Digital Sovereignty in the National Context: A Multi-Axis Strategic Framework

Key finding: Cloud providers should not be the issuers of encryption keys for sovereign data. Key sovereignty is the linchpin — without it, all other sovereignty investments (data residency, local operations, domestic ownership) can be nullified by a single subpoena or insider attack.

Introduction: Digital Sovereignty as a Strategic Imperative

In the 21st century, national sovereignty extends beyond physical borders into the digital realm. Just as control over territory underpins political independence, control over data and digital infrastructure underpins technological independence. Cloud computing and artificial intelligence (AI) have become as critical to a nation's survival and prosperity as energy grids or defense systems.¹ For modern nation-states, achieving digital sovereignty — the ability to govern and protect digital assets without external interference — is not optional but a strategic imperative. It determines who controls, monitors, and can access a nation's information.

Critically, digital sovereignty is not a binary state but a multi-layered continuum.¹ Policymakers must understand the interplay of legal, operational, and technological factors to build a coherent sovereignty strategy. This paper outlines the parameters of digital sovereignty in a national context, defining its key dimensions and describing a multi-axis, multi-level framework for implementation. AI is treated as the central axis of analysis — the lens through which all sovereignty challenges and opportunities are focused. The defence sector provides the ultimate test case, demanding the highest levels of sovereignty for national survival. By examining global case studies — from France's SecNumCloud to Germany's C5 and Europe's Gaia-X — we illustrate how nations are pursuing sovereign cloud and AI strategies.

Defining Digital Sovereignty: Key Dimensions

Traditional sovereignty is the exclusive right of a state to govern itself without external interference. Digital sovereignty applies this principle to the digital sphere. It can be understood across four interrelated dimensions:¹

• Jurisdictional Sovereignty. All data, digital services, and infrastructure are subject to the country's laws and jurisdiction, with no competing extraterritorial control. Foreign laws (such as another nation's cloud access laws) have no reach into domestic data. Legal mechanisms protect against foreign subpoenas or orders.
• Technological Sovereignty. The nation possesses the domestic capacity to develop, operate, and control critical digital technologies (cloud stacks, AI models, encryption tools) without undue reliance on foreign vendors. Domestic companies should own or govern cloud infrastructure and key software, preventing vendor lock-in by foreign tech.
• Operational Sovereignty. The country can manage and run its digital operations entirely on its own soil and by its own people. Key administrative roles are staffed by nationals accountable to domestic authorities. Networks, servers, and security operations are monitored and controlled from within the country, 24/7. There are no hidden "backdoors" or remote root access for foreign engineers.
• Economic Sovereignty. The domestic digital ecosystem (cloud providers, data centers, AI industry) generates value, jobs, and innovation for the national economy. This includes nurturing local tech companies and ensuring that investments in cloud/AI benefit domestic interests. Redundant infrastructure distributed within national borders ensures continuity during crises.

These dimensions overlap in practice. A country might localize its data (achieving jurisdictional control) but still lack technological sovereignty if the underlying cloud software is foreign-owned. Conversely, a nation might develop indigenous technology yet outsource operations to foreign firms, undermining operational control. True digital sovereignty requires progress on all fronts — legal, technical, operational, and economic — to eliminate single points of dependency.

The Multi-Level Sovereignty Continuum

Because sovereignty is not all-or-nothing, it is useful to think in terms of levels. This paper uses a five-level continuum (Level 1 through Level 5) to characterize the progression from minimal to full sovereignty.¹ Each level represents a deeper integration of sovereignty principles into cloud/AI infrastructure.

Level 1 — Data Residency

Data is stored on servers physically located within the country's borders. This level addresses geographic data location but not who owns or operates the infrastructure. Often, Level 1 involves using a global cloud provider's regional data center. Suitable for low-sensitivity information (e.g. public websites, open data portals). Risks: the service may still be owned by a foreign company and subject to foreign laws or subpoenas (e.g. U.S. CLOUD Act), and administrators could have remote access from abroad.

