As the Indian government prepares to release a comprehensive consultation paper on AI regulation, data control and infrastructure ownership have emerged as critical priorities. With nations racing to build sovereign AI, true technological independence hinges on controlling the underlying cloud power, chips, and data centers that drive models. To address growing concerns over sensitive data and system access, MeitY has set up a committee to frame a sovereign-cloud policy. Mint explains what sovereign AI entails, why India needs a sovereign cloud, and whether domestic firms must build it.
AI sovereignty is often understood as a nation’s ability to develop or control its own AI technology and models. But that is only part of the picture, as AI systems require data, computing power, and cloud infrastructure to train, operate, and scale. Access to computing power—particularly the GPUs required to train and run AI systems—and control over the supporting infrastructure are therefore strategically critical.
For instance, if sensitive Indian data is processed on computing and cloud infrastructure controlled by a foreign entity, questions arise over who can access that data, who operates the systems, and which jurisdiction applies. This makes controlling the cloud infrastructure where AI systems are trained and run a core element of AI sovereignty. Consequently, AI sovereignty cannot be viewed solely through the lens of AI models, , or tools. The underlying rails on which these systems run are just as important, if not more so, especially when handling government or other sensitive information.
Simply locating servers in India does not make a cloud sovereign. To date, policy has focused primarily on data residency and localization. However, for a cloud to be truly considered , a country may need control over the physical infrastructure, the cloud technology and software control systems that manage it, operations and administration, encryption keys, and data access.
There must also be explicit clarity on which country’s laws govern the provider and its access to relevant data. These details are critical because a cloud platform can physically reside in India while its underlying technology or operational control remains with a foreign-headquartered firm governed by another nation’s laws. India’s proposed framework will need to address these complex requirements, including how critical workloads can remain operational and controlled even during external disruptions.
The case for a sovereign cloud has grown more compelling as cloud infrastructure has transitioned from an ordinary IT service to strategic national infrastructure, particularly with the rise of AI. Access to computing power, advanced chips, data, and the underlying infrastructure on which AI systems operate is increasingly a matter of national security and competitiveness.
The US-China technology rivalry demonstrates how control over AI infrastructure can be weaponized as a geopolitical tool, as seen with US export controls restricting China’s access to advanced chips. India’s government has begun responding directly to these concerns. MeitY established the sovereign-cloud committee in August and held consultations with Google, AWS, and Apple in September. C-DAC has since issued an EoI for sovereign cloud services along with a tender for sovereign AI cloud and data-centre infrastructure, signaling that the government is transitioning from defining the regulatory framework to actively procuring the infrastructure.
Global cloud companies argue that sovereignty does not necessarily require domestic ownership. Microsoft, for instance, has positioned its new Hyderabad data-centre region, India South Central, as part of its “Sovereign Public Cloud” offering, featuring controls over data residency, encryption keys, and operational access.
A executive told Mint in a September interaction that Indian customers could obtain “full sovereign control” over their data, including where it resides, which data centres are used, and which laws apply. AWS, too, provides digital-sovereignty controls and has partnered with to run sensitive government workloads inside NIC data centres using AWS services. Google offers similar sovereign-cloud capabilities, including dedicated and air-gapped infrastructure.
The question for India, then, is whether these technical and operational controls are sufficient to meet its definition of sovereignty, or whether a sovereign cloud must also entail Indian ownership, control under Indian law and jurisdiction, or both.
This is ultimately a question of how India defines sovereignty. Indian ownership could provide the government with greater control over technology, infrastructure, and operations while reducing reliance on companies subject to foreign jurisdictions. Indian technology firms are already positioning themselves to provide sovereign cloud infrastructure for government and enterprise workloads.
, for instance, has developed SovereignSecure Cloud—an indigenous cloud tailored for government, public-sector, and regulated workloads—while Airtel’s Cloud offers control over the data, control plane, operations, and jurisdiction from within India. Yotta has likewise built sovereign AI infrastructure aimed at government and enterprise workloads.
However, mandating an Indian provider could also mean forfeiting some of the scale, technology, and investment available from global hyperscalers. The central question, then, is whether India needs a domestic alternative to AWS, Microsoft, and Google, or whether it simply requires sufficient control over both foreign and domestic providers to ensure the cloud is sovereign. The path India chooses will determine whether it builds a parallel domestic cloud ecosystem or creates sovereignty standards that both global and Indian providers can meet.
