Not 'Where' but 'Who Controls It': In Enterprise AI, Sovereignty Splits From Residency

The subtlest distinction in enterprise AI in 2026: data residency (where it is stored) is not the same as data sovereignty (who legally controls it). Using an American cloud provider's European data center does not give you sovereignty under EU law.

Why the CLOUD Act matters

Storing data in a European data center owned by a US company can still expose you to the CLOUD Act: whether a US court can reach data held by an EU subsidiary of a US parent is a fact-dependent jurisdictional question that remains legally unresolved. 'It sits in Europe' is not the same as 'European law protects it.'

Regulation and where the market is going

• EU AI Act: most obligations apply from August 2, 2026; Article 10 requires data-governance documentation for high-risk systems. Fines up to €35M or 6% of global turnover.
• Gartner expects European sovereign cloud IaaS spending to jump from ~$7B in 2025 to more than $12B in 2026 — nearly doubling in a single year.
• The trend: keep inference inside EU jurisdiction, minimize retention, and run air-gapped when policy demands it.

Architecture, not contract

The key principle: data residency is enforced by architecture, not promised by contract. Building a stack where you can prove what happens to data at every step is a far more defensible position than 'we trust them.'

The remot angle

remot is an orchestration layer that decides, by policy, which request goes to which model and which region. It enforces data routing, masking and logging from a single point, so sovereignty and residency become an auditable part of the flow rather than a bolt-on compliance patch.