Level 2 — Controlled Residency

Both data storage and processing occur within national borders. Encryption keys are managed domestically. Cloud services comply with local security certifications. Suitable for moderate-sensitivity workloads such as internal administrative systems (payroll, procurement). Risks: the underlying infrastructure or software may still be foreign-owned, and legal exposure to foreign jurisdictions persists if the provider's parent company is overseas.

Level 3 — Legal and Operational Sovereignty

The service provider is a legal entity domiciled in-country and exclusively subject to national law. All operations and support are performed by locally based staff. Regulators have full audit rights and oversight. Often referred to as a "trusted cloud." Appropriate for sensitive personal data (health records, citizen ID databases). Risks: the country may still rely on foreign-developed technology or core intellectual property. If critical software updates come from abroad, there is residual dependency.

Level 4 — Technological Sovereignty

A domestic entity owns and operates the entire cloud stack — infrastructure, middleware, orchestration software — within the country. Foreign "root access" is eliminated. Critical intellectual property is either developed domestically or licensed in a way that the nation can maintain and govern it independently. Open standards ensure interoperability. Suitable for mission-critical workloads such as financial systems, power grid controls, or large-scale AI training on sensitive data. Risks: achieving Level 4 is expensive and technologically challenging, requiring significant R&D investment and a mature domestic tech ecosystem.

Level 5 — Full Sovereign Cloud

The cloud infrastructure, hardware, software, and operations are 100% owned and controlled by domestic institutions. All staff are citizens (often with security clearances) and all governance is national. Even supply chain and physical facilities are under national control. Redundancy and resilience are built entirely within national borders. Reserved for the most sensitive domains — defence, intelligence, and strategic government AI systems — where any foreign dependency is unacceptable.

Key finding: The five-level sovereignty continuum (L1 data residency through L5 full sovereign cloud) gives policymakers a structured benchmarking tool: each workload maps to an appropriate level based on sensitivity, threat exposure, and value.

Few nations will attain Level 5 across all systems. Instead, countries must map each workload or dataset to the appropriate sovereignty level based on its sensitivity, threat exposure, and value. The five-level model provides a structured way to assess where stronger sovereignty measures are needed. It also serves as a benchmarking tool: policymakers can set targets (e.g. "all health data systems must reach at least Level 3") and identify gaps.

The Multi-Axis Blueprint for Sovereignty

While the five levels describe vertical progression toward full sovereignty, a comprehensive strategy is multi-dimensional. Sovereignty exists on multiple levels, across layers of responsibility, and along dimensions of data sensitivity. These interacting axes form a multi-axis blueprint for national digital sovereignty:

• Vertical Axis — Sovereignty Levels (1–5). The depth of sovereign control implemented, as described in the five-level framework. Higher levels impose stricter requirements on ownership, law, and operations.
• Horizontal Axis — Data Sensitivity Classification. Not all data requires the same level of sovereignty. General public content may only need Level 1 residency. Sensitive personal information (health, biometrics) might need Level 3 or 4. National security and defence data unequivocally demand Level 5, as do foundational AI models trained on sensitive national datasets.
• Overlay — Governance Maturity. Sovereignty is not just about technology and location; it's also about how well the environment is governed. Governance ranges from basic manual policies to advanced real-time, AI-driven compliance monitoring. A highly mature governance layer means any policy violations or security anomalies are caught and addressed in real time.

Visualizing these three axes together, one can imagine a sovereignty cube: the vertical axis of Levels 1–5, the horizontal axis of data sensitivity (from low to high), and the governance overlay from basic to real-time AI-driven. This multi-axis model allows policymakers to map every workload in the nation's digital landscape to an appropriate point in the cube. For example:

• National tourism website (public data): Level 1 with low sensitivity classification and minimal oversight. Basic residency satisfies sovereignty for this use case.
• Government hospital records system (sensitive personal health data): Level 3 with "sensitive" data classification and continuous auditing by regulators.
• Defence AI simulation platform (highly classified models and data): Level 5 with "national security" data classification and real-time AI-driven governance, where every component is under strict domestic control.

