
| Operation | Who manages, from where, and with what privileges |
| Access | Identity governance, segregation, and operator control |
| Infrastructure | Public cloud, Azure Local, on-premises, or regional providers |
| Compliance | Evidence for GDPR, DORA, NIS2, and sector standards |
| AI | Data locality, model governance, and usage traceability |
| Continuity | Resilience, recovery, and operation in restricted scenarios |
Kyndryl’s role is to translate these requirements into applicable architectures. Its Sovereignty Readiness Assessment evaluates an organization’s current posture in data, operations, and technology domains, identifies gaps and dependencies, and enables a phased evolution plan.
Azure Local Gains Traction in Regulated Environments
The most relevant technical component is Azure Local. Microsoft has been expanding this platform to deliver Azure capabilities on infrastructure controlled by the customer—suitable for scenarios with strict residency requirements, disconnected operations, regulated workloads, or AI near the data source.
This can be appealing to government agencies, defense, financial services, healthcare, and industry sectors where deploying solely in a European cloud region isn’t enough. Some workloads require operating on private premises, national data centers, isolated environments, or locations where latency, compliance, or continuity are more critical than the convenience of the public cloud.
Microsoft has already strengthened its sovereign narrative with offerings like Sovereign Public Cloud, Sovereign Private Cloud, and European-operated features. In 2025, it announced initiatives such as Data Guardian, aimed at providing transparency over operational sovereignty controls in Europe, including remote access by Microsoft engineers to systems storing or processing European data routed through the EU, supervision by personnel located in the EU, and tamper-resistant logs.
With Kyndryl, this approach extends from technical offerings to daily operations. It’s not just about having a sovereign option in Azure, but about designing which workloads go to public cloud, which stay on Azure Local, which remain on-premises, what controls are applied, how compliance is documented, and who operates the entire environment.
Sovereign AI: The New Pressure Point
AI adds urgency to this debate. Many AI projects depend on sensitive internal data, customer histories, regulatory documents, health information, financial data, or critical operational knowledge. The question is no longer just whether such data can be uploaded to a cloud model, but where it is processed, what model is used, what traces remain, what information is retained, and whether the output can be audited.
Kyndryl and Microsoft explicitly mention AI use cases in their collaboration, focusing on data governance and model locality. This points to an emerging shift: regulated AI architectures will not be purely cloud or purely local. They will often combine near-data inference, private models, managed cloud services, strict access controls, and compliance evidence.
Azure Local can fit into this pattern by enabling AI workloads and data to be near the data source while leveraging Azure management and governance tools. Still, each case must consider cost, performance, technological dependency, support, hardware availability, and actual isolation level.
A natural tension arises here. For some European clients, a sovereign offer from a U.S. provider may suffice if it addresses residency, access, encryption, and operational controls. For others, full sovereignty will require local providers, European jurisdiction, stronger contractual controls, or private deployments without operational dependence on hyperscalers. The Kyndryl-Microsoft partnership doesn’t eliminate this debate but provides a practical way for those seeking a balance between control and modernization.
DORA, NIS2, and Moving from Theory to Architecture
The announcement references frameworks like GDPR, DORA, and NIS2 because these regulations are prompting many organizations to review their technological dependencies, resilience, vendor management, continuity, and traceability. In regulated sectors, it’s no longer enough to declare that a workload is in a specific region; organizations must demonstrate how they control, recover, intervene, and provide evidence.
Kyndryl’s long-standing experience in managed services and critical systems operations positions it well here. The company offers not just cloud solutions but capabilities in design, migration, operation, and governance of complex environments. Microsoft, on its part, provides a broad technological foundation already entrenched in enterprises and administrations: Azure, Microsoft 365, security tools, identity solutions, and now expanded sovereign capabilities.
This combination can be especially valuable for organizations seeking to avoid a complete overhaul of their existing cloud setups but requiring enhanced controls. Instead of migrating everything to a national cloud or reverting to on-premises data centers, they can design a hybrid architecture: some workloads in Azure public cloud with sovereignty controls, others on Azure Local, some on regional infrastructure, and critical legacy systems still operational.
This hybrid approach appears more practical than absolute rhetoric. Digital sovereignty is built through classifying workloads, assessing risk tiers, defining controls, and documenting decisions—not by shutting down the public cloud overnight.
The Challenge: Making Sovereignty More Than Just Marketing
Sovereign cloud has become a widely used label. Almost all major cloud providers now have their own narratives around data residency, operational control, and compliance. The risk is that the term becomes imprecise, used to describe everything from a standard European region to a fully isolated environment operated locally.
Therefore, clients must ask concrete questions: Who can access the data? Where are the keys stored? What happens in an emergency support scenario? Can it operate offline? How is privileged access audited? What obligations does the provider have under extraterritorial laws? Which parts depend on Microsoft, Kyndryl, the client, or a local operator? How is recovery validated?
The joint proposal by Kyndryl and Microsoft is valuable because it seeks to move that conversation into design and operation, not just marketing. Yet, the quality of the outcome will depend on each client’s specific architecture. There’s no universal sovereignty—only levels of sovereignty appropriate to risks, sectors, and workloads.
This announcement signals that sovereign cloud is entering a more mature phase. No longer is it just about selecting a region. It’s about building environments where data, operations, AI, compliance, and resilience are supported with evidence. For governments and regulated sectors, this will be one of the most significant technology decisions in the coming years.
Frequently Asked Questions
What have Kyndryl and Microsoft announced?
They expanded their collaboration to combine Kyndryl Sovereignty Solutioning with Microsoft Sovereign Cloud, assisting regulated clients in designing, building, and operating cloud architectures with sovereignty requirements.
What is Microsoft Sovereign Cloud?
It’s Microsoft’s offering for sovereignty needs across public clouds, private environments, and partner-operated clouds, with controls over data residency, access, and operations.
What role does Azure Local play?
Azure Local enables bringing Azure capabilities to infrastructure controlled by the customer, suitable for scenarios with strict residency, disconnected operation, regulated workloads, or AI near the data source.
Why is this important for AI?
Because many AI use cases involve sensitive data. Sovereignty helps determine where data is processed, which models are used, how access is governed, and how usage is auditable.
Does a sovereign cloud from a hyperscaler solve all issues?
Not always. It can address many practical requirements, but some organizations will require more local control, regional providers, isolated operations, or additional guarantees depending on their risks and regulations.
via: kyndryl
