Alex Hanway | Director of Business Development
More About This Author >
Alex Hanway | Director of Business Development
More About This Author >
Autonomous AI changes the risk equation for business leaders. AI agents go further than the generative AI tools organizations now use to produce content and help with research. They can access enterprise data, invoke systems, and execute multi-step workflows with limited human intervention. That opens the door to faster innovation, but also to sensitive data exposure, unauthorized actions, and loss of operational control.
The question for executives has changed. It is no longer simply whether to adopt AI, but whether the business can scale it while retaining control over where data resides, who can access it, where workloads run, and who owns the encryption keys. Without those safeguards, AI initiatives may not be allowed access to valuable data and intellectual property, ultimately limiting model performance and business value.
That is why data security and AI sovereignty have become business imperatives, not simply compliance requirements. A new report from MIT Technology Review Insights, “Establishing AI and Data Sovereignty in the Age of Autonomous Systems” (May 2026), discusses how enterprise leaders are reassessing their data architectures as autonomous systems move into production. Organizations can innovate with greater confidence, manage risk, and turn AI investment into measurable business results when they have clear control over data, infrastructure, and AI environments.
From Thales’s perspective, the real sovereignty challenge is not simply where AI runs. It is whether the organization retains authority over where workloads run, how sensitive data is accessed, how encryption keys are controlled, and what happens when AI acts. As autonomous systems take on more operational responsibility, that authority must be designed into the architecture rather than added after deployment.
Key Takeaways
- AI sovereignty extends data sovereignty from where data lives to where models run, which data they can touch, and how their autonomous decisions are audited.
- Organizations deeply committed to sovereignty (13% of respondents) report five times the AI return on investment of their least-committed peers.
- Modeled analysis across more than 15,000 simulations found a 0.93 correlation between sovereignty commitment and AI success, the strongest single driver identified.
- 95% of enterprises plan to establish their own AI and data platforms within three years, and 53% already run AI agents in production.
- Sovereignty does not mean isolation: externalized key management, hardware-backed roots of trust, and hybrid architectures let enterprises use cloud scale while keeping control of keys, access, and audit.
Data Sovereignty vs. AI Sovereignty: Why Both Matter
Data sovereignty governs where data resides, under which legal jurisdictions it falls, and who can access it. AI sovereignty extends these principles to the entire decision-making environment, governing where models run, how they are trained and fine-tuned, what operational data they can touch, and how their autonomous decisions are audited.
“Data sovereignty and governance is about custody and control, consent and compliance. AI sovereignty is … the entire decision environment and the operational authority that surrounds it.”
Michael Schrage, Research Fellow, MIT Sloan School’s Initiative on the Digital Economy
According to the EDB global survey cited in the report, which surveyed more than 2,000 senior executives across 13 countries, 95% of enterprises plan to establish their own AI and data platforms within the next three years. In addition, 70% of executives report a need to establish a sovereign data and AI platform within one year.
The findings point to measurable business value:
- Potential ROI Advantage: Organizations categorized as "deeply committed" to AI and data sovereignty (13% of respondents) reported five times the return on investment of disengaged "sideliners."
- Strong Association with Success: Modeled analysis across more than 15,000 simulations and 500+ variables found a 0.93 correlation between sovereignty commitment and AI success outcomes, the strongest single driver the analysis identified.
Stronger sovereignty controls can give organizations the confidence to use high-value data and intellectual property in AI initiatives rather than keeping those assets outside the AI environment.
“You leave your crown jewels—customer data, IP—outside of AI access, because you’re in that fearful environment. If you flip the coin... you have the confidence to feed your most valuable data through your AI models and extract massive ROI.”
Mukesh Chandak, Director of Strategy and Innovation, Cloud & AI, Thales
Sovereignty Without Isolation: Hybrid Cloud With Customer-Controlled Keys
Sovereignty does not mean building an isolated private cloud. Nor does it require giving up the scale and advanced services available from cloud providers. It means choosing where workloads run while retaining control over sensitive data, encryption keys, access policies, and audit records.
This balance is already reflected in enterprise architecture: 45% of surveyed organizations use hybrid environments to combine high-performance computing with jurisdictional and operational control. Models such as S3NS, the Thales joint venture with Google Cloud, show how organizations can use cloud capabilities within a framework designed to support local control requirements.
Compliance remains important, but it is not the same as sovereignty. An environment may meet regulatory requirements and still leave an organization dependent on a provider for critical decisions or key access. A sovereign architecture adds stronger cryptographic and operational control, helping the enterprise determine who can access protected data, under which conditions, and in which jurisdictions.
How Sovereignty Controls Secure Agentic AI Workflows
AI agents are already moving into production: 53% of enterprises report running them today, and another 28% are actively deploying them. These systems do more than generate text. They can invoke sub-agents, read transaction databases, and execute operational workflows.
When an autonomous agent initiates a multi-step chain, clear accountability matters at every handoff, along with controls that reduce the risk of unauthorized data movement across jurisdictional borders.
