Organizations worldwide have spent much of the past decade embracing the public cloud as the default destination for enterprise workloads. The benefits of rapid deployment, elastic scalability and reduced operational overhead were compelling. But as global organizations navigate an increasingly complex regulatory and geopolitical landscape in 2026, a different priority has emerged: maintaining control over where data resides, who can access it and which laws ultimately govern it.
Data sovereignty has evolved beyond a compliance exercise into a strategic business issue. The convergence of new regulations, artificial intelligence and geopolitical uncertainty is prompting enterprises to reassess where critical workloads belong. Increasingly, that assessment is leading organizations to expand their investments in on-premises infrastructure as part of their overall IT strategy.
Beyond Data Residency: The New Definition of Sovereignty
Historically, many organizations assumed that storing data within national borders was sufficient to satisfy sovereignty requirements. Today, that assumption is proving overly simplistic.
Legal experts increasingly distinguish between data residency (the physical location of information) and data sovereignty (the legal jurisdiction governing access to that information). A growing number of enterprises have discovered that these concepts are not interchangeable.
One of the primary reasons is the extraterritorial reach of laws such as the U.S. CLOUD Act, which allows U.S. authorities to compel American-headquartered companies to provide access to data under their control, regardless of where that data is physically stored. As a result, simply selecting a cloud region located within Europe, Canada or Asia may not eliminate legal exposure if the service provider remains subject to foreign jurisdiction.
This distinction has become particularly important for organizations operating in highly regulated industries, including financial services, healthcare, energy and critical infrastructure.
Regulations Are Raising the Bar
The regulatory environment has accelerated dramatically across Europe and other global markets.
The Digital Operational Resilience Act (DORA) has already established new operational resilience requirements for financial institutions. The NIS2 Directive is expanding cybersecurity obligations across critical infrastructure sectors, while the EU AI Act introduces governance requirements surrounding how artificial intelligence systems process sensitive data.
Although these regulations do not universally mandate on-premises infrastructure, they place unprecedented emphasis on demonstrable control, governance, operational resilience and accountability. Organizations must now understand not only where their data is stored, but also which entities can legally access it and under what circumstances.
For many enterprises, on-premises infrastructure ownership has become an increasingly attractive method of reducing compliance complexity.
AI is Changing the Economics
Artificial intelligence is introducing a second challenge alongside regulatory compliance.
Training and operating modern AI models often involves processing massive datasets that span multiple storage environments and geographic regions. These workloads frequently consume petabytes of data and require continuous movement between storage platforms, compute clusters and cloud services.
As datasets grow, organizations face rising network transfer costs, cloud egress fees and increasing governance complexity. Every movement of regulated information across jurisdictions introduces additional compliance considerations.
This has prompted many organizations to evaluate whether certain AI workloads are better suited to infrastructure they own and directly control, particularly when handling proprietary intellectual property, regulated customer information or sensitive research data.
Geopolitics Has Become an Infrastructure Risk
Technology infrastructure no longer exists independently of international politics.
Recent regulatory actions involving major technology providers have demonstrated how quickly commercial platforms can become entangled in broader geopolitical disputes. Trade investigations, sanctions, regulatory enforcement actions and cross-border legal conflicts can all affect organizations that depend heavily on infrastructure operated by foreign-owned providers.
While few enterprises expect these events to directly interrupt day-to-day operations, they increasingly recognize that infrastructure choices now carry strategic implications beyond performance and availability.
As a result, many boards and executive teams are adding geopolitical resilience to their infrastructure planning alongside cybersecurity, disaster recovery and regulatory compliance.
Cloud Economics Are Also Shifting
Cost is another factor driving renewed interest in on-premises infrastructure. Organizations with predictable, always-on workloads are finding that consumption-based pricing models can become increasingly difficult to forecast over time.
Usage-based billing, storage growth, network transfer charges and cross-region data movement all contribute to operational costs that fluctuate month to month. Some specialized sovereign cloud offerings also carry additional pricing premiums while still raising questions about legal jurisdiction.
Recent industry surveys indicate that a significant majority of enterprise IT leaders expect to expand their on-premises infrastructure during the next two years. Organizations are increasingly relocating data-intensive, regulated and AI-centric workloads back to privately owned infrastructure while primarily retaining public cloud for applications that benefit most from elasticity.
Looking Ahead
Data sovereignty in 2026 is no longer simply about where information resides. It is about who ultimately controls it.
As regulations become more stringent, AI workloads continue to expand and geopolitical uncertainty influences technology strategy, enterprises are recognizing that infrastructure ownership can play an important role in managing both compliance and business risk. On-premises infrastructure offers predictable costs, operational control and stronger governance for the workloads where sovereignty matters most. Infrastructure has become less an IT decision and more a foundational component of enterprise resilience, regulatory readiness and long-term business continuity.