Coexistence of Sovereignty Levels in a National Architecture

No nation applies a single sovereignty level uniformly across all its digital domains. A layered ecosystem inevitably emerges, where different sectors and workloads operate at different points on the sovereignty spectrum:

• Public and Commercial Services (Levels 1–2). Prioritize cost efficiency and scalability over strict sovereignty. A municipal website or private e-commerce platform might use a local data center or a cloud with localized processing to meet basic data residency requirements.
• Government Administrative Systems (Levels 2–3). Internal government systems (tax, procurement, citizen services) target controlled residency and legal jurisdictional assurance. Governments increasingly mandate that cloud providers be domestically domiciled entities.
• Critical Infrastructure and Regulated Industries (Levels 3–4). Finance, energy, telecommunications, and healthcare require legal sovereignty and are moving toward technological control. These sectors often adopt hybrid models — domestic cloud providers leveraging global technology under license, but with local control provisions.
• Defence and Intelligence (Level 5). Military and intelligence networks are often completely separated ("air-gapped") from commercial networks and run on sovereign infrastructure operated by government agencies or cleared defence contractors. Any lesser level of sovereignty is considered an unacceptable risk.

This coexistence must be actively managed by national policy. Three principles are essential:

• Workload Allocation. Each government function or dataset is assigned to an appropriate sovereignty level based on risk assessment. A clear policy should dictate what level is required for various categories of data.
• Interoperability and Segregation. Different-level systems will interact, but the architecture must prevent "sovereignty leaks" — strong network segmentation, data diodes, and interface rules are required so that integration between levels does not dilute the security of the stricter environment.
• Unified Governance. A national governance framework must oversee this mosaic of systems. An overarching authority or policy regime sets the rules for all layers, ensuring new systems are slotted into the right sovereignty tier and continuously audited.

AI as the Central Axis of Digital Sovereignty

Artificial Intelligence lies at the heart of the sovereignty debate and serves as a unifying axis along which other challenges align. AI systems — especially advanced machine learning models — concentrate many of the issues of data control, technological dependency, and security into a single domain. If data is the new oil, AI is the engine that runs on it; controlling that engine is becoming as strategically important as controlling the data itself.

AI relies on massive data — often the most sensitive data a nation holds. Training state-of-the-art AI models requires huge datasets, which may include personal information, strategic intelligence, or proprietary business data. Data sovereignty is a prerequisite for AI sovereignty: a country must ensure that training data for national AI initiatives resides in-country and isn't siphoned off to foreign jurisdictions. The model weights themselves can become sensitive IP that the nation wants to protect.

AI processing demands advanced cloud infrastructure. Heavy reliance on foreign AI cloud services can create a strategic vulnerability: if a nation's AI capability is mostly running on foreign-owned cloud, that cloud provider (or their home government) could theoretically limit or surveil AI operations. Moreover, opaque updates to AI models by foreign providers could introduce biases or failures that the local nation cannot detect.

AI amplifies the consequences of losing control. A nation that cannot trust the integrity of its AI systems (because they run on black-box platforms outside its oversight) risks everything from malicious manipulation of AI outputs to dependency on external providers for critical services. On the flip side, achieving sovereign AI capability yields a significant strategic edge. The concept of "Sovereign AI" has emerged: meaning AI that is developed and run within a country's own borders on infrastructure under local control.⁴

AI in defence makes sovereignty a matter of national security. Autonomous drones or decision-support AIs used by the military — if those rely on an external cloud or foreign software updates, an adversary could degrade or sabotage them at a critical moment. Defence-related AI projects often require Level 5 sovereignty. Sovereign AI is not a luxury, but the last line of defence in a crisis.

Given these factors, AI acts as a stress test for a nation's digital sovereignty framework. For a country like Canada, ensuring sovereignty in AI could involve: investing in domestic AI supercomputing infrastructure, securing supply chains for critical AI chips, promoting local AI software ecosystems, and enacting regulations that mandate certain AI training data never leaves the country.

Defence Sector: The Ultimate Sovereignty Use Case

National defence exemplifies the highest stakes for digital sovereignty. Defence organizations were among the first to recognize the risks of foreign-controlled technology. In the context of cloud and AI, defence requirements effectively set the bar — if the framework can satisfy defence, it will likely satisfy less critical sectors.

