For a decade, the cloud conversation in the Middle East and Africa followed a script written somewhere else. Move fast. Consume global services. Accept that the infrastructure, the operations and the rules behind them live outside the country.
That script is being rewritten. Governments, banks, health systems, telecom operators and critical infrastructure providers are asking three questions they used to skip: where does our data live, who controls it, and whose law does it answer to?
The answer they are arriving at is sovereign cloud. Not as a niche requirement for defence ministries, but as the foundation for digital government, regulated industry and national AI.
The fastest-growing region in the world
The shift is not anecdotal. Gartner forecasts worldwide sovereign cloud IaaS spending of $80 billion in 2026, up 35.6% on 2025, and puts the Middle East and Africa at 89% forecast growth — the fastest of any region (Gartner, 9 February 2026).
That growth reflects a simple recognition. Countries have always protected their natural resources, financial systems, transport networks and power grids. Data has joined that list. Citizen records, patient files, banking transactions, research and intellectual property are national assets, and protecting them is no longer only an IT decision.
What sovereignty actually means
Here is where the conversation usually goes wrong. Sovereignty is most often sold as a location: a region in-country, and a checkbox that says the data stays there.
Residency is one question. Sovereignty is seven.
A region on a foreign platform answers where the data sits. It leaves six more questions with someone else: who owns the hardware, who runs the operations, whose identity system grants access, who holds the encryption keys, whose policies govern change, and whether you keep the right to continue if the relationship ends.
A real sovereign cloud answers seven questions, deliberately, one layer at a time:
- Data — where it is stored, processed and backed up, and who may ever read it.
- Infrastructure — the racks, the site and the hardware the cloud runs on.
- Operations — who runs the platform day to day, under whose employment and whose law.
- Identity — whose directory issues credentials, and where authentication decisions are made.
- Security — key custody, encryption, monitoring and incident response. A cloud is only as sovereign as the answer to who can decrypt it.
- Governance — the policies enforced across every service, and the evidence they produce.
- Technology — the right to run, inspect and continue the platform without a foreign dependency.
Regulation is setting the pace
Across the region, regulators are turning expectations into obligations: data residency for financial, health, citizen and government records; demonstrable privacy controls, access governance, encryption and auditability; and sector frameworks with teeth.
The names differ by country and sector — NCA ECC and SAMA’s cybersecurity framework in Saudi Arabia, the UAE’s information assurance regulation and personal data protection law, ADHICS for Abu Dhabi healthcare, national PDPLs, alongside international standards such as GDPR and the ISO 27001 family. What they share is a demand for proof. An organisation must be able to show where data is, who touched it and which control stopped what.
That is worth being precise about: a platform cannot be compliant on your behalf. Certification attaches to an organisation, its scope and its practices. What the platform can do is make the controls enforceable and the evidence automatic.
The Gulf is building, not waiting
The UAE has made itself a digital hub, and its government, AI and innovation programmes are pulling demand toward cloud that can prove compliance and residency without giving up scale. Saudi Arabia’s Vision 2030 is driving investment in digital infrastructure on a national scale, with government, finance and healthcare looking for platforms that satisfy national regulation while they modernise. Bahrain has built a reputation for cloud adoption, fintech and regulatory modernisation that makes it a natural early mover.
These are not markets choosing sovereignty over progress. They are markets that expect both.
Africa’s opportunity
Across Africa, digital services are growing quickly while much of the infrastructure behind them still sits outside national borders. That brings latency, regulatory friction and dependency. Governments are responding with national cloud platforms, government clouds, domestic data centres and regional ecosystems, so that more of the value created locally stays local.
The trade nobody should have to make
Global public cloud delivered real value, and nothing here pretends otherwise. But regulated organisations keep running into the same limits: bills that are hard to forecast once egress, API and replication charges accumulate; limited visibility into how the platform is operated; and legal complexity when the provider answers to another jurisdiction.
Underneath all of it sits one assumption the industry has asked everyone to accept: you can have a cloud that works, or a cloud that is yours. Global scale, or local control. Pick one.
We think that is a false choice. Sovereignty should not cost you scale.
Sovereign. Not isolated.
The fear behind the trade is reasonable: a national cloud built alone can only offer what it can build alone. The answer is not to become a hyperscaler. It is to connect to other clouds that made the same choice.
That is the idea Oasis Stack is built around. Each sovereign cloud keeps its own data, operations, identity and keys inside its boundary. By explicit agreement, it can offer and consume services with other independent clouds in the federation — and customer data never moves automatically. Control stays local. Reach does not have to.
AI makes this more urgent, not less. National AI strategies depend on training data, models and GPU capacity that must stay under local governance. Countries that build sovereign AI infrastructure now will not have to rent their intelligence later.
What to ask before you choose
Not every “sovereign” offer is the same. Before choosing, ask:
- Where is the infrastructure, who owns it and who operates it?
- Where are the data, the backups and the replicas — and what can make them move?
- Whose identity system grants access, and who holds the keys?
- Which frameworks does the operator certify against, and how does the platform produce the evidence?
- Does sovereignty cost you the services you need: virtual machines, Kubernetes, managed databases, object storage, backup, AI infrastructure and security?
It shouldn’t. The Middle East and Africa are proving that the future of cloud is not global or local. It is owned, and connected.