Summary: IBM announced Sovereign Core on January 15, 2026 as software for building and operating sovereign environments, with a February tech preview and mid-2026 general availability. It keeps the control plane, identity, keys, audit trails, and governed AI inference inside the customer jurisdiction. Cegeka and Computacenter lead the first commercial rollout in Belgium, the Netherlands, and Germany.
Sovereign Core is IBM’s newly announced software for enterprises, governments, and service providers that need to stand up, deploy, and operate sovereign environments — unveiled on January 15, 2026 and billed as “the industry’s first AI-ready, sovereign-enabled software.” The rollout is staged: a tech preview opens in February, and general availability follows in mid-2026. The framing is what should catch a developer’s eye. Sovereignty here is not a matter of where data happens to sit; it is treated as a design assumption for the entire software stack, with the control plane, identity, encryption keys, audit trails, and AI inference kept inside the customer’s own jurisdiction.
Nor is this a fringe topic. To size it, IBM points to a Gartner prediction that by 2030 more than 75% of enterprises will carry a formal digital sovereignty strategy. And once AI workloads start pushing sensitive data through model inference, the question changes shape: no longer “where is the data stored” but “who operates the system, who can access it, and under whose jurisdiction do the models run.”
How AI Pushed Sovereignty Onto the Agenda
In this announcement, IBM draws the boundaries of digital sovereignty far more widely than the usual data-residency debate: it spans who runs and controls the environment, the terms on which data gets accessed and governed, where workloads actually execute, and whose jurisdiction AI models fall under. What forces the issue is regulation that keeps tightening, joined to the demand for auditable governance — the same current we flagged in our opening outlook for 2026, when vendors started splitting terms and compliance obligations by region.
The gap most organizations run into is concrete: when an application — AI-enabled ones included — has to land, modernize, and re-host somewhere under sovereign control while feeding continuous compliance reporting, there is no obvious destination today. Deploying AI raises the stakes on every one of those points. Where inference runs, which data an agent touches, and whether anything crosses out of the jurisdiction stop being infrastructure choices and become governance questions.
The Four Pillars Behind Sovereign Core
Four pillars carry the product, as the announcement lays them out:
- A control plane operated by the customer, so organizations hold operational authority directly and go without vendor intermediaries from outside the region
- Identity and keys that never leave the boundary: authentication, authorization, encryption keys, and access management are all handled within the jurisdiction
- Compliance evidence in continuous supply, with telemetry, operational data, and audit trails created and administered within the sovereign boundary
- AI inference under governance: local GPU clusters, on-premises inference, and traceable agent operations, without any data going out to external providers
Beneath the product sits Red Hat’s open source foundation, and IBM’s central claim is an architectural one: rather than a control layer bolted onto existing systems, sovereignty is “an inherent property of the software itself.” For deployment, IBM commits to isolated environments with multitenancy built in and a setup time of “within a matter of days,” while hardware and infrastructure stay the customer’s call — an on-premises data center, an in-region cloud, or an IT service provider all work.
Cegeka and Computacenter Lead the European Rollout
Europe gets the first commercial push: Cegeka takes Belgium and the Netherlands, Computacenter takes Germany, and wider collaborations with global service providers are still to come. Gaetan Willems, VP of Cloud & Digital Platforms at Cegeka, sees a market pulling hard for platforms and software that can hold sensitive data within compliant boundaries. Christian Schreiner, Unit Director Cloud at Computacenter, puts it more bluntly: with Sovereign Core, the company can serve “clients who previously couldn’t consider AI solutions at all,” and value arrives faster than it does when assembling components piece by piece.
The dates to note: tech preview in February, general availability mid-year with additional capabilities, a waitlist that is open right now, and a virtual IBM Tech Summit on January 27. IBM operates in more than 175 countries, so starting in Europe is no accident — the EU pairs the densest data-governance and AI regulation with the most mature sovereign-cloud market.
What IBM Is Really Selling: Control You Can Prove
Where the product sheet stays polished, the analyst commentary lands harder. Sanjeev Mohan, principal at SanjMo, boils the pitch down to a single question: “who controls the system and can you prove it to regulators?” Erik Fish, Director of Geotechnology at Eurasia Group, observes that AI is speeding up the rate at which sovereignty questions move from theory to daily operations. IBM’s own Priya Srinivasan, GM of IBM Software Products, describes the shift as creating “an urgent need for sovereign solutions that deliver AI-ready environments.”
Read that way, the offer comes into focus: not merely “data stays in country,” but compliance evidence generated continuously and ready to place in a regulator’s hands. For banks, telecoms, and hospitals already carrying heavy audit spend, that turns sovereignty from a compliance tax into a deliverable engineering capability.
The Takeaways for AI Product Teams
Three practical effects follow. One, compliance moves into the architecture: if European customers are on the roadmap, the control-plane location, key management, and inference boundary need to be settled at system-design time, not patched in after launch. Two, in-jurisdiction inference becomes a first-class requirement — with local GPU clusters and traceable agent operations on the table, “just call an overseas API” is no longer the only default, so weigh self-hosting and sovereign service providers early. Three, a sovereignty market in its own right is forming: once IBM and major European service providers treat sovereignty as a 2026 product theme, “can this deploy sovereign?” will quickly join the first questions enterprise buyers ask about any AI product that touches sensitive data. Startups in those categories should have their answer ready now.