Sovereign AI and Cloud Security Take Center Stage on the Microsoft - Utimaco Germany Roadshow 2026

Cloud Innovation and Data Sovereignty Must Go Hand in Hand

The Microsoft–Utimaco Germany Roadshow 2026, which stopped in Berlin, Hamburg, Cologne, and Munich, highlighted a challenge facing many organizations across Germany’s regulated industries: how to adopt cloud and AI technologies without compromising security, compliance, or control over sensitive data.

Across all four events, attendees consistently raised similar questions. How can organizations take advantage of Microsoft Azure, Microsoft 365, and AI-powered services such as Copilot while maintaining data sovereignty and meeting increasingly complex regulatory requirements?

The answer, as demonstrated throughout the roadshow, lies in combining cloud innovation with sovereign encryption, trusted key management, confidential computing, and strong governance frameworks.

Growing Demand for Sovereign Cloud Architectures

The audience reflected a broad cross-section of highly regulated sectors, including public sector organizations, healthcare providers, and defense-related institutions.

Discussions revealed two distinct customer groups. Some organizations have already adopted Microsoft cloud services and are now looking to strengthen sovereignty and compliance controls. Others remain cautious about moving sensitive workloads to the cloud due to regulatory concerns, despite broader digital transformation initiatives.

Despite their different stages of cloud adoption, both groups shared the same objective: benefiting from cloud services and AI innovation while maintaining control over critical data and cryptographic assets.

Microsoft's Approach to European Data Sovereignty

The keynote session from Microsoft focused on the company's commitment to European data sovereignty and the importance of combining organizational measures with technical safeguards.

Several deployment options were highlighted to support varying sovereignty requirements:

• Public Cloud
• Azure Local (formerly Azure Stack)
• Sovereign cloud initiatives such as Delos in Germany and Bleu in France

A major focus was the rapid adoption of AI services. While AI delivers significant productivity benefits, it also introduces new considerations around data protection and governance. Microsoft emphasized a structured approach based on identifying critical data, classifying sensitive information, implementing controlled encryption and key management, and establishing clear sovereignty controls.

Building Trust Through Independent Cryptography

During the Utimaco session, we explored how organizations can implement practical sovereignty controls through trusted cryptographic infrastructure.

A key theme throughout the roadshow was the importance of maintaining an independent root of trust. Utimaco’s General Purpose Hardware Security Modules (GP HSMs), manufactured in Aachen, Germany, provide the foundation for securing cryptographic keys and supporting compliance requirements in regulated environments.

The discussion also addressed the growing importance of the VAU/TEE criteria catalog. One of its central concepts, Betreiberausschluss (Operator Exclusion), ensures that cloud operators themselves cannot access protected data or cryptographic key material. This principle is increasingly becoming a cornerstone of modern sovereignty strategies.

Sovereign Encryption in Practice

A dedicated architecture session demonstrated how organizations can implement sovereignty requirements through layered encryption and externalized key management.

The session explored key approaches including Bring Your Own Key (BYOK), Double Key Encryption (DKE), and Hold Your Own Key (HYOK). These models were combined with Utimaco’s Key Management flagship solution, Enterprise Secure Key Manager (ESKM), and its GP HSMs serving as the cryptographic root of trust.

A recurring concern among attendees was the complexity of operating secure key management infrastructures on premises. To address this challenge, Utimaco provides Enterprise Key Management as a Service (EKMaaS), a fully managed offering that enables organizations to implement advanced sovereignty controls without managing the underlying infrastructure themselves.

New Innovations for Key Management

Another highlight was the introduction of upcoming enhancements to the Utimaco Key Management Services portfolio.

New Azure HYOK support will allow Azure Key Vault to use an external key store, providing greater control over encryption keys and stronger separation of duties. Automated BYOK key rotation will simplify lifecycle management by automatically rotating Key Encryption Keys used to protect Data Encryption Keys.

Significant interest was also generated by the upcoming integration between ESKM/EKMaaS and Microsoft Sentinel. The integration will enable organizations to monitor key activity, detect potential compromise scenarios, trigger automated response actions, and rotate keys following security incidents, helping strengthen both security operations and compliance automation.

Securing AI and Sensitive Data

One of the most engaging sessions featured a live demonstration showing how organizations can prevent Microsoft Copilot and other AI services from accessing sensitive Microsoft 365 content.

The solution combines Microsoft Purview, BYOK-based sensitivity labels, and Utimaco-controlled encryption keys. For many attendees, the demonstration provided a practical blueprint for implementing AI governance while maintaining independent control over protected information.

The roadshow also showcased confidential computing architectures that combine Utimaco HSM technology with Azure infrastructure to create highly isolated environments for sensitive workloads, providing an additional layer of protection for organizations operating under strict security requirements.

Looking Ahead

A clear message emerged from every stop on the roadshow: organizations are no longer asking whether they should adopt cloud and AI technologies. They are asking how to do that in a secure and compliant way with full control over their most valuable data.

As cloud and AI adoption continue to accelerate sovereign encryption, externalized key management, confidential computing, and robust AI governance are becoming strategic requirements for organizations operating in regulated environments.  

The Microsoft–Utimaco Roadshow 2026 demonstrated that these challenges can effectively be achieved by adopting the appropriate cybersecurity solutions as crucial parts of future-ready digital environments.  

Explore our Trust as a Service cloud solutions with a free 30-day trial here.

About the Author

Dirk Warneke

Senior Account Manager, Utimaco

Matthias Partl

Cloud Solution Architect, Utimaco