State of Confidential AI 2026: $9.31B → $15.15B, 8.5% CAGR, and the Rise of Geopatriation

Five years ago, “sovereign cloud” was a French and German procurement preference and an analyst footnote. In 2026 it is a sized market, a Gartner emerging trend, and a regulatory event with a calendar date. This piece is a primary-source synthesis of where confidential AI stands in the middle of 2026, what the numbers say, what the drivers are, what the technical stack looks like, and what to do about it if you are buying or building AI infrastructure in a regulated EU sector.

The shortest possible summary: the market that did not exist in 2018 is worth ~$9 billion in 2024 and projected to grow to ~$15 billion by 2030, the European sovereign AI category specifically attracts an estimated €1.5 trillion in cumulative spend through the end of the decade, and the regulatory and geopolitical drivers are structural rather than cyclical. Gartner has given the trend a name, Geopatriation, and the technical stack to support it (Intel TDX, NVIDIA Confidential Computing, OpenAI-compatible APIs from EU controllers) has reached production maturity at the same time as the August 2026 EU AI Act deadline. That alignment is what makes this an inflection year rather than another sovereign-cloud announcement cycle.

Market sizing, what the primary sources actually say

Three syndicated reports anchor the numbers buyers reference in 2026. Mordor Intelligence sizes the sovereign cloud market at USD 9.31 billion in 2024, projecting USD 15.15 billion by 2030. The driver mix in the Mordor report is fairly evenly split between regulated industries (financial services, healthcare, public sector) and geopolitically exposed multinationals revisiting their cloud exposure to US-parent providers after the CLOUD Act and FISA 702 became persistent talking points in European tenders.

Forrester publishes a narrower estimate for European sovereign AI specifically, €1.5 trillion in cumulative spend through 2030. The category includes infrastructure (compute, storage, networking), platforms (vector stores, orchestration, agent runtimes), and applications (regulated industry agents, sovereign copilots). Forrester treats AI separately from generic sovereign cloud because the AI-specific compliance overhead, model cards, transparency notices, EU AI Act documentation packs, is itself a market driver that pulls procurement into the sovereign category even for buyers who would otherwise be comfortable with hyperscaler EU regions.

Read the growth rate with care. USD 9.31 billion in 2024 to USD 15.15 billion in 2030 is 62.7% growth in total over six years, which is 8.5% CAGR (compound annual growth rate): (15.15 / 9.31)^(1/6) - 1 = 8.45%. Correction, 27 October 2026: an earlier version of this article presented that 62.7% total as the annual growth rate of the confidential AI sub-segment. It is the cumulative growth of the whole sovereign cloud market over 2024-2030, not a yearly rate, and not a figure for the sub-segment.

The confidential AI sub-segment, workloads running inside Intel TDX, AMD SEV-SNP or equivalent TEEs with attestation, is the line item inside the sovereign cloud category where VoltageGPU sits. The confidential layer requires specific hardware and provider posture; supply is concentrated, and the per-workload contract value is higher than commodity inference.

For context, the same period saw the global generative AI market itself grow from roughly $40 billion in 2024 toward an analyst-consensus $200-300 billion by 2030. The confidential AI slice is small in absolute terms, and none of the figures above sizes it on its own.

Geopatriation, the term Gartner introduced

Gartner added Geopatriation to its emerging-trends taxonomy to describe a structural shift in cloud procurement: workloads moving back from globally distributed providers, typically US-parent hyperscalers, to sovereign regional clouds whose controlling legal entity is incorporated in the customer's regulatory zone. The term is deliberately distinct from the 2018-2022 cloud repatriation discussion.

Cloud repatriation in the 2018-2022 sense was a cost discussion. Buyers ran a TCO model against hyperscaler list price, decided that workloads in steady-state could run cheaper on bare-metal or colo, and moved them off. The buyer was the infrastructure team or FinOps, and the destination was typically on-premises or colocation.

Geopatriation is a jurisdictional discussion. Buyers run a legal exposure model against CLOUD Act, FISA 702, Schrems II, EU AI Act, DORA, NIS2 and SecNumCloud, decide that sensitive workloads cannot live in US-controlled inference, and move them to a sovereign regional cloud whose controller is incorporated in their regulatory zone. The buyer is the DPO, General Counsel and Audit Committee. The destination is a sovereign cloud, not on-premises.

The two trends share a verb (“move workloads back”) but the rest is different, drivers, buyers, destinations, success metrics. Confusing them leads to projects that optimise cost when the audit committee was worried about legal defensibility. The Geopatriation framing matters because it tells the project sponsor which department owns the decision and what the success criteria are.

