AIの時代におけるデジタル主権：管理とイノベーションはどちらかを選ぶ必要はないDigital sovereignty in the age of AI: You don’t have to choose between control and innovation

For organizations bound by strict compliance and sovereignty rules, adopting the latest artificial intelligence has often meant a difficult trade-off: keep sensitive data under tight local control, or move it to the cloud to access cutting-edge models. In a recent post, Google Cloud argues that this is a false choice, contending that enterprises and governments can pursue AI innovation without surrendering control over their data, largely through hybrid and distributed cloud infrastructure.

The company frames the challenge around three interconnected risks that regulated organizations are actively managing. The first is jurisdictional risk, driven by shifting local regulations, the need to protect intellectual property, and the possibility of foreign data access requests, all of which make careful local data handling essential. The second is economic independence, reflecting the concern that heavy reliance on foreign infrastructure providers could leave critical services vulnerable. The third is geopolitical risk, the need to safeguard essential local services against unpredictable global disruptions. Together, these pressures explain why many institutions have historically kept sensitive workloads on-premises, even at the cost of falling behind on AI.

Google Cloud supports its argument with data from its State of AI Infrastructure report, which surveyed more than 1,400 senior IT leaders. According to the post, 48 percent of those leaders said they are prioritizing infrastructure that offers data residency, controls, and support aligned with their compliance and sovereignty needs. That figure suggests sovereignty considerations are not a niche concern confined to a handful of heavily regulated sectors, but a mainstream factor shaping infrastructure decisions across a broad set of enterprises and public bodies.

The technical premise is that hybrid and distributed cloud models can act as a bridge between compliance and advanced AI. Rather than forcing organizations to send data to a centralized public cloud, this approach brings cloud-style services and AI capabilities closer to where data already resides, including on-premises environments and locally operated facilities. In practice, this typically involves deploying managed hardware and software stacks inside a customer's own data center or a designated regional location, allowing sensitive data to remain within a defined jurisdiction while still benefiting from modern model serving, tooling, and updates. The stated goal is to let organizations retain control over data residency, operational governance, and access, without giving up access to current AI functionality.

For context, Google's broader push in this area is anchored by Google Distributed Cloud, its portfolio for running Google Cloud services outside the traditional public cloud, including connected and air-gapped configurations intended for environments with the most stringent isolation requirements. The company has previously described efforts to make its Gemini models available in such distributed and on-premises settings, which aligns with the argument in this post that frontier AI need not be confined to centralized regions. The emphasis on sovereignty also reflects Google's investment in region-specific offerings and partnerships designed to meet local control and operational independence expectations.

This messaging does not exist in isolation. Digital sovereignty has become a competitive theme across the major cloud providers, with Microsoft and Amazon Web Services both promoting sovereign and localized cloud options aimed at government and regulated industry customers, particularly in Europe. Regulatory drivers such as the European Union's data protection framework, sector-specific rules in finance and healthcare, and ongoing debates over cross-border data access have intensified interest in infrastructure that can demonstrably keep data within national or regional boundaries. As a result, vendors increasingly present sovereignty features, including data residency guarantees, operational controls, and encryption key management, as core differentiators rather than optional add-ons.

It is worth noting that the post reflects a vendor's perspective, and its central claim, that control and innovation no longer require compromise, is a position Google Cloud is making to advance its own offerings. Whether hybrid and distributed deployments fully satisfy a given organization's legal and operational requirements is likely to depend on specific regulations, threat models, and the maturity of the underlying products. Even so, the underlying trend appears clear: sovereignty requirements and demand for advanced AI are converging, and infrastructure that can reconcile the two is becoming a central battleground. For enterprises and governments weighing where to run sensitive AI workloads, the practical question is shifting from whether local control is possible to how much capability it can preserve.