Sovereign AI Has Two Boundaries: Location and Execution

“Keep the data in-country” used to be the defining sentence in a sovereign-cloud discussion. For production AI, it is only the first question. The harder one is what happens while a model is actively reading a prompt, retrieving documents, holding embeddings in memory and generating an answer.

Two announcements this week make that distinction concrete. On 20 October, Google Cloud introduced a managed enterprise-search experience for Gemini on an air-gapped Google Distributed Cloud deployment. A day later, it made confidential computing on G4 instances with NVIDIA Blackwell GPUs generally available. Together they point to a more useful architecture for regulated AI: control the location of a workload and independently protect its execution.

Residency and confidentiality solve different problems

The new Gemini enterprise search on GDC air-gapped is designed to keep prompts, responses, uploaded files, embeddings and models inside an organisation’s physical perimeter. Identity, object storage, PostgreSQL, model serving and even the code-execution path all stay on the disconnected network. This answers questions such as: Which jurisdiction holds the data? Can the service work without the public internet? Who operates the infrastructure?

Confidential G4 addresses another threat model. Hardware-backed isolation, memory encryption, non-exportable keys and remote attestation aim to prevent the host administrator, hypervisor or cloud provider from seeing a protected workload while it runs. Google says the service is now generally available across 36 zones for Compute Engine VMs and GKE nodes. In its stated inference tests, confidential instances showed less than 3.5% throughput degradation, although every team should benchmark its own model and configuration.

These controls are complementary, not interchangeable. An on-premises model can still expose plaintext in memory to an over-privileged administrator. A confidential GPU can protect execution while the surrounding service still uses an unsuitable region, identity model or retention policy. “Private AI” therefore needs more than a deployment label.

Attestation turns trust into a release decision

Remote attestation is the operationally important part. Before a system releases a model-decryption key, customer dataset or production credential, it can ask for cryptographic evidence about the hardware, firmware and security mode receiving the secret. The policy then releases the secret only when that evidence matches an approved configuration.

But an attestation result is not a universal safety certificate. NVIDIA’s current confidential-computing threat model is explicit: GPU evidence alone does not validate the CPU trusted execution environment or the tenant workload, while CPU evidence alone does not establish the state of attached GPUs. The trusted boundary still includes guest software, key-release services, policies and their administrators.

That caveat should shape procurement. Ask a provider to demonstrate the complete evidence chain—CPU, GPU, workload identity, verifier and key broker—not merely show that encryption is enabled. Decide what happens when evidence is stale, a firmware measurement changes or the attestation service is unavailable. A secure design should fail closed for sensitive workloads and make the rejection observable.

A practical control stack for Gulf organisations

The UAE’s National Cloud Security Policy already separates several concerns that AI programmes often collapse: data classification, protection during storage, transmission and processing, transparency about processing location, identity, contracts, resilience and operational sovereignty. That is a strong starting point for an AI workload matrix.

For each use case, record five decisions:

1. Data class: Which prompts, retrieved documents, outputs and model artefacts contain personal, regulated or commercially sensitive information?
2. Location boundary: Must processing remain in a named region, inside the UAE, on premises or fully air-gapped?
3. Execution boundary: Must data be protected from infrastructure operators while in use, and is CPU-plus-GPU attestation required before keys are released?
4. Application boundary: Which identities can retrieve documents, call tools, execute code and export an answer?
5. Evidence boundary: Which logs, attestations, source citations and deletion records prove that the first four controls actually operated?

This prevents expensive over-engineering. Public product documentation may need only regional hosting and strong tenant isolation. Legal evidence, health records, unpublished financials or proprietary model weights may justify confidential execution. Classified or safety-critical material may require an offline sovereign environment as well. The right answer is a portfolio, not one platform setting applied everywhere.

What founders and technical teams should do next

Start with one narrow workload. Choose a retrieval or inference flow whose data classification is known and whose output can be independently checked. Draw the path from ingestion through embedding, prompt assembly, GPU memory, output storage and deletion.

Make key release conditional. Treat attestation as an automated policy gate, store the evidence with the workload record and rehearse denial paths. If a new image or firmware version breaks the policy, the team should see a controlled failure—not a silent fallback to ordinary compute.

Measure the real trade-off. Benchmark latency, throughput, cold starts, capacity availability and operating cost against a non-confidential baseline. The week’s vendor numbers are encouraging, but an architecture decision needs measurements from your model, region and traffic profile.

Put promises into contracts. Data location, operator access, log retention, incident notification, evidence portability and exit procedures should be explicit. NVIDIA’s 21 October infrastructure expansion shows that confidential AI is spreading across cloud, specialised providers and enterprise systems. Portability of evidence and policy will matter as much as portability of containers.

The strategic shift is simple: sovereignty says where AI runs; confidential computing helps prove how it ran. Teams that design both boundaries now can use more valuable data without replacing governance with trust in a logo.