AI Risk: Identity Governance Trumps Sovereign Cloud

European enterprises found that sovereign cloud alone did not provide the control they expected for AI workloads. Many discovered the real control point was elsewhere. This is a key lesson for US security leaders as they face similar questions about AI strategy. European companies, especially in finance, infrastructure, and manufacturing, have spent two years migrating workloads and renegotiating contracts due to regulations like DORA and NIS2. Hyperscalers like AWS, Microsoft, and Google have responded with their own sovereignty offerings. US enterprises are now facing comparable pressures from SEC rules and CISA guidance. The conversation among practitioners at a recent conference shifted from sovereign cloud architecture to AI security and identity management. This indicates that identity governance, not just sovereign cloud, is crucial for managing AI risk.