Shaping Data Sovereignty Strategies that Scale

Deutsche Telekom serves around three million businesses in the German market, and sovereignty is top of mind for many of them. 

“Everybody is talking about sovereignty,” Andreas Eisenreich, chief technology officer of cloud and infrastructure at Deutsche Telekom, told The Forecast. 

“A lot of people reduce that to where your data sits. But, really, sovereignty is all about being able to act according to your strategic goals, to your values.”

His recent work and conversations inspired him to write IT Sovereignty: The Hitchhiker's Guide for Architects and Decision Makers, featuring strategy tips for building sovereign-capabile IT systems today.

For years, “data sovereignty” was a term only uttered by policy wonks and privacy lawyers. But on August 2, 2026, it could mean code red for CIOs and whole C-suites across Europe. That’s when companies must comply with the EU AI Act, the most comprehensive AI regulation. Failure to do so could bring penalties of up to 7% of an organization’s total global turnover.

The threat of being found in noncompliance has given rise to geopatriation, “prompting organizations to move workloads to sovereign, secure environments such as sovereign clouds and on-premises data centers,” according to Gartner. The trend reflects growing distrust of global technology providers. Local alternatives have come into favor, as they can guarantee a company’s data is stored and processed legally within EU borders.

The shift has IT decision-makers scurrying to find smart, economical ways to modernize their existing systems and power AI capabilities. Many are honing sovereignty strategies that give them more control over their data, where it runs, when it runs, the systems it runs on, and who has the keys to their data and systems. Increasingly, that means managing hybrid IT infrastructure and systems that stretch across private data centers and public clouds in multiple regions. 

Bhattacharyya sees these concepts as relevant to IT professionals who must build complex, flexible systems that respond to new threats, learn and optimize, remain resilient under stress, and feature modular subsystems.

“More than ever, IT systems need to be adaptive to new challenges,” he said. “Those who build and manage them need to do the same. They have to think holistically and design for change.”

Flexibility: Bending Without Breaking

In IT systems, flexibility means maintaining a core purpose while allowing for extensive adaptability in form. Much like trees that survive a storm by bending with the wind, technology designed with true flexibility can undergo rapid pivots to meet new threat landscapes or business needs without losing its essential character.

Eisenreich hops between meetings with mid-market business leaders, helping them create sovereignty strategies that keep them moving forward in rapidly changing times. This requires significant foresight. If the architecture is too rigid, locked down, or insular, or is built on closed, proprietary standards, IT teams risk getting stuck, unable to scale and bolt on new capabilities in the future. 

“This is something that our clients are afraid of, honestly,” Eisenreich said.

“With all that is happening in the world, it's easy for them to say, ‘Okay, I’ll do my own thing. I’ll just call my friends over at IBM and ask them to ship ten servers to my premises, and I'm good to go.’

“That’s an easy way out of the discussion when it comes to sovereignty. But if you’re not willing to partner with someone and get someone from outside into your infrastructure strategy ideas, you miss the speed of innovation and commit to an enormous amount of long‑term effort to develop and maintain your infrastructure during a time of skill shortage in Germany,” he said.

From his unique vantage point, IT teams need two things to prevail as sovereignty comes into focus: hybrid technologies that give them tighter control over their data and infrastructure, and strategic policies for partnering with cloud vendors.

Framework for Evaluating Sovereign Cloud Vendors

In September 2025, Eisenreich wrote on Linkedin about some of the challenges IT decision-makers face in putting together an effective digital sovereignty strategy. In it, he stressed how sovereignty isn’t the same for all organizations. It contains many facets, including data residency, operational independence, and the openness of underpinning technologies.

“It’s not a switch that you can turn on and off,” he told The Forecast.

“It’s a scale. And where you are on that scale depends on what’s important to you. That makes it super complex when we are in a service provider and client discussion,” he said.

He gives the example of a cloud platform that is marketed as sovereign, but fails to provide open formats and standards, preventing customers from exercising full control over their data. This would not fit many people’s definition of sovereignty. 

He created a framework to help IT pros develop a strategic plan tailored to their unique goals. Organizations can rate data sovereignty by ranking “I want control over my data” to a level between 0 "I don't care; I just want to be able to store and retrieve data” and 5 "I want to have my data exclusively with me.” 

He explained that this framework can help IT teams assess whether a potential vendor aligns with the company’s strategy.

“I don’t want to say people start lying,” he said. “But if you are a service provider and you are using your own infrastructure to run your data centers, to you it feels kind of sovereign. That doesn’t always fit with what clients have in mind.”

Hybrid IT Solution Brings Scale and Control

Recently, Deutsche Telekom teamed up with Nutanix to create a sovereign management solution dubbed Hybrid IT. Built on Nutanix open source software core, it is designed to give IT teams control and visibility into how they utilize resources.

“What we created fits perfectly with the discussion about, ‘Okay, I want it sovereign on one hand, and I want to make use of the promises of the cloud,’” he said. 

“The client is able to decide per workload if they want to run it on the full trust, closed Nutanix stack within their premises, or pull in additional resources from the cloud, and that's completely transparent to the client.”