• Extreme Sensitivity. Military data and defence AI models are often classified at the highest levels. They demand Level 5 sovereignty — absolute national control. Defence clouds ensure all servers are in-country on military bases or secure facilities, all administrators are citizens with clearances, and no foreign-built networking equipment with potential backdoors is present.
• Continuity Under Duress. A defence cloud must operate through crises — including wartime — when international connectivity might be cut. This drives a need for fully sovereign, domestically routed networks and redundant data centers. If a conflict arises, foreign technicians cannot be relied on to fix systems.
• Cybersecurity and Threat Model. Defence systems are prime targets for nation-state cyberattacks. Sovereign defence infrastructure can be hardened under national standards, and vetted by national security agencies continuously. Sovereignty grants agility in cyber defence — the freedom to tailor and secure systems on one's own terms.
• Integration with National Industry. Many governments leverage defence procurement to build up local cloud and AI capabilities. Defence projects sometimes spin off into broader sovereign cloud offerings for other sectors.

Defence sovereignty must coexist with coalition operations (e.g., NATO, NORAD). Allies need to share data securely, which implies interoperability between sovereign clouds. The solution lies in multilateral frameworks and trust federations where each nation controls its node but participates in a shared infosphere by consent. Canada's strategic lens here would be ensuring sovereign control over its systems, yet remaining fully interoperable with US and other Five Eyes partners for combined operations.

The defence sector encapsulates the maximum requirements of digital sovereignty. Policymakers should treat defence as a bellwether: when designing national digital sovereignty policies, ask "Would this be acceptable for our military and intelligence needs?" If not, then it likely falls short of true sovereignty.

Encryption and the Chain of Trust

One critical theme in any sovereignty strategy is encryption — specifically, who controls the cryptographic keys that safeguard data. Encryption is the linchpin of data security: even if infrastructure is compromised, properly encrypted data remains confidential. However, encryption is only as strong as the "chain of trust" that underpins it.

For a sovereign cloud or AI environment, it is imperative that the issuer and holder of encryption keys be under domestic control. The cloud provider — especially if it's a foreign company — should not be the entity generating or managing the customer's master keys. Instead, keys must be generated, stored, and administered by a trusted national entity.⁶

Three principles underpin this requirement:

• Extraterritorial defence. If a cloud provider holds the encryption keys to government data, that provider effectively has access regardless of where the servers sit. The U.S. CLOUD Act can require U.S.-based cloud firms to produce data even if stored abroad — but if the foreign government holds the only keys, the provider cannot decrypt the data to comply. Key sovereignty is a defence against extraterritorial legal reach.
• External key management. Best practice is an external key management system, meaning key generation and storage occur outside the provider's environment. The keys might reside in a government-owned Hardware Security Module (HSM) or a domestic third-party escrow. This ensures that even insiders at the provider cannot secretly access the data.⁶
• Auditability. Holding keys domestically enables stronger auditability. National auditors can verify the key management processes without relying on a foreign company's attestations. National cryptographic authorities can set standards to maintain trust in the whole chain.

A breach in key sovereignty can nullify all other sovereignty measures. Even a Level 5 sovereign cloud where all data is in-country, under domestic operations — if the master encryption keys were created by the cloud software vendor and stored on its systems, that would be a single point of failure.

In policy terms, governments can enforce this by regulation: "All sensitive government data stored in the cloud must be encrypted with keys that are generated and stored within government-approved key management systems located on national soil. Cloud vendors shall have zero knowledge of or access to these keys."

The Integration Challenge and the Need for an Orchestrator

Achieving digital sovereignty is not solely a technical feat — it is largely an integration challenge. Many of the individual components required for sovereignty exist: on-premise servers, open-source cloud software, domestic fibre networks, locally developed AI models, national encryption tools. The harder part is making all these independently developed systems work together as a seamless, secure, and scalable national platform.

The Orchestrator Role. This refers to an entity (or coordinated group) responsible for bringing together all the sovereign components and operating them as a service for government and critical industries. The orchestrator could be a government agency or a consortium of trusted domestic companies working under government mandates. Their tasks include: integrating networking with data centers; ensuring the cloud management software, identity systems, and encryption services interoperate; managing updates and patching across the stack; and providing a unified interface and support structure to users.

