.svg)
.jpeg)
Key Takeaways
- Confidential computing protects data while it is being processed (in use)—the third pillar, following encryption at rest and in transit—through hardware enclaves known as Trusted Execution Environments (TEEs).
- Azure, AWS, and Google Cloud each offer their own solutions: Azure combines AMD SEV-SNP, Intel SGX, and Intel TDX depending on the service; AWS relies on its proprietary Nitro Enclaves; and Google Cloud uses Intel TDX for its latest confidential VMs (source: Microsoft Learn, 2026; AWS, docs.aws.amazon.com).
- On October 1, 2025, ANSSI published a technical position paper that tempers enthusiasm: when faced with a hostile cloud administrator carrying out active attacks, technology alone does not provide a sufficient guarantee of integrity and confidentiality (source: ANSSI, Technical Position Paper on Confidential Computing, October 1, 2025).
- Do not confuse confidential computing with the SecNumCloud sovereign cloud: they are two different solutions to two different problems, and ANSSI itself points out that no cloud—even a certified one—has full control over its entire technology chain (source: Vincent Strubel, Director General of ANSSI, quoted by Solutions Numériques, January 7, 2026).
Confidential computing addresses a specific question: How can you maintain control over sensitive data when it must be processed on infrastructure that you do not fully control—whether it’s a public cloud, a service provider, or a partner? It’s an architectural challenge, not just a box to check in a cloud contract.
This issue is rising in the IT department’s list of priorities for a very specific reason: between the growing use of external large language models (LLMs), GDPR and AI Act requirements regarding the processing of personal data, and the pressure to host sensitive workloads outside their own data centers, more and more organizations are processing critical data on hardware owned by someone else.
What exactly is confidential computing?
The Confidential Computing Consortium (CCC), a project hosted by the Linux Foundation that Microsoft has co-founded since 2019, defines the technology as follows: it protects data being processed by executing computations within a hardware-based, attested Trusted Execution Environment (TEE) (source: Microsoft Learn, “What is confidential computing?”, learn.microsoft.com/azure/confidential-computing/overview).
In practical terms, data exists in three states: at rest (storage), in transit (network), and in use (RAM during computation). The first two have long been encrypted using standard methods. Until now, the third state remained in plain text in RAM while the calculation was in progress. In practice, a compromised hypervisor, a malicious cloud administrator, or an unauthorized physical user could read this data while it was being processed.
The TEE closes this window: the processor encrypts the memory used by the enclave, and a cryptographic attestation mechanism is used to remotely verify that the code is indeed running in a legitimate, unmodified hardware environment before transmitting secrets (encryption keys, sensitive data) to it.
Data StateHistorical ProtectionProtection Provided by Confidential ComputingAt Rest (Disk)Disk Encryption, BitLocker, LUKSUnchangedIn Transit (Network)TLS/SSLUnchangedDuring Processing (Memory)None, plaintext data in RAMHardware-Based Memory Encryption + Attestation (TEE)
Want to assess where your own blind spots lie when it comes to processing sensitive data? An IT security audit helps identify who has access to what, including during data processing.
Why This Topic Is Becoming a Strategic Priority for CIOs at Small and Medium-Sized Businesses
Three trends are driving confidential computing beyond the confines of large banking clients and the defense sector.
First, generative AI. Employees send business data—which is sometimes sensitive—to external LLMs (ChatGPT, Claude, Mistral, Grok) hosted on third-party cloud infrastructures. IT Systèmes has detailed elsewhere the risks of this “Shadow AI” and the security measures for ChatGPT, Claude, and Mistral in small and medium-sized businesses: confidential computing is one of the technical building blocks that allows these prompts to be processed without the LLM operator or the cloud provider having access to them in plain text.
Next, the regulations. The European AI Regulation (EU 2024/1689, known as the AI Act), which took effect on August 1, 2024, imposes increasing obligations on data processing by AI systems, with stricter requirements taking effect on August 2, 2026, for high-risk uses. At the same time, the NIS2 Directive (EU 2022/2555) broadens the scope of entities subject to enhanced security obligations. While neither of these regulations specifically mentions confidential computing, they require CIOs to document how sensitive data is protected at every stage of its lifecycle, including during processing. The NIS2 compliance guide details the technical measures required.
Finally, the growing reliance on the public cloud. Migrating to Azure, AWS, or Google Cloud means entrusting computing tasks to a third party. For regulated industries (healthcare, finance, the public sector), this reliance raises a simple question: Who, technically speaking, can access your data while it is being processed? Confidential computing is one possible solution—but not the only one.
How TEE Works: Attestation, Enclaves, and Memory Encryption
The central mechanism is attestation. Before a sensitive operation is executed in a TEE, the hardware generates cryptographic proof—known as “evidence”—of its state: which firmware is running, which version of the code is about to be executed, and whether secure boot is enabled. A third party (“relying party”) verifies this proof before transmitting secrets, according to the model described by the IETF’s RATS architecture (RFC 9334, as outlined in the Microsoft Azure documentation on attestation).
Two technical approaches currently coexist among cloud providers:
AWS Nitro Enclaves take a slightly different approach: they isolate computing resources using the Nitro hypervisor (proprietary AWS technology), with no access possible from the root or administrator account of the parent instance, and feature cryptographic attestation and integration with AWS KMS for key management (source: AWS, What is Nitro Enclaves?, docs.aws.amazon.com/enclaves).
What the certificate does not always cover
ANSSI highlights a specific technical point in its October 2025 document: for confidential VMs in a cloud environment, verification through attestation generally stops at the guest operating system level. The firmware and vTPM remain under the control of the cloud provider, which limits the customization and comprehensiveness of the trust measure (source: ANSSI, technical position on confidential computing, October 1, 2025, summarized by CyberVeille, November 8, 2025).
