Data sovereignty has become essential to reconciling innovation, compliance and risk management in the AI era, and can no longer be just an option for businesses.
In recent years, artificial intelligence has largely established itself within most companies and seems to be gaining further ground, as evidenced by a recent study from McKinsey indicating that 88% of them admit to using it in at least one business function. In many cases, companies end up having to define their own frameworks in the face of its rapid democratization.
However, faced with the deceleration of the pace of innovation, companies increasingly tend to leave aside data sovereignty, which is nevertheless a pillar on which to orchestrate their deployment of secure AI. Such technological acceleration has had the effect of revealing certain limits: as uses multiply, data sovereignty emerges as an essential criterion to guarantee secure and reliable deployment of AI technologies.
At the same time, to catch up, regulatory frameworks have made the sovereignty and visibility of the data that powers AI a priority. This logic is illustrated in particular by the strict, risk-based rules, established in particular by the AI Act, the European regulation on AI, to govern the way in which AI is developed and deployed within the EU, to allow better visibility of the data on which the technology is built.
Therefore, organizations should opt for a more structured approach in order to best integrate these regulatory developments into their initiatives. This involves designing traceable, visible data architectures that incorporate sovereignty-by-design; this will not only allow them to be a step ahead in regulatory compliance, but also to be able to take full advantage of the potential of AI.
Sorting your data, an essential step
Data constitutes the foundation of digital sovereignty, but also of innovation in artificial intelligence, it is now common knowledge. According to IDC, by 2025, the total volume of data generated will reach a dizzying peak of 181 zettabytes; if these immense quantities are used to power AI with the aim of developing projects, it is clear that most of them remain stuck in the pilot phase, before being abandoned. Furthermore, recent studies show that nearly 95% of generative AI pilot projects carried out within organizations never reached the production phase or were simply not deemed profitable. The cause? Some negligence in data hygiene.
As data experiences unprecedented growth, driven by the rise of artificial intelligence, most organizations struggle to keep pace with such volumes, which often outpace evolving storage and governance practices. As a result, vigilance over the quality of the data stored decreases significantly. In this context, data that is not very useful, or even redundant, is frequently stored alongside data that is truly usable in the context of developing AI use cases. However, this accumulation is not without consequences, as AI systems learn as much from the structure and quality of data as from its content. In fact, when the data sets used to train artificial intelligence contain inappropriate or useless data, the performance of the models loses quality and relevance, and the results obtained cannot be properly exploited.
Finally, the regulatory challenges linked to AI should not be underestimated. Although regulators still struggle to establish a common international approach, a trend is emerging: future regulatory requirements will rely heavily on better visibility of the data used to power AI systems.
The NIS 2 Directive and the EU AI Act already reflect this trend at the European Union level, raising expectations for transparency, governance and control of training and operational data. In such a context, strong data sovereignty becomes essential. Without a clear and controlled overview of their data assets, organizations will struggle to map their data flows, understand their dependencies and, ultimately, meet the regulatory requirements of today and tomorrow.
Regain control over your data
Today, companies find themselves faced with several years of massive accumulation of data, and must try to control ever more colossal volumes. Rather than considering an immediate improvement in their data hygiene, they must take an essential step: understanding precisely what data they have and assessing its level of criticality.
This essential approach helps prevent a generative AI tool from inadvertently accessing strategic or sensitive data, but also constitutes a key lever for improving the performance of AI models. So, by more clearly identifying relevant data and discarding unnecessary data, organizations can feed AI systems with more structured, reliable and actionable data sets.
As soon as their data is identified, classified and controlled, companies can begin defining their sovereignty requirements according to each category of data, taking into account both international regulations and local specificities.
Faced with this level of complexity, some choose to apply the most restrictive rules in their environments in order to limit the risks of non-compliance. However, the reality is often more nuanced: for example, the GDPR does not require data localization according to the country concerned, but requires them to remain within the European Economic Zone (EEZ)while rigorously regulating transfers of personal data outside this area.
This patchwork of requirements explains why many organizations today are moving toward hybrid and multicloud architectures, which allow for a degree of flexibility regarding where workloads are processed and stored, while still meeting local regulatory constraints. Data portability thus becomes a key issue, particularly in a context where regulations will continue to evolve. Beyond compliance, this approach also provides greater visibility and control over data, by making it possible to visualize its location, know how it circulates and the identity of the people who can access it. Such a degree of transparency is now essential, both to strengthen security and to ensure effective governance of AI environments.
Data sovereignty is no longer an option
Once seen as just a box to check off a long list of regulatory requirements, data sovereignty was far from being part of companies’ data strategy. Today, it represents a real lever for transformation, offering a structuring framework to better govern the data that powers operations and AI systems.
Companies thus have a more reliable basis for regulating the uses of AI and deploying appropriate governance. Furthermore, better structured, better understood and more relevant data also makes it possible to concretely improve the performance of generative AI projects and to take advantage of them more easily.
