Digital Sovereignty for AI and Analytics Platforms

For organizations, digital sovereignty has long been more than just an abstract political debate. It is increasingly becoming a key requirement for modern IT architectures. Those who design analytics and AI platforms face fundamental decisions: Where is the data stored? Who controls access? What dependencies arise from software, vendors, and licensing models? And how can these decisions be reconciled with requirements for agility, cost, and scalability?

At HMS, we examine these questions across five dimensions: control, compliance, scalability, cost, and speed of innovation. These dimensions form the framework within which architectural decisions can be structured and prioritized.

In this blog post, we present the five dimensions of our approach. Using selected projects as examples, we show how companies have worked with HMS to develop solutions that are sustainable over the long term. In doing so, we took each client’s specific circumstances into account and developed tailored approaches.

Many organizations begin their architectural planning with the desire for maximum control over their IT infrastructure. They want to determine for themselves where data is stored, in what format it is available, how it is processed, and what software is used. This sovereignty over systems lays the foundation for compliance: Only those who retain technical control can consistently and transparently implement data protection, audit-compliant processes, and regulatory requirements. Control here means not only physical control over systems but also the ability to manage access at a granular level—for example, through identity and access management, secrets management, and policy enforcement. The more clearly these mechanisms are embedded internally, the greater an organization’s technological independence.

Compliance, in turn, encompasses far more than adherence to legal requirements: it also includes internal corporate security policies, auditability, and the complete traceability of data flows. In regulated industries, compliance has long been a prerequisite for operating in the market—for example, under ISO 27001, DORA, or NIS2. But control and compliance come at a price. Those who operate systems entirely on their own must not only provide infrastructure and specialized personnel but also bear the responsibility for keeping systems up-to-date, secure, and available. These tasks are essential, but they tie up resources—such as those needed for building and retaining in-house expertise—which are then no longer available for the development of new products, services, or analyses.

On the other hand, there is often a need for scalability and availability: the ability to flexibly scale compute and storage resources up or down, distribute systems geographically, and ensure global access with consistent performance. Hyperscalers offer this almost “out of the box”—with data centers distributed worldwide, built-in redundancy, automatic failover, and contractually defined service levels (SLAs).

Those who operate everything themselves, on the other hand, must ensure high availability independently—for example, through backup sites, emergency power supplies, replication, and disaster recovery. This is possible, but it is expensive and complex. This highlights a key tension: The more control an organization wants to retain, the greater the effort required to achieve a comparable level of resilience and elasticity to what cloud providers deliver as standard.

There are also significant differences in costs between cloud and on-premises solutions: In the cloud, costs can rise quickly if services are poorly configured. On-premises solutions, on the other hand, require high initial investments in hardware, licenses, and personnel. However, the ongoing costs are usually easier to plan and control.

In both cases, it’s worth considering the entire lifecycle. In addition to visible infrastructure costs, hidden expenses also play a role—such as those for training, integration projects, or legal advice on data protection issues. A thorough total cost of ownership analysis is therefore essential.

When it comes to the speed of innovation, the cloud usually offers clear advantages: ready-made platforms, tools, and AI models make it possible to implement new ideas often within just a few days. On-premises solutions, on the other hand, usually require in-house development, which entails longer lead times—but results in fewer dependencies on external providers.

However, the speed of innovation depends not only on the technical infrastructure but also on how the development process is organized within the team. Continuous integration, continuous delivery, platform capabilities, and standardized interfaces facilitate the integration of new technologies. This continuous, iterative process plays a decisive role in determining how quickly and innovatively an organization can act in the market.

These areas of tension clearly show that no single architectural approach can meet all requirements at the same time. Many of these dimensions are in conflict with one another, while others are interdependent.

Greater control can strengthen compliance, but at the same time significantly slow the pace of innovation. The pace of innovation and scalability usually go hand in hand—yet those who push for innovation may find themselves at odds with regulatory requirements. Strict compliance requirements can reduce the pace of change.

Those who design robust architectures can never fully resolve these conflicting goals. Rather, the challenge is to consciously balance them—in alignment with the organization’s strategic goals and the specific conditions within which it operates. These include, among other things, available budgets, technical and organizational expertise, regulatory requirements, industry-specific standards, and management’s risk tolerance.

Only when strategy and context are given equal consideration can a sustainable and realistic architecture emerge. This is precisely where HMS’s consulting approach comes into play: We systematically map an organization’s individual requirements onto the five dimensions and derive clear priorities from them. We then work with our clients to shape decisions in a way that ensures they are viable today while also enabling future developments.

In practice, three basic models have emerged that organizations can use to address the trade-offs between control, compliance, scalability, costs, and the pace of innovation:

1. On-premises is the traditional approach for those who want to retain maximum control over their systems. Operations take place in the organization’s own data center under full control. This model offers the highest level of control and can meet the strictest compliance requirements—but it does not scale to the same extent as offerings from traditional hyperscalers, requires high initial investments, and often slows down the pace of innovation.
2. The EU cloud represents the middle ground. Providers such as STACKIT, Open Telekom Cloud, or Hetzner are subject to European law and offer a solid service portfolio, though one that is not comparable in scope to that of U.S. hyperscalers. Services in EU clouds have a less global reach but are more flexible and faster than systems operated purely on-premises.
3. U.S. hyperscalers stand for maximum scalability and a high pace of innovation. New technologies are often widely available here first, the cloud ecosystem is highly mature, and the infrastructure can be expanded with comparatively little provisioning effort. In return, organizations relinquish a significant amount of control and sometimes find themselves in a additional data protection and compliance considerations—especially in regulated industries.