It is vital to distinguish the orchestration function from the oversight/audit function. To maintain trust, three roles must be structurally separated:

• The orchestrator operates and integrates the sovereign cloud according to agreed policies.
• An independent audit body (for instance, the national cybersecurity agency or a dedicated regulator) continuously monitors the operations for any deviation from policies, security breaches, or compliance failures.⁵
• Suppliers (hardware makers, software developers) simply provide components. They should not audit themselves, nor operate critical systems without oversight.

Key finding: The orchestrator and auditor must be structurally separated. The entity operating sovereign infrastructure cannot be the one certifying its own compliance — independent real-time auditing is essential for trust.

From a policy perspective, establishing these roles requires clarity: define which organization(s) will act as the sovereign cloud orchestrator; empower a regulatory audit body with resources and authority to perform continuous oversight; and clarify supplier roles with mandated open standards and full transparency.

The integration challenge is not only technical but also organizational. Sovereign clouds need skilled cloud architects, cybersecurity experts, AI engineers, and administrators who are citizens and potentially security-cleared. A sovereignty policy should include workforce development: training programs, competitive salaries to attract talent from big tech, and perhaps a "national cloud academy." Without the people to run it, even the best designed sovereign cloud will fail.

International Case Studies and Global Context

Around the world, governments are experimenting with policies and frameworks to reclaim digital sovereignty. While each country's approach varies, common themes include data localization, domestic oversight, and national certification of cloud services.

France — SecNumCloud and "Cloud de Confiance"

France has been a front-runner in asserting cloud sovereignty through its SecNumCloud certification scheme. Administered by the national cybersecurity agency ANSSI, SecNumCloud sets stringent requirements for a cloud provider to be deemed "trusted" for sensitive French data.² The latest criteria effectively bar foreign-controlled clouds from qualifying. Requirements include: localizing all customer data in the EU; ensuring all operations are conducted by EU-based personnel; and imposing ownership constraints where non-EU shareholders cannot hold more than 25% individually (and 39% collectively) of the provider.²

France's approach establishes clear sovereignty guardrails. Canada, sharing values of rule-of-law with France, can study the SecNumCloud criteria as a possible template for defining our own "trusted cloud" standards.

Germany — BSI C5 and Sovereign Cloud Stack

Germany's approach focuses on security and compliance through the C5 (Cloud Computing Compliance Criteria Catalogue) developed by the Federal Office for Information Security (BSI). C5 is an auditing framework ensuring cloud providers meet over 100 security controls aligned with German requirements.³ Compliant cloud services process data exclusively in German data centers in accordance with German law.

Beyond C5, Germany has invested in the Sovereign Cloud Stack (SCS) initiative — an open-source cloud technology stack aimed at providing a European alternative to hyperscalers. SCS reduces reliance on any single vendor by offering a standardized blueprint for a sovereign cloud. Germany's case illustrates a standards and open-source-led path to sovereignty.

Gaia-X — A European Federated Cloud Ecosystem

Gaia-X is an EU-born project (initiated by France and Germany in 2020) with the ambitious goal of creating a federated, interoperable data and cloud infrastructure for Europe.⁷ It is not a single cloud provider, but rather a framework and set of standards to enable many providers to interconnect, with common rules ensuring transparency, data sovereignty, and interoperability.⁸

Gaia-X has been motivated by bolstering European digital sovereignty and reducing dependency on foreign cloud dominance.⁷ Instead of one EU government cloud, it envisions many clouds linked by common standards, giving users choice and avoiding lock-in to any one vendor or jurisdiction.

Other Approaches

The United Kingdom follows a classification approach where highly sensitive government systems run on fully sovereign infrastructure, while emphasizing supplier diversity and UK legal control. The United States enjoys de facto digital sovereignty since its companies dominate the cloud market, focusing on securing its supply chain and creating isolated government cloud regions. China and Russia exemplify the extreme end of sovereignty, where the state exerts tight control over digital infrastructure — demonstrating the feasibility of near-total self-reliance, albeit at high cost and isolation.

