Sovereign cloud costs 30 percent more and is still someone else's cloud: what full sovereignty actually requires

Is sovereign cloud actually sovereign?

Partly. A hyperscaler sovereign region keeps your data in-country and adds local staffing and contractual controls, which is a genuine step up for many buyers. But the servers, the control plane and the operational keys still sit with the provider, and the provider still answers to its home jurisdiction. Gartner projects roughly 80 billion dollars of sovereign-cloud spend in 2026, with hyperscalers charging up to 30 percent more for sovereign offerings and migrations that typically take 3 to 4 years. You pay a premium and wait years for a stronger version of a tenancy you do not ultimately control.

That is the honest distinction. Sovereign cloud improves residency and reduces some exposure. It does not change who owns the substrate. If control is what you are buying, ask who holds the hardware, who holds the keys, and whose law reaches the operator.

What does the 30 percent premium actually buy?

It buys a ring-fenced version of the same public cloud: data kept in a named region, access restricted to vetted local personnel, contractual promises about foreign access, and sometimes a local operating partner. Those are real controls and they matter for some workloads.

What the premium does not buy is independence from the provider. The compute is still theirs. The management plane is still theirs. Software updates, capacity and availability are still on their terms. And where the provider is headquartered under a jurisdiction with extraterritorial reach, a lawful order in that jurisdiction can still create a route to your data or your operations that you cannot fully see or block. The premium narrows the surface. It does not remove the landlord.

Why do migrations take 3 to 4 years?

Because moving a regulated estate into a sovereign region is a re-platforming exercise, not a switch. You re-architect networking, identity, data flows and controls, then re-certify the lot against auditors and regulators. Multi-year timelines are common, and during those years the strategic question rarely gets re-asked: at the end, do you own the thing, or do you rent a more expensive seat in someone else's building?

If the answer is still rent, a three to four year programme has bought residency and assurance, not sovereignty. For some buyers that trade is acceptable. For defence, intelligence, critical national infrastructure and the most sensitive parts of finance, government and healthcare, it often is not.

What does full sovereignty actually require?

Three things the operator must hold, not borrow:

• The hardware. The AI runs on machines the operator owns and physically controls, not on rented capacity in a provider's estate.
• The keys. Encryption and signing keys live with the operator. No third party can compel access to keys it never holds.
• The audit. Every consequential action is recorded in a ledger the operator keeps, so the record cannot be edited or withheld by an outside party.

Add one property that matters for AI specifically: the ability to run offline. If the system depends on a live connection to an external cloud to function, that connection is a control point, and whoever owns the other end owns part of your operation. Sovereignty that evaporates when the link drops was never sovereignty.

Where does Mickai fit, and where does it not?

Mickai is a British Sovereign Intelligence Operating System (SIOS) built for exactly this control boundary. The AI runs inside the operator's own walls, offline, on hardware they own. Keys stay with the operator. Every consequential action is sealed into a post-quantum signed audit ledger using ML-DSA-65 (FIPS 204), so the record is verifiable and held by you rather than by a provider. It ships as roughly 60 studios that replace much of the enterprise cloud and SaaS stack, backed by 50 brains, so sovereignty does not mean giving up capability. Our position is protected by 104 filed UK patent applications and 2,340 formal claims, trade mark UK00004373277, under Companies House 17166618. It is built and live, not a slide.

Here is the limit, stated plainly. Owning your AI does not make you exempt from any law, and it does not make you immune to every risk. You still need good policy, good people and good governance around it. Sovereign cloud remains a sensible step up for buyers whose sensitivity does not demand full operator control, and we will say so. What Mickai changes is who holds the substrate. When the hardware, the keys and the audit are yours and the system runs without an external cloud, there is no landlord to answer an order you never saw.

How should a buyer decide between sovereign cloud and full sovereignty?

Start with a single question: in your worst case, who do you need to be unable to reach your data or your model, and does your chosen option make that party structurally unable, or merely contractually discouraged? Sovereign cloud leans on contracts, vetting and residency. Full sovereignty leans on ownership and physics.

Then weigh cost and time honestly. A 30 percent premium and a three to four year migration are a large commitment for an outcome that still leaves ultimate control with a provider. Owning the substrate has its own cost and its own operational burden, and it is not right for every workload. But for the workloads where control is the whole point, paying more to rent harder is the wrong shape of answer.

Sovereign cloud asks you to trust a better tenancy. Full sovereignty asks you to own the building. Mickai is built so regulated operators can own it, run it offline, and hold the keys and the audit themselves, and we will tell you where the honest line sits for your case.

“Gartner projects about 80 billion dollars of sovereign-cloud spend in 2026, with up to a 30 percent premium and migrations that typically take 3 to 4 years.”

Frequently asked questions

Is a hyperscaler sovereign region enough for sensitive data?

For many workloads it is a real improvement: data stays in-country, access is restricted to vetted staff, and contracts limit foreign access. But the provider still owns the hardware and control plane and answers to its home jurisdiction, so for the most sensitive defence, government, finance and healthcare workloads it may not meet a genuine control requirement.

Why do sovereign cloud offerings cost up to 30 percent more?

The premium pays for ring-fenced regions, local staffing, additional contractual controls and sometimes a local operating partner. It buys stronger residency and assurance. It does not buy ownership of the underlying compute or independence from the provider.

How long does a sovereign cloud migration take?

Gartner indicates migrations typically take 3 to 4 years because moving a regulated estate is a re-platforming and re-certification exercise, not a simple switch. The strategic risk is spending years to end up renting a more expensive seat rather than owning the system.

What is the difference between data residency and sovereignty?

Residency means your data physically sits in a named country. Sovereignty means you hold ultimate control: the hardware, the keys and the audit trail are yours. You can have residency without sovereignty, which is the gap sovereign cloud often leaves.

Does owning your AI make you exempt from regulation?

No. Full sovereignty changes who controls the substrate, not whether the law applies. You still need sound policy, governance and people. Mickai gives you ownership of the hardware, keys and audit; it does not make any operator immune or exempt.

How does Mickai deliver full sovereignty?

Mickai runs the AI offline on hardware the operator owns, with keys held by the operator and every consequential action sealed into a post-quantum signed audit ledger using ML-DSA-65 (FIPS 204). Roughly 60 studios and 50 brains provide the capability without depending on an external cloud.