Key Takeaways
Confidential computing is a hardware-based technique that keeps data encrypted even while it’s being processed — closing a gap that standard encryption has always left open. In May 2026, Sweden’s data protection authority became the first EU regulator to formally recognize this technique as a valid GDPR safeguard, a decision now reshaping how enterprises buy and build AI systems.
At a glance:
- Sweden’s IMY ruled that hardware-based trusted execution environments (TEEs) satisfy GDPR Article 32
- The ruling grew out of a real pilot with Volvo Group, Ericsson, and CanaryBit — not a hypothetical
- Gartner projects 75%+ of untrusted-infrastructure workloads will use confidential computing by 2029
- Roughly 70% of enterprise data still sits outside the cloud, unprotected by this threat model
What Just Changed in Sweden
Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY), published a landmark report in May 2026. It concluded that hardware-based trusted execution environments can satisfy GDPR Article 32’s technical safeguard requirement — the first time any European regulator has said so formally, according to the Confidential Computing Consortium.
The finding came out of a real pilot. IMY worked with Volvo Group, Ericsson, and confidential-computing vendor CanaryBit on a specific problem:
- Connected trucks generate continuous streams of video, positioning, and telemetry data
- That data can’t realistically be processed onboard the vehicle
- Sending it to an external cloud immediately raises a GDPR question: who can see it while it’s being processed?
IMY’s answer: cryptographic isolation — not just contractual promises — can close that gap, because the isolation is enforced by hardware and can’t be overridden by the infrastructure provider itself.
That distinction matters beyond Sweden. Neither the European Data Protection Board nor any other national regulator has yet said whether it will follow IMY’s reasoning, so the ruling’s full reach across the EU is still unsettled. IMY itself expects other authorities to face the same question soon.
The Gap Encryption Never Closed
Enterprise security has spent 20 years protecting two states of data well. The third is where the risk actually sits:
| Data state | Protected by standard encryption? | The gap |
|---|---|---|
| At rest (on a disk) | Yes | None |
| In transit (across a network) | Yes | None |
| In use (being processed) | No | Data must be decrypted before any computation — including an AI model’s inference step — can happen on it |
For most of computing history, that gap didn’t matter much, because the same organization usually owned both the data and the infrastructure processing it. Generative AI broke that assumption. Running a frontier model in production typically means sending sensitive material — customer records, financial transactions, medical files, proprietary source code — to infrastructure the enterprise doesn’t fully control.
Confidential computing closes that specific gap. It creates a hardware-rooted enclave where data is decrypted only inside a sealed, attested boundary, processed, and re-encrypted immediately after — invisible even to the administrators of the machine it’s running on. (See our related primer on trusted execution environments for how attestation works step by step.)
Why This Is Suddenly Urgent
Two forces are pushing confidential computing from a security afterthought into board-level infrastructure:
- The regulatory force. IMY’s report is unlikely to stay confined to Sweden. It functions as a legal precedent inside the EU’s data protection framework, and other national authorities — eventually the European Data Protection Board — will be pressed to address it, especially as more companies process EU citizens’ data through AI systems hosted outside the bloc.
- The technical force. Conventional security frameworks assumed a human initiates every data movement: someone opens a file, sends an email, approves a transfer. Autonomous AI agents don’t work that way — they read, combine, and act on data continuously, without a human in the loop at each step. A single successful prompt injection attack can expose whatever sensitive material that agent had access to. Hardware-enforced isolation is the only genuine boundary against that exposure.
The scale of the exposure is significant: Nvidia’s confidential-computing team estimates that roughly 70% of enterprise data still lives outside the cloud entirely, in on-premises data centers and data lakes that were never designed with this threat model in mind — precisely the data enterprises now want AI systems to work on.
What the Market Is Already Doing About It
The industry response is already visible. Gartner has named confidential computing one of its three core “Architect” technologies in its Top Strategic Technology Trends report for 2026, projecting that more than 75% of processing operations on untrusted infrastructure will be secured through confidential computing by 2029.
The Confidential Computing Consortium — the Linux Foundation-hosted body whose members include AMD, Google, Microsoft, and Intel — has published a maturity model informally known as the “three degrees” framework. It lets enterprises assess how deeply confidential computing is actually integrated into a vendor’s stack, rather than treated as a marketing checkbox. Not every product advertising “confidential AI” implements hardware-enforced isolation at every layer — some stop at partial protection that leaves gaps closer to the model or the orchestration layer.
The CFO and CTO Calculus
For CTOs, this is an architectural shift:
- Confidential computing is moving from an optional add-on evaluated late in a deployment to a requirement specified at project kickoff for any AI initiative touching regulated or proprietary data
- That requirement now sits alongside data residency and model access controls
- Vendor RFPs in finance, healthcare, and legal increasingly list hardware-based attestation as a named line item, which means security architects are in the room from day one
For CFOs, the math is less about what confidential computing costs to adopt and more about what it costs to be without it when a deal requires it:
- Sales teams selling into regulated sectors report that demonstrable hardware-enforced data isolation increasingly separates a shortlisted vendor from a disqualified one
- A verified compliance posture under GDPR also reduces exposure to enforcement action — a risk European regulators have shown a consistent willingness to pursue
Three Things to Watch Over the Next 12 Months
- Whether other EU regulators follow Sweden’s lead. A second or third national authority formally recognizing TEEs under Article 32 would create a genuine bloc-wide precedent, rather than an isolated national ruling.
- Whether confidential inference becomes the default, not an option. Nvidia, Google, Microsoft, and AMD are already building attestation into their core infrastructure rather than offering it as a bolt-on.
- Whether jurisdictions outside Europe cite the Swedish precedent. Data sovereignty rules are tightening in Asia and the Gulf, and regulators there may look to IMY’s reasoning as a template.
The Bottom Line
None of this is settled yet — IMY’s report is a national ruling, not an EU-wide one. But the strategic read for global enterprises is straightforward: this is no longer a story about a single security feature. It’s a story about which infrastructure choices will hold up under scrutiny from a regulator, an auditor, or a customer’s own security review three years from now. The companies building that assurance in today are the ones setting the terms everyone else will eventually have to meet.