Nations must weigh three fundamental trade-offs:

• Cost vs. Control. Full sovereignty can be expensive. Many adopt a hybrid approach: high sovereignty for the crown jewels, commercial clouds with safeguards for less critical needs.
• Innovation vs. Autarky. There's a risk that in trying to be sovereign, one isolates from global innovation. Sovereign solutions should plug into global knowledge networks via open standards.
• Alliances vs. Autonomy. Allies need each other, especially countries like Canada that are part of defence and intelligence coalitions. Sovereignty efforts must not cripple beneficial data sharing and interoperability.

Strategic and Policy Considerations

Crafting a national digital sovereignty strategy requires high-level policy abstraction coupled with practical implementation plans.

Develop a Sovereignty Classification Framework. Clearly define what types of data and systems require which level of sovereignty. Classify data into tiers and map those to sovereignty levels. This policy should be transparent so that all agencies and critical operators know the expectations.

Mandate Sovereignty Levels for Critical Sectors. Through legislation or directives, ensure critical infrastructure sectors and government departments adhere to minimum sovereignty requirements. Mandate that all federal government cloud usage be at least Level 3 by a certain date, with higher levels for national security agencies.

Build or Designate a Sovereign Cloud Orchestrator. Choose the model for who will integrate and operate sovereign infrastructure. This might entail funding a new Crown corporation for digital infrastructure or expanding Shared Services Canada. Government should be prepared to invest seed capital to make this viable.

Empower Independent Oversight. Create a dedicated Digital Sovereignty Commission or expand the mandate of CSE (Communications Security Establishment) to continuously audit and certify compliance of cloud services. This body should report to a high authority on the state of sovereignty periodically, highlighting any weaknesses.

Leverage Allies and Multi-Level Sovereignty. Coordinate with allies on standards and mutual recognition. Work within Five Eyes to develop a "sovereign-by-design" approach that still allows selective sharing. Assert Canada's needs: in alliances, push for agreements that respect each nation's data control.

Invest in Domestic Capacity. Use sovereignty to catalyze the national tech industry. Policies can include incentives for local cloud startups, grants for developing sovereign AI tools, and support for SMEs that fill niches in the sovereignty stack. Public procurement becomes a lever: by choosing domestic providers that meet sovereignty criteria, government becomes a lead customer.⁵

Conclusion: Sovereignty as a Strategic Asset

Digital sovereignty is not a one-time achievement but a continuous endeavour — a dynamic equilibrium that must be actively managed in the face of evolving technology and threats. It requires navigating trade-offs and making strategic choices, but the rewards are immense. A nation that masters digital sovereignty secures not only its data and systems, but also its digital future — ensuring that innovation benefits the country and aligns with its values.

Canada's pursuit of digital sovereignty should be seen as foundational to our national security and prosperity in the 21st century. It is a proactive measure, preparing us for a world where data is weaponized and technology leadership defines power. By establishing multi-layered sovereignty across jurisdictional, operational, technological, and economic dimensions, and by integrating those layers via a multi-axis national blueprint, Canada can ensure it remains the author of its own digital destiny.

Ultimately, just as independent nations harness their sovereignty in the physical domain for collective good, we can harness digital sovereignty to create a secure, vibrant, and self-determined digital nation. The journey will be complex — requiring orchestrating technologies and policies, investing in people, and cooperating with allies — but the destination is clear: a Canada that stands tall in the digital world, with its values upheld and its interests protected, come what may in the global tech landscape.

Notes

1. Cloud Sovereignty Framework (confidential framework document outlining levels and dimensions of cloud sovereignty).
2. ITIF, "France's Cloud Service Restrictions," 2025.
3. StackIT, "German C5 Standard," 2023.
4. Broadcom, "Local Rules, Local Clouds: Sovereign AI," 2025.
5. BCG, "Sovereign Clouds Reshaping National Security," 2025.
6. Cloud Security Alliance, "Sovereignty in the Cloud," 2023.
7. Polytechnique Insights, "Gaia-X: A Bid for a Sovereign European Cloud," 2025.
8. Gaia-X Official Site, mission and overview statements.
9. Cloud Security Alliance Blog, "Data Sovereignty" (Thales CPL reference on encryption keys).
10. Additional sovereignty framework excerpts (multi-axis model, challenges, roadmap elements).