Why 2026 is the inflection year, four compounding drivers

1. EU AI Act enforcement reaches existing models in August 2026. The Act phases in steps: February 2025 (prohibited practices), August 2025 (GPAI provider obligations on new models), August 2026 (the general date of application), August 2027 (GPAI models already on the market), and 2 December 2027 for the Annex III high-risk obligations, deferred by Regulation (EU) 2026/1744. European buyers consistently report that they prefer a European controller who can respond directly under EU law rather than escalating to a US headquarters. The deadline is a hard forcing function.

2. DORA has been mandatory since January 2025. The Digital Operational Resilience Act requires controllable processors, EU sub-processor chains, demonstrable resilience, an ICT third-party register, and an exit plan. The 2025-2026 enforcement cycle is forcing financial entities to redo vendor selection on AI workloads and prefer providers who can produce cryptographic evidence rather than vendor PDFs. We have written about this specifically in DORA Article 28 for AI vendors.

3. Schrems II remains structurally unresolved. The CJEU invalidated Privacy Shield in 2020. The 2023 EU-US Data Privacy Framework is under legal challenge and widely expected to be either invalidated or narrowed by the CJEU in the 2026-2027 window. Transferring personal data to US providers currently requires Standard Contractual Clauses plus a transfer impact assessment. An increasing number of European DPOs decline to sign that combination for sensitive workloads, privileged legal documents, patient records, financial models, public-sector data. The legal uncertainty pushes geopatriation up the priority list.

4. The technical stack reached production maturity simultaneously. Intel TDX 1.5 is shipping on Sapphire Rapids and Emerald Rapids. NVIDIA Confidential Computing is generally available on H100 and H200, with B200 rolling out through 2026. Attestation flows are documented by Intel and NVIDIA. And the OpenAI SDK accepts a custom base_url with no source code change. This last detail matters because the lock-in argument against moving off a US-parent provider no longer holds: SDK migration is a configuration change, not a rewrite.

Any one of these would push some workloads off US-parent inference. Together they make the trend structural rather than cyclical, and they line up around the August 2026 deadline as the natural cutover point.

What the technical stack looks like in 2026

Three layers, all production-ready.

Intel TDX (Trust Domain Extensions) handles the host enclave. Memory is encrypted with per-tenant keys managed in silicon. The hypervisor, host operator and cloud provider are excluded from the trust boundary. The TDX module produces a signed quote on demand, an attestation report that proves which Trust Domain image was loaded on which physical CPU, with a measurement (MR_TD) that pins the workload identity.

NVIDIA Confidential Computing on Hopper (H100, H200) and Blackwell (B200) handles the GPU side in the industry stack: trust-domain GPU passthrough encrypts the channel between the CPU and the GPU. Device memory is protected by hardware access controls, not encrypted. The GPU produces its own attestation report binding device identity to a customer-controlled key. Combined with TDX, this narrows what a privileged cloud operator can reach through software; on our inference API, our relay still sees the text.

Attestation binds the cryptographic evidence to the specific workload. A TDX quote carries the measurements of the trust domain and 64 bytes of report_data chosen by the caller, which can bind a nonce or the hash of an artifact. An auditor can replay the quote against Intel's and NVIDIA's public roots of trust without trusting the cloud provider or the customer. This is what shifts compliance from contractual posture to technical proof.

On top of this stack sits an OpenAI-compatible REST API. Chat completions, with streaming and function calling, accept the same payloads as the OpenAI API. Migrating an existing integration is a base_url and API key swap in the SDK code, not a rewrite. We covered the attestation flow specifically in our TDX attestation verification guide and the underlying technology in Intel TDX deep dive.

How hyperscalers are responding (and where they fall short)

Microsoft Cloud for Sovereignty, AWS European Sovereign Cloud, Google Cloud Sovereign Solutions, Azure Confidential VMs and AWS Nitro Enclaves are all responses to the same buyer signal. The hyperscaler offerings address some layers:

• Regional residency, EU regions exist and the data stays there for most standard operations.
• Contractual posture, sovereignty SKUs come with stricter DPAs, listed sub-processors and EU support staff.
• Partial TEE coverage, Azure offers Confidential VMs with AMD SEV-SNP and limited TDX preview, AWS offers Nitro Enclaves on CPU workloads, Google offers Confidential VMs with SEV-SNP.

What none of them solves is the parent company problem. Microsoft Ireland is a subsidiary of Microsoft Corporation (US). AWS EMEA Sàrl is a subsidiary of Amazon.com Inc (US). Google Belgium is a subsidiary of Alphabet Inc (US). The CLOUD Act applies to the parent regardless of which region holds the data. For tenders that explicitly screen out US-parent processors, and there are more of them every quarter, the hyperscaler sovereignty SKUs do not pass the legal filter.

The hyperscaler response confirms the trend without solving the underlying constraint. A buyer running a strict geopatriation policy needs an EU-incorporated provider, and the EU-incorporated providers running production-grade confidential AI in 2026 are a short list.