None of these options is inherently better or worse. They serve as waypoints on a map where each organization must chart its own course—depending on which specific aspects are priorities for it.

Sovereign cloud offerings can be a complementary option in certain scenarios. These are specialized offerings from global cloud providers that work with European data trustees or ensure EU-only operations. The goal is to combine the scalability and service portfolio of international hyperscalers with local sovereignty. In practice, these models have not been widely adopted so far, but they can be useful when regulatory requirements are the top priority and, at the same time, the service portfolio and convenience of a U.S. hyperscaler are needed.

Hybrid architectures remain a proven approach: critical workloads remain on-premises, while individual projects utilize cloud resources. This allows for the balance specific trade-offs without completely relinquishing one’s own sovereignty.

Every IT architecture emerges from its specific context. In the following, we use case studies to illustrate how companies, under a wide variety of conditions, have set priorities, weighed different decision-making factors against one another, and selected technologies. HMS has advised these organizations and supported them as an implementation partner—not with off-the-shelf solutions, but with architectures designed for their specific requirements.

This case illustrates two contrasting approaches: on the one hand, maximum autonomy through a stack operated entirely on-premises; on the other hand, rapid innovation through the use of existing cloud infrastructures.

Example A: A Financial Institution’s Sovereign Chatbot

Initial Situation / Context

A major European financial institution wanted to make internal documents searchable using generative AI. The key requirement was that confidential information must never leave the organization. Compliance and control were top priorities.

Solution Approach

• A fully on-premises architecture running on the institution’s own OpenShift cluster.
• All components—document parser, vector database, language model—ran in isolation.
• Only open-source components such as Weaviate, MLflow, and Open WebUI were used.

Results & Trade-offs

• Full control, maximum traceability, and comprehensive documentation of all data flows.
• Enormous operational complexity. Operation required an interdisciplinary team with expertise in GenAI, MLOps, and traditional infrastructure.

Example B: Accelerating Innovation with Azure

Initial Situation / Context

An industrial conglomerate was also planning to introduce a chatbot to tap into internal knowledge sources—in this case, over 500,000 research reports. Unlike the financial institution, the company already had a large Azure data platform that was well integrated into existing business processes. The focus was on rapid integration into the existing infrastructure.

Solution Approach

• Integration of Azure OpenAI Services into the existing infrastructure.
• Seamless integration into existing research tools.

Results & Trade-offs

• A production-ready chatbot was available within a few weeks.
• Some of the data was migrated to the cloud, increasing technological dependence on Azure

This case illustrates how differently organizations address the trade-offs between cost, scalability, and regulatory requirements—ranging from a minimalist lakehouse to a highly scalable real-time platform.

Example C: A Minimalist Lakehouse

Initial Situation / Context

A financial institution was subject to strict regulatory requirements and placed the highest priority on digital sovereignty. The goal was to build a robust data platform that remains compliant with regulations while still being future-proof.

Solution Approach

• Building a lakehouse based on an SQL-first approach, open-source technologies and open standards (Apache Arrow, Parquet).
• Data is stored exclusively within the organization’s own cluster.
• Containerized workflows to to simplify future migrations.

Results & Trade-offs

• A robust, scalable platform that meets regulatory requirements.
• Less convenience and speed compared to large platform services.

Example D: Real-Time at the Production Plant

Initial Situation / Context

A manufacturing company wanted to process production data in real time to optimize processes. The focus here was on the speed of innovation and scalability.

Solution Approach

• Use of Azure Databricks in combination with Apache Kafka.
• Integration with existing Azure services for seamless workflows.

Results & Trade-offs

• Virtually unlimited scalability, rapid prototyping of AI models, and a high pace of innovation.
• Significantly higher operating costs for streaming, storage, and compute, as well as an increasing dependence on Azure.

The case studies make it clear: There is no single “right” architecture. Each decision reflects a different priority:

1. The financial institution opted for maximum control and compliance.
2. The industrial conglomerate prioritized the speed of innovation.
3. The second financial institution focused on future-proofing and portability.
4. The manufacturing company optimized for performance.

All solutions are valid—because they take the respective context into account and are consistently aligned with the organizations’ value chains.

Digital sovereignty does not arise from dogmatic technology decisions, but rather from multifaceted considerations. In this article, we have presented five dimensions for making decisions in a structured manner: control, compliance, scalability/availability, costs, and speed of innovation.

Our case studies show that sovereignty does not mean maximum independence, but rather the freedom to make informed choices. Every architecture entails dependencies—what matters is that these dependencies are understood and deliberately managed and aligned with the organization’s strategic goals and the broader context. Those who understand the conflicting goals and clearly define priorities can design architectures that are viable today while remaining open to future developments.

This is precisely where HMS comes in: We support organizations in transparently mapping their requirements, setting the right priorities, and developing architectures that balance security, speed, and long-term adaptability—creating a practical basis for digital sovereignty.