Sovereignty is control, not location. Tell that to the EMA inspector.

A recent Microsoft EMEA panel with IDC and Accenture landed the message hard, in unison and on cue. Digital sovereignty is no longer about where your data sits. It is about how you govern, protect and operate it.

A recent Microsoft EMEA panel with IDC and Accenture landed the message hard, in unison and on cue. Digital sovereignty is no longer about where your data sits. It is about how you govern, protect and operate it. Control, not location. Resilience, not residency. Risk management as a discipline, not a fixed destination.

It is a polished narrative. It is also a coordinated one. The video drops two weeks after the Microsoft Digital Sovereignty Summit in Brussels, three days after Accenture and Google Cloud opened a sovereign-AI centre in the same city, and a few weeks after Microsoft Sovereign Cloud went generally available. The Trusted Technology Alliance, launched in February, lines up the same vocabulary across the sector. Three companies, one message, one quarter.

For most enterprise workloads, the reframe holds. Hyperscale infrastructure is genuinely more resilient than what most organisations could build themselves. Modern key management, confidential computing, regional disconnected modes and contractual safeguards are real engineering, not marketing. If you are running a CRM, a customer data platform or a marketing analytics stack, sovereignty as control is a serviceable model for most of your risk register.

For pharma and life sciences, it is the first slide of the pitch, not the last word on what compliance actually requires.

The regulators have not moved with the narrative. EMA inspectors, BfArM auditors and FDA Form 483 writers still ask the same questions they asked five years ago. Where does this data physically reside. Who has lawful access to it under which legal regime. Under whose jurisdiction do the encryption keys sit. Whose courts can compel disclosure of plaintext. Where do the operations staff with privileged access actually log in from. None of those questions get a satisfactory answer from a control plane diagram or an attestation document.

Schrems II is still live law. The CLOUD Act still applies to US-headquartered providers regardless of where their European data centres sit. FISA 702 has not been repealed. A non-EU provider operating beautifully resilient infrastructure inside the EU can still be lawfully compelled to disclose data held under EU jurisdiction. That is not a hypothetical. It is the central reason the European Data Protection Board has spent three years building case law around exactly that risk.

The regulatory layer cake is getting thicker, not thinner. The EU AI Act high-risk obligations now bite for clinical decision support, pharmacovigilance signal detection and diagnostic AI. The Data Act cloud-switching rules come fully live in January 2027 and require demonstrated portability, not theoretical portability. GxP audit trail requirements predate cloud computing entirely and were written for systems where the auditor can identify a specific server, a specific operator and a specific point of accountability. ISO 42001 and NIST AI RMF add a layer of AI-specific governance on top. None of this gets simpler under a control-not-location framing. Most of it gets harder, because you now need to evidence control as well as residency, and you need to do it in language that an inspector trained on paper-and-server systems can follow.

This is the practitioner reality. Pharma sovereignty is location, and control, and jurisdiction, and key custody, and vendor concentration, and contractual fallback, and audit evidence, and personnel security. You do not get to pick the parts that are easy to sell. Inspectors do not accept abstractions, and they do not grade on a curve for vendors who give a confident pitch.

The procurement questions that matter for a pharma AI workload are unglamorous, and they are the ones the panel did not address. Where does the data physically reside, in which named region, under which named legal entity. Who holds the root keys and where do those keys physically sit. Which legal regimes can compel access, and what is the contractual disclosure obligation when they do. What happens to your data, your models and your prompts if the provider is acquired, sanctioned, or chooses to exit your region. Can you actually export and rebuild on a different stack within the Data Act portability window. Where do the privileged operations staff log in from, under whose employment contract, and under whose background check standard.

If a vendor cannot answer those in writing, with named entities and specific contractual references, no amount of resilience marketing will help when an inspector is sitting across the table from your QA director.

The Microsoft, IDC and Accenture reframe is not wrong. It is incomplete for our sector. Sovereignty as risk management is a useful executive narrative and a dangerous starting point for procurement. The boardroom can buy the abstraction. The QA team cannot.

The pharma practitioner job is to read the pitch deck for what it tells you, then walk into the procurement room with the questions the panel never got round to answering. Pitch decks do not pass audits.