Where VoltageGPU positions

Disclosure: this is our piece, so we will be specific about where we sit. VoltageGPU is operated by VOLTAGE EI (France, SIREN 943 808 824). The controller is European. There is no US parent. Inference runs inside Intel TDX hardware enclaves at our inference provider, under a French controller. The inference API does not return an attestation with each request; the attestation you generate yourself is available on Confidential VMs. The API is OpenAI-compatible (drop-in base_url swap). Requests pass through our relay, which sees them in clear (TLS ends at our host). To keep plaintext off our servers, run your own inference server in a Confidential VM and terminate TLS inside its trust domain.

Plans run from $20/month (Plus, individual regulated user) through Starter ($349/month), Pro ($1,199/month, OpenAI-compatible API) to Enterprise (custom pricing, unlimited requests, SLA, dedicated support). The full positioning is on Sovereign AI Cloud and the project methodology for moving workloads off US-parent providers is on Geopatriation.

The honest version: we are not the only EU-incorporated provider with TEE-based compute, and we will not be the only one a year from now. Mistral and Aleph Alpha are real EU controllers with credible products. We sit in the niche of EU controller plus TEE inference in Intel TDX plus OpenAI-compatible API. That niche is small today, inside a sovereign cloud market growing at about 8.5% a year.

18-month forecast, what to actually expect

Three observable signals to track.

Procurement template change. RFPs in regulated EU sectors are starting to explicitly screen out US-parent processors for AI workloads, not just for traditional cloud. The language varies, “EU-incorporated controller”, “non-extraterritorial jurisdiction”, “SecNumCloud-aligned”, “Gaia-X compatible”, but the intent is consistent. By end of 2027 we expect this to be standard in financial services, healthcare and public sector tenders across the EU and in default policy for many European multinationals.

Audit findings. National competent authorities (BaFin, ACPR, CNIL, AEPD, Garante, MFSA) have published enough DORA and AI Act guidance that auditors now expect cryptographic evidence rather than vendor PDFs.

Workload mix. Chat completions, embeddings and retrieval flows are typically the first to geopatriate because the OpenAI SDK swap is mechanical. Fine-tuned models and agent workloads tend to migrate in a second wave on dedicated regional clusters, because the BYOA packaging takes longer to validate. The first wave runs through 2026; the second wave runs through 2027.

Net forecast: a multi-hundred-million-euro shift of AI inference spend out of US-parent providers into sovereign regional clouds by the end of 2027, with the largest absolute flow happening between Q3 2026 (EU AI Act general date of application) and Q4 2027. The market that is $9 billion today reaches $15 billion by 2030 in the central Mordor case, which means roughly $1 billion of net new sovereign cloud spend per year through the decade, about 8.5% a year.

What to actually do, if you are buying or building

If you are buying: run an inventory. List your AI workloads on US-parent providers. Capture traffic volumes, data sensitivity, SLAs and existing DPA terms. Pick one workload, typically a chat completion or embedding flow, and run a parallel evaluation against an EU-incorporated confidential AI provider. Document the comparison. Take the evaluation pack to your DPO and audit committee. The inventory itself is the most informative step.

If you are building: the lock-in argument that kept teams on US-parent providers is gone. The OpenAI SDK accepts a custom base_url. Model quality on regulated workloads (legal, financial, medical, compliance) is within striking distance of GPT-4-class systems with Qwen3.5-397B-TEE and DeepSeek-V3.2-TEE. The marginal capability gap on the most exotic tasks is the trade against hardware confidentiality, EU jurisdiction and direct EU AI Act applicability. For most production workloads, the trade is the right one, and the buyer in your enterprise customer base will increasingly require it.

The honest summary of 2026: the sovereign cloud market is real, the Geopatriation trend is named and tracked, the regulatory deadlines are hard, the technical stack is mature, and the SDK lock-in is no longer a meaningful barrier. The question for every team running regulated AI workloads is not whether to move some workload off US-parent providers, it is which workload to move first.

Sources

• Mordor Intelligence, Sovereign Cloud Market 2024-2030, sizing ($9.31B 2024 → $15.15B 2030), driver mix and regional split.
• Forrester, European sovereign AI commentary, €1.5 trillion cumulative spend through 2030.
• Gartner, Top Strategic Technology Trends for 2026, which names Geopatriation.
• Regulation (EU) 2024/1689 (AI Act), Articles 111 and 113, and Regulation (EU) 2026/1744 (Digital Omnibus on AI): February 2025, August 2025, August 2026, August 2027, December 2027.
• Intel, Intel TDX white paper (343961-003US).
• NVIDIA, Secure AI with Blackwell and Hopper GPUs (white paper WP-12554-001).

Continue reading, Sovereign AI Cloud pillar, Geopatriation methodology, DORA Article 28 for AI vendors, EU AI Act high-risk compliance.