The cloud conversation has changed.

A few years ago, the direction of travel seemed obvious: migrate, modernise and scale. For many organisations, “cloud first” was the accepted strategy. It appeared only a matter of time before companies, banks and institutions moved away from the traditional data room in the basement, with Microsoft Azure and the other hyperscalers positioned as the main beneficiaries.

But the transition has not unfolded quite as expected.

Financial institutions, in particular, have often remained cautious. Their priority has been control, resilience and regulatory certainty, sometimes above access to the latest functionality. This conservative approach is now being challenged by the rise of AI, which is exposing the limits of legacy infrastructure and fragmented data governance.

At the same time, concerns around data sovereignty have become more acute. Geopolitical uncertainty, questions around extraterritorial legislation and the changing relationship between Europe and US-owned technology platforms have all contributed to a more complex decision-making environment. For heads of compliance and risk, the question is no longer simply whether cloud is efficient, but whether it is sufficiently controllable, transparent and sovereign.

The hyperscalers have responded by highlighting their European credentials, investing in local regions, and offering new models designed to meet governance and regulatory expectations. But is this enough to reassure regulated organisations? The jury is still out.

Francois Philippo, CTO of Econocom commented

“No one can ignore it any longer: the deck has been completely reshuffled for IT and data at the heart of a global challenge, making the choice between public cloud, private cloud, and on-premise infrastructure a highly strategic decision. Far from being a one-off choice, this trajectory will need to continuously adapt to regulatory, economic, and geopolitical shifts. The good news is that the explosion of software solutions now offers genuine sovereign alternatives, empowering businesses to master their technological destiny.”

IT leaders want the agility of cloud, but they also want control. They want visibility across infrastructure, applications and data usage. Yet, in practice, few organisations can see their entire environment on one screen. Many are managing fragmented systems, hybrid architectures and growing volumes of data spread across multiple locations.

This challenge is particularly relevant in regulated sectors. Insurance companies, for example, now have greater clarification from the regulator and are increasingly able to use cloud services with more confidence. But this does not mean every workload belongs in the public cloud. The right approach depends on the data, the use case, the risk profile and the operating model.

At the same time, companies are asking a more ambitious question: can they access the functionality traditionally offered by hyperscalers, but through an on-premise, private or sovereign solution? In other words, can organisations combine the innovation of cloud with the reassurance of local control?

There is no simple answer. But the direction is clear. The market is moving away from one-size-fits-all thinking. Cloud is no longer simply a destination. It is an operating model.

Cloud 3.0 is about making deliberate choices: where data sits, where compute happens, how risk is managed, and how innovation is enabled. The future will be hybrid, sovereign, intelligent and, above all, strategic.