NVIDIA has added Confidential Bare Metal to its confidential computing lineup, an option that lets large AI model developers run sensitive workloads on third-party dedicated servers without losing control of their models or their data. The company announced it on 10/21/2026 at GTC Berlin, with Google Cloud and Cohere as the first named partners and a list of clouds that already support these deployments, including CoreWeave, Microsoft Azure, Nebius and Nscale.
NVIDIA Confidential Bare Metal in 30 seconds
- NVIDIA adds Confidential Bare Metal to its existing options for Kubernetes containers and virtual machines.
- It lets model developers run their own software, including the host system, on third-party infrastructure.
- Google Cloud will bring it to its A4X Max instances with GB300 NVL72, and Cohere plans to integrate it into Model Vault.
- Support extends to Grace Blackwell NVL72 and to HGX and DGX Rubin NVL8 systems. No general availability date has been given.
Confidential computing protects data while it is being processed, not only when it is stored or moving across a network. It relies on hardware-backed trusted execution environments (TEEs), so that not even the infrastructure operator can see what happens inside. NVIDIA now presents it as the layer that protects the models and data AI agents depend on, and announced it alongside the NVIDIA OpenShell reference architecture, its secure execution environment for agents.
Three ways to deploy with the same security
NVIDIA’s lineup already covered virtualized environments with Confidential Virtual Machines and Kubernetes with Confidential Containers. Confidential Bare Metal completes the trio for non-virtualized servers. All three options share what NVIDIA calls a converged security architecture.
The new piece for frontier model developers is a set of platform-level security controls: they protect data in transit, verify platform integrity and enforce hardware-level access restrictions. With them, an AI lab can install and run its own software stack, including host and platform software, on NVIDIA-accelerated infrastructure from public clouds, neoclouds or enterprises, while keeping control of its models and data.
Support now extends to NVIDIA Grace Blackwell NVL72 rack systems and to x86-based HGX Rubin NVL8 and DGX Rubin NVL8. NVIDIA DSX OS, its software for operating AI factories, will also integrate with confidential computing as a reference architecture for cloud providers and will support all of its modes. cloudnews.tech previously reported on how Apple is extending its Private Cloud Compute with NVIDIA’s confidential computing on Google Cloud.
Google Cloud and Cohere, the first use cases
Google Cloud will extend Confidential Bare Metal to its A4X Max instances, based on NVIDIA GB300 NVL72 systems, which combine non-virtualized accelerated compute with cryptographic protection for training data and model intellectual property. Andrés Lagar-Cavilla, distinguished engineer and head of AI infrastructure security at Google Cloud, explained that the option gives AI labs hardware-isolated compute and end-to-end cryptographic protection, and that A4X instances protect the privacy of user and model data without giving up performance. Google has not given a date.
Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault. It will use trusted execution environments to extend hardware-based security all the way to the GPU, so that models and data stay protected in memory and across interconnects during execution. Phil Blunsom, Cohere’s chief technology officer, stressed that enterprises rely on Cohere for secure, confidential inference.
Which clouds and manufacturers offer it
NVIDIA names CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr as providers that support deployments with its confidential computing. Among manufacturers, Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull will bring these capabilities to customers through NVIDIA-Certified systems.
The announcement includes no pricing or performance figures, and makes clear that Confidential Bare Metal will be offered through supported providers with no general availability date set. Cohere’s integration is planned, not yet underway.
Frequently asked questions
What is NVIDIA Confidential Bare Metal?
It is a confidential computing option from NVIDIA for non-virtualized servers that lets model developers run sensitive workloads on third-party infrastructure while keeping control of their models and data.
How does it differ from Confidential Containers and Confidential VMs?
All three share the same security architecture, but each one covers a different environment: non-virtualized servers, Kubernetes or virtual machines.
Which clouds offer NVIDIA’s confidential computing?
NVIDIA names CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure, Nebius, Nscale and Vultr.
Which hardware is supported?
Grace Blackwell NVL72 systems and x86-based HGX Rubin NVL8 and DGX Rubin NVL8, according to NVIDIA.
Sources:
