Digital sovereignty is driving new multicloud strategies to reduce vendor lock-in lock-in, ensure compliance, and improve the operational efficiency of AI.

According to Gartner’s estimates, 90% of companies will adopt a hybrid cloud model by 2027, with the multicloud model cited as the primary driver of cloud infrastructure spending. This trend highlights a stark reality for IT governance: digital sovereignty has become a strategic necessity.

In a hyperconnected ecosystem, relying on a single infrastructure or provider is a vulnerability that no company can afford. The multicloud approach reduces that risk by distributing workloads across multiple providers, but it does not, on its own, guarantee digital sovereignty: for that, data must also be processed within the appropriate jurisdiction, and the organization must maintain full control over where and how its infrastructure operates. To achieve this strategic autonomy, companies must advance on three fronts simultaneously: reducing technological dependence, ensuring regulatory compliance, and managing operational complexity.

Ending vendor lock-in as a prerequisite for AI

In the early years of the cloud’s rise, many companies chose to outsource their infrastructure to large public cloud platforms because of their capacity for innovation, speed of deployment, and scalability. The goal was to free themselves from the “tyranny” of hardware and move to a more flexible environment. However, migrating to the cloud also means becoming dependent on other providers. Data egress fees, the use of proprietary services, and closed architectures hinder mobility.

At present, breaking free from that dependence is not just a matter of agility; it is also essential for the expansion of generative artificial intelligence.

Companies need to train models, analyze sensitive information, and automate processes without exposing trade secrets or feeding their strategic data into external ecosystems. For this reason, more and more firms are turning to sovereign AI architectures, in controlled environments with data custody policies. For example, a financial institution can train its fraud detection models in the cloud—which is more cost-effective—and then deploy them on local infrastructure to meet regulatory requirements, without ever relinquishing ownership of the model.

In this regard, the use of cloud-native and container technologies has improved the portability of the application layer across cloud environments. This can reduce the cost of moving workloads, models, and analytical workflows from one cloud to another.

Regulatory compliance: a new factor in resilience

Once the challenge of technology portability has been addressed, the second major challenge for companies seeking to exercise multicloud sovereignty is regulatory compliance. Regulations such as DORA (Digital Operational Resilience Act), the GDPR, and the EU Data Act, along with the full implementation of the Artificial Intelligence Act (AI Act), require companies to manage their digital assets in a much more rigorous and auditable manner. It is no longer enough to simply store information securely; the AI Act mandates ensuring the traceability of training data and the transparency of algorithms. Therefore, it is imperative to document where data resides, who accesses it, and under which jurisdiction it is processed, ensuring that innovation does not compromise legal compliance or operational ethics in the event of any incident.

This shift particularly affects sectors such as finance, insurance, healthcare, manufacturing, energy, and public administration, where reliance on third-party technology can become a strategic threat. A major failure at a cloud provider, a service disruption caused by geopolitical tensions, or a unilateral change in terms of service could have direct consequences for essential services.

Companies need the ability to decide, in near real time, where to place their workloads, how to distribute their data, and which providers will deliver critical services to them. This is where the multicloud strategy truly comes into its own. By spreading applications and infrastructure across different environments, companies reduce concentration and gain flexibility in the face of technical, regulatory, or commercial contingencies. If a region becomes unviable for legal reasons or if a provider changes its terms, operations can be reconfigured with minimal impact.

Furthermore, this diversification makes it possible to tailor each workload to the most appropriate regulatory framework. The most sensitive data can be kept on local infrastructure, while other less critical services can be deployed on public clouds. The key lies in combining operational flexibility with regulatory control.

Managed services as a response to multicloud complexity

The portability and flexibility offered by the multicloud model lead to the third challenge: operational complexity. Working with multiple providers simultaneously requires managing different consoles, security policies, billing models, monitoring tools, and compliance requirements. Without effective management, this diversification can result in higher costs, reduced visibility, and increased operational risk.

As a result, managed services are emerging as a key component of the digital sovereignty strategy. Their role is not merely to outsource technical tasks, but to provide a layer of coordination that simplifies operations, automates processes, and ensures a unified view of the cloud ecosystem.

For strategic autonomy to be viable, multicloud management must provide real-time visibility so that companies can know which resources they are using, where their data is located, what risks exist, and how each environment is performing. Without that, there is no real decision-making capability. Additionally, financial optimization is required that combines FinOps disciplines to control spending with AIOps approaches to anticipate demand and move workloads between environments to maximize every investment.

Added to this is automated compliance—or compliance-as-code—which transforms legal requirements into automated controls. This management layer facilitates integration between the cloud, edge computing, and the IoT. Many companies need to process information where it is generated—in factories, hospitals, stores, or connected infrastructure—to reduce latency and comply with local regulations. Managed services make it possible to coordinate this distributed ecosystem without losing control.

Cloud & AI Infrastructure: Where All Trends Converge

The discussion on digital sovereignty, technological resilience, and the future of multicloud computing will be a key focus of the Cloud & AI Infrastructure (CAI) event, which will take place on November 4 and 5 as part of Tech Show Madrid 2026.

The event will bring together technology leaders, executives, cloud providers, and artificial intelligence specialists to discuss strategies for transitioning to agile, secure, and AI-ready cloud infrastructures.