Narrative intro
Sovereign cloud is no longer a niche concern. In 2026, financial services CIOs face DORA enforcement, EU-based estates contend with NIS2 transposition and the EU Data Boundary, healthcare estates carry HIPAA and increasingly GDPR-equivalent regional regulations, and government estates face FedRAMP, IRAP, C5, SecNumCloud, or jurisdiction-specific requirements that aren't going away. The question for a regulated-industry CIO isn't whether sovereignty matters — it's how to satisfy it without retreating to a separate sovereign cloud that costs more and innovates more slowly. Microsoft's sovereign offering has matured. Microsoft Cloud for Sovereignty (MCFS) is the architecture; Confidential Computing has narrowed the premium for operator-unreadable processing; Key Vault Managed HSM provides customer-controlled hardware-backed keys; and partner-operated sovereign clouds (Bleu in France, Delos in Germany) exist for the workloads that need them. The strategic question is which sovereignty controls apply to which data tier — and how to operate them as one estate rather than as a parallel compliance theatre. This briefing covers the four pillars regulated-industry CIOs need credible answers on: regulatory mapping, data sovereignty controls, operational sovereignty, and continuous compliance. The pillars are sequenced deliberately — regulatory mapping first because it anchors everything, continuous compliance last because it's the recurring pillar that converts architecture into sustained posture. Most sovereign-cloud failures are failures of pacing and pillar order, not failures of technology.