Strategic Insight: “Sovereign cloud” is being operationalized as a compliance control, not a complete solution.

BD’s rollout of an AI-enabled medication dispensing system on AWS European Sovereign Cloud highlights a recurring governance tension. Organizations want hyperscale infrastructure benefits while maintaining EU data sovereignty alignment.

The issue is that sovereignty in cloud terms is partial by design. It typically covers data residency, restricted access, and localized operations. However, several governance gaps remain:

• Encryption key jurisdiction. Who can compel access under foreign laws
• Incident response coordination across legal entities and regions
• Sub-processor transparency and cascading compliance obligations
• Alignment with lawful basis requirements for sensitive health data

From a governance perspective, this shifts the burden to procurement and risk teams. Supplier due diligence must go beyond marketing claims and into contractual, technical, and operational verification.

Sovereign cloud reduces exposure. It does not eliminate cross-border complexity.

Where do you see the biggest unresolved risk in sovereign cloud models today?