Why sovereign cloud fails: Real‑world risks, trade‑offs, and resilience | Ladybug Unplugged | Episode 4.

Lysa Banks:
Let’s think about this from a practical standpoint. We’re both technologists, and we know a fundamental truth: all complex systems fail. It’s not a matter of if, it’s a matter of when.

So let’s imagine an organisation has assessed its risks, defined its operational needs, and implemented what it believes is a sovereign cloud solution that meets all its requirements.

Even then, things can fail. What breaks first?

Sander Nieuwenhuis:
That depends largely on the technical foundation — the infrastructure you choose.

If we look back at the sovereignty spectrum, with hyperscaler cloud on one end and fully self‑managed data centres on the other, each option fails differently.

Hyperscaler cloud tends to be very resilient, and it’s relatively easy to design for continuity. But if you run workloads locally, you need to invest significantly more to achieve the same level of resilience.

For example, if you run systems in your own offices, you likely need a second location as well. That requires substantial investment.

Lysa Banks:
So the failure modes depend on where you sit on that spectrum?

Sander Nieuwenhuis:
Exactly. In hyperscaler environments, failures are more likely to relate to access and control, such as identity and access management or operational processes you must run yourself.

With local or self‑managed solutions, failures often relate to reliability and cost. These environments can be more expensive and less predictable if not designed carefully.

Where things go wrong depends heavily on the technology choice — but also on factors outside your direct control.

Lysa Banks:
Such as geopolitics and regulation?

Sander Nieuwenhuis:
Yes. You can’t fully predict political changes or new legislation. Those external factors can affect cloud availability, cost, or compliance requirements, and organisations need to be aware of them.

Lysa Banks:
That brings us to a bigger question. If geopolitics is driving this discussion, should organisations invest in sovereignty now, or wait it out?

Sander Nieuwenhuis:
These conversations existed before current political cycles. In Nordic countries, for example, organisations were already questioning their dependency on non‑European technology providers.

Geopolitical events may accelerate awareness, but the underlying concerns remain: dependency, regulation, and control.

Lysa Banks:
And regulation seems to be reinforcing that.

Sander Nieuwenhuis:
Absolutely. We see legislation such as NIS2 and DORA pushing organisations to take a more risk‑based approach.

For example, financial institutions are allowed to outsource services, but they must have exit strategies and ensure continuity if providers change or fail.

This shifts cloud strategy away from “cloud first” towards “cloud first, with exceptions” — and requires more deliberate thinking about sovereignty, resilience, and AI adoption.