As highlighted in the MIT Technology Review Insights report, sovereignty controls provide a consistent trust layer across multi-agent workflows. Agentic systems can expand the attack surface and make accountability more difficult without hardware-backed roots of trust and external key management. Thales applies the same principle beyond the database: its expanded collaboration with Google Cloud connects the Thales AI Security Fabric to Gemini Enterprise to keep AI agents within approved policy boundaries.
How EDB Postgres AI and Thales CipherTrust Manager Enable Sovereign AI
Production environments need a practical answer. EDB and Thales bring together open, AI-ready data infrastructure, customer-controlled encryption key management, and hardware-backed security.
EDB Postgres AI serves as an open, enterprise-grade data and AI platform, unifying transactional, vector, and analytical workloads. By pairing EDB's AI-ready database engine with Thales CipherTrust Manager and Luna Hardware Security Modules (HSMs), enterprises can strengthen operational separation and cryptographic control. See the EDB and Thales partnership for the full set of joint integrations.
Core Architectural Safeguards
- Externalized Key Management: Thales CipherTrust Manager enables the enterprise to control cryptographic keys separately from cloud providers and database engines. This separation is designed to prevent protected database content from being decrypted without access to authorized customer-controlled keys.
- Hardware-Backed Root of Trust: Thales Luna HSMs provide FIPS-validated, tamper-resistant protection for key generation and cryptographic operations.
- Data Encryption and Granular Access: Encryption and fine-grained, role-based permissions help protect data and limit access to approved users, services, and workflows.
- Confidential Computing Integration: Hardware-enforced enclaves can help protect data and model assets while they are being processed by limiting their exposure outside the trusted execution environment.
- Post-Quantum Cryptography Readiness: PQC-ready and crypto-agile capabilities can help organizations plan a controlled migration toward quantum-safe protection as standards and deployment requirements evolve.
Why Enterprises Prioritize Sovereignty: The Top Three Drivers
The survey findings show that executive decisions about sovereignty are driven by security, compliance, and operational priorities:
- Security and Resilience (85%): Protecting AI models, prompts, and training data from cyber threats and unauthorized access.
- Data Localization Requirements (74%): Complying with evolving global mandates requiring data to be processed within national boundaries.
- Ownership and Control (72%): Maintaining authority over core data assets and proprietary model outputs.
A 90-Day Roadmap to Sovereign AI
A multi-year rebuild is not the only path forward. Organizations can begin with high-value workflows and strengthen controls in three practical stages:
- Weeks 1–4: Map — Identify high-value data, workflows, jurisdictions, and governance requirements.
- Weeks 5–8: Validate — Pilot a bounded use case and test key control, access policies, auditability, and recovery.
- Weeks 9–12+: Expand — Move validated workflows into controlled production environments and monitor decision trails.
Conclusion: Make Sovereignty a Foundation for AI Growth
Autonomous AI leadership will depend on more than speed. Organizations also need control of their most valuable data, AI models, infrastructure, and encryption keys. Sovereignty gives business leaders greater confidence to expand AI into high-value workflows while managing security, compliance, and operational resilience.
EDB Postgres AI, Thales CipherTrust Manager, and Luna HSMs provide a practical foundation for control across hybrid and multi-cloud environments. Together, they help protect sensitive data, simplify governance, and support AI adoption at scale.
What should executive teams do next? Start with the data and autonomous workflows most critical to the business. Define the controls needed to protect them, then make sovereignty part of the AI strategy from the outset. Acting now can help convert AI investment into sustainable business value.
Frequently Asked Questions
What is AI sovereignty?
AI sovereignty extends data sovereignty to the entire AI decision environment: where models run, how they are trained and fine-tuned, which operational data they can access, and how their autonomous decisions are audited. Data sovereignty governs where data resides, which jurisdiction’s laws apply, and who can access it.
What is the difference between data sovereignty and data residency?
Data residency describes where data is physically stored. Data sovereignty goes further: it determines which jurisdiction’s laws apply to that data and who can access it, including the cloud provider. Without control of the encryption keys, storing data in a given location does not by itself guarantee control.
Why does sovereignty matter for agentic AI?
AI agents can read transaction databases, invoke sub-agents, and execute workflows with limited human intervention. Without sovereignty controls such as customer-controlled keys, hardware-backed roots of trust, and audit trails, every handoff in a multi-agent chain widens the attack surface and blurs accountability, including for data that crosses jurisdictional borders.
Does data sovereignty require a private cloud?
No. Sovereignty means choosing where workloads run while retaining control over sensitive data, encryption keys, access policies, and audit records. Hybrid and multi-cloud architectures with externalized key management let enterprises use cloud-scale AI services without giving the provider access to their keys.
How does external key management support sovereign AI?
External key management keeps encryption keys outside the cloud provider and the database engine. With Thales CipherTrust Manager managing keys for EDB Postgres AI, backed by FIPS-validated Thales Luna HSMs, protected data cannot be decrypted without access to the enterprise’s own authorized keys.