Where sovereignty is won or lost: Four control points for the AI era

Bart SalaetsField Chief Technology Officer | F5

For years, my conversations about digital sovereignty with customers across Europe, the Middle East, and Asia-Pacific started with one question: Where does the data live? It still matters, though leaders now ask something harder. They want to know who governs the systems their business runs on, and whether that authority holds when circumstances change.

Budgets show how seriously they take it. Gartner forecasts that sovereign cloud infrastructure spending will reach $80 billion worldwide in 2026, with the fastest growth in the Middle East and Africa (89%), mature Asia-Pacific markets (87%), and Europe (83%). Regulation drives part of that momentum, and resilience drives the rest.

AI moved the control points

Every AI deployment adds layers that most sovereignty plans never anticipated: models, prompts, agents, APIs, and a lengthening chain of third-party services. Organizations are now operating or evaluating an average of seven AI models, according to the F5 2026 State of Application Strategy Report, and data sovereignty and compliance requirements are among the reasons they diversify. Each model and connection creates a place where data can leave, a decision gets made, or an outside party gains leverage.

Those places are where sovereignty is won or lost. An organization that governs them keeps its options open wherever workloads run. One that cedes them has surrendered far more than data.

Four control points, four reference architectures

Working with Red Hat, F5 has defined four reference architectures around the points that matter most:

• Encryption keys: Perimeter application security with FIPS key assurance is the starting point, since most other safeguards depend on encryption. On supported F5 BIG-IP hardware, private keys never leave a FIPS-validated hardware security module. No administrator can extract them.
• Inference: Full lifecycle AI security for sovereign clouds runs F5 AI Guardrails and F5 AI Red Team on Red Hat OpenShift, keeping prompts, retrieved context, and model responses inside the local trust domain, including in air-gapped environments.
• Access: Zero-trust application access in sovereign clouds pairs F5 BIG-IP Zero Trust Access with a self-hosted Red Hat build of Keycloak. The pairing evaluates every user, device, and request, and identity data stays in-region.
• Operational technology: A sovereign industrial demilitarized zone (IDMZ) combines BIG-IP with OpenShift and Red Hat Enterprise Linux to secure the junction between enterprise IT and the systems that run plants, grids, and transport networks.

Together, these architectures also produce records, from key custody logs to inference audit trails, that support assessments under frameworks such as NIS2, DORA, and the EU AI Act.

Encryption keys are the starting point for sovereignty, with inference, access, and operational technology built on top of them.

Why the platform matters

Red Hat OpenShift is a leading Kubernetes platform, giving organizations consistent operations across hyperscale clouds, sovereign partner clouds, on-premises data centers, and air-gapped sites. Red Hat Confirmed Sovereign Support adds 24/7 assistance delivered by verified European Union citizens from within the EU. On that foundation, F5 security and traffic policies move with the workload across hardware, virtual, and container form factors.

Key custody is the exception. Keeping private keys inside a FIPS-validated hardware security module requires supported BIG-IP hardware, a choice to make early in the design.

Sovereignty in degrees

Not every application needs the same level of protection. A public website and a defense workload carry very different risks, and treating them identically either wastes budget or leaves gaps. A more practical path sets sovereignty application by application and layers it onto existing infrastructure, public cloud included.

Sovereignty is set application by application, from public cloud to sovereign partner cloud, on-premises, and air-gapped environments.

Most organizations begin with encryption keys and extend to inference, access, and operational technology as AI adoption and regulatory scope grow. Organizations that lead will adopt AI quickly and keep a firm hold on all four control points. Speed and sovereignty are compatible when the architecture is designed for both.

You can find the reference architectures here. Also, visit our F5 and Red Hat webpage.

About the Author

Bart SalaetsField Chief Technology Officer | F5

More blogs by Bart Salaets