IBM unveils tool to track sovereignty risks for cloud workloads

IBM launched a tool to help customers assess cloud-sovereignty risks and meet regulatory compliance requirements, as 93% of executives believe sovereignty must be part of their business strategy. The Sovereignty Risk Profile allows users to set policies on data residency and encryption, track requirements in real time, and evaluate workload compliance. The tool, available within IBM’s Security and Compliance Center Workload Protection, addresses growing concerns about data location and regulatory adherence amid complex sovereignty challenges.

IBM has launched a tool designed to help customers assess cloud-sovereignty risks and meet regulatory compliance requirements. The Sovereignty Risk Profile launch comes as digital sovereignty becomes a higher priority for organizations concerned about where data is stored and processed https://www.computerworld.com/article/4129552/gartner-european-spending-on-sovereign-cloud-iaas-to-nearly-double-in-2026.html . According to an IBM survey https://www.ibm.com/thought-leadership/institute-business-value/en-us/report/ai-orchestration-layer , 93% of executives believe sovereignty needs to be part of their business strategy. Via the new tool, customers can set up policies related to regulatory and business requirements — such as where data resides and how it’s protected, for instance. These policies can be applied to specific cloud workloads, regions, or zones in the Sovereignty Risk Profile tool, allowing users to track sovereignty requirements “in real time,” IBM Cloud product manager Janet Van said in a blog post https://community.ibm.com/community/user/blogs/janet-van/2026/05/27/sovereignty-risk-profile-scc-workload-protection , with “visibility into configurations, encryption posture, and environmental controls.” It’s then possible to assess compliance and decide what workloads meet sovereignty requirements. Tracking the factors that contribute to sovereignty is a challenge for many organizations, said Holger Mueller, vice president and principal analyst at Constellation Research. “It is very difficult, as you don’t know about the details of the stacks; sometimes, even the location of data is not fully transparent,” he said. The Sovereignty Risk Profile “addresses many of the compliance-related requirements associated with data residency and encryption, while also tackling sovereignty from a resilience and concentration-risk perspective,” said Dario Maisto, senior analyst at Forrester. However, the monitoring tool can only do so much to address digital sovereignty concerns, he said. While it can help organizations identify and report on potential issues, it “does not help make clients more or less sovereign, per se: it has only the potential to tell that a sovereignty problem is there.” Broader questions around digital sovereignty remain difficult to address, he said, as there’s no universally accepted definition of the concept and limited legislation to establish clear requirements. Mueller described a spectrum of sovereignty issues that depend on factors such as whether data is stored, processed, and backed up in a customer’s own country, as well as whether staff that operate the data are domestic nationals. “Then there is the sovereignty of the software supply chain — but here everybody is dependent,” he said. To further complicate matters, while several US hyperscalers sell sovereign-branded cloud services to European customers — with local staff and infrastructure — concerns remain about the potential for extra-jurisdictional access to data, due to the US CLOUD Act and the US Foreign Intelligence Surveillance Act FISA . The Sovereignty Risk Profile is available within IBM’s Security and Compliance Center Workload Protection. It’s the latest in a range of IBM Cloud products aimed at addressing customers’ sovereignty concerns https://newsroom.ibm.com/2026-05-05-think-2026-ibm-makes-digital-sovereignty-operational-with-general-availability-of-ibm-sovereign-core , including the recently launched IBM Sovereign Core software platform https://www.networkworld.com/article/4117292/ibm-pushes-sovereign-computing-with-a-software-stack-that-works-across-cloud-platforms-2.html .