What Confidential Computing Protects—and What It Doesn't
This is the most important point for a CIO who has to allocate a budget: this technology has a defined scope of protection, and ANSSI has taken care to specify it rather than leaving it up to the marketing departments of cloud providers to decide.
This table summarizes the key points: confidential computing reduces the attack surface against a negligent cloud provider or a faulty hypervisor, but it does not provide absolute protection against a determined attacker with physical access or sophisticated capabilities. ANSSI recommends treating it as an additional layer of defense in depth—never as the sole line of defense—and emphasizes three best practices: attesting the entire boot chain, cryptographically linking the delivery of secrets to the attestation result (via RA-TLS, in particular), and deploying known mitigations against side channels despite their performance trade-offs (source: ANSSI, October 1, 2025).
Real-World Use Cases for Small and Medium-Sized Businesses and Mid-Sized Companies
Confidential computing is gradually moving beyond its initial use cases in high-level defense and finance. Microsoft documents several real-world deployments on Azure Confidential Computing that provide insight into the scope relevant to mid-sized organizations:
For an SME or mid-sized company, the most realistic short-term approach rarely involves a proprietary in-house platform, but rather selecting a service provider or SaaS vendor that already relies on these building blocks to process HR, healthcare, or financial data. The question to ask your providers is therefore: “Does your service run in a certified TEE, or only behind standard encryption at rest and in transit?”
Overview of Cloud Services: Azure, AWS, Google Cloud
The three major providers offer confidentiality computing building blocks, each with different levels of maturity and programming models.
This technical choice has a direct impact on your architecture: a confidential VM (Azure, GCP) requires little or no code changes, whereas an application enclave (Nitro Enclaves, Intel SGX) requires you to refactor the application to isolate the sensitive portion. The right choice depends on your existing stack, not on a generic security criterion. If you’re leading a multicloud migration or consolidation, IT Systèmes’ cloud and infrastructure consulting services factor this type of technical trade-off into the selection of the target platform.
Confidential computing and sovereign cloud: two topics that should not be confused
Many French CIOs automatically associate confidential computing with digital sovereignty. However, these are two solutions to two different problems, and conflating them leads to poor budget decisions.
Confidential computing addresses a technical question: Who can read my data while it is being processed, regardless of where it is hosted? The ANSSI’s SecNumCloud certification addresses a different question—one that is more legal and business-related: Is my cloud service provider subject to a foreign law with extraterritorial reach (such as the U.S. CLOUD Act), and can I discontinue this service without being subject to a decision beyond my control?
Vincent Strubel, Director General of ANSSI, noted in early 2026 that SecNumCloud is based on approximately 1,200 audited control points, provides protection against the CLOUD Act and the risk of service outages, but does not eliminate all technological dependencies: in his own words, as reported, no cloud infrastructure—even one operated by a European provider—has full control over its entire technology chain (source: Vincent Strubel, quoted by Solutions Numériques, January 7, 2026). A SecNumCloud-certified cloud is therefore not automatically equipped with confidential computing, and a service with confidential computing is not automatically sovereign in the legal sense.
For a CIO, the right governance question is not “which one to choose” but “which one addresses which risk”: data governance must explicitly distinguish between the risk of unauthorized technical access (confidential computing) and the risk of legal dependence on a foreign law (SecNumCloud, trusted cloud).
How to Get Started Without Getting Your Priorities Wrong
Before investing in a confidential computing architecture, an IT director at an SME or mid-sized company would be wise to follow a simple process: classify data by sensitivity level, identify which data actually passes through an uncontrolled infrastructure (public cloud, external LLM, service provider), and then verify whether properly configured encryption at rest and in transit is already sufficient to mitigate the identified risk. Confidential computing is warranted when data must be processed—not merely stored or transmitted—on a machine whose administrator you do not control.
In most small and medium-sized businesses, the most cost-effective short-term measures often lie in the early stages: securing access, properly configured traditional encryption, and a clear policy on data sent to external LLMs. Confidential computing comes into play afterward, focusing on a more limited set of truly critical data.
FAQ
Does confidential computing replace traditional encryption at rest and in transit?
No. It supplements the two existing safeguards to cover the third state of data: in-memory processing. A CIO must ensure that all three layers of encryption—at rest, in transit, and during processing—are in place for the most sensitive data.
Is confidential computing sufficient to meet the requirements of the GDPR or the AI Act?
Not on its own. While it strengthens the technical protection of personal data and high-risk AI processing, compliance with the GDPR and the AI Act also imposes organizational obligations (processing records, impact assessments, governance) that technology alone cannot address.
Should an SME with fewer than 100 employees invest in confidential computing?
Rarely on-premises. For most small and medium-sized businesses, the priority remains choosing a SaaS provider or vendor that already relies on these building blocks for sensitive data (HR, healthcare, finance), rather than building a proprietary, in-house architecture that is costly to operate.
What is the difference between a confidential VM and an application enclave?
A confidential VM encrypts the entire virtual machine without changing the application code. An application enclave isolates only a portion of the code that has been rewritten for this purpose. The former is easier to implement, while the latter offers finer-grained isolation but requires dedicated development.
Does confidential computing protect against a malicious employee with legitimate access to the data?
Not directly. It protects against unauthorized access at the infrastructure level (hypervisor, cloud administrator), but not against a user who has legitimate access rights to unencrypted data as part of their normal work.
Should you choose Azure, AWS, or Google Cloud specifically for confidential computing?
Your decision should not be based solely on this criterion. All three platforms offer mature building blocks with different models (confidential VM vs. application enclave); the right choice depends more on your existing application stack and migration constraints than on any clear technical superiority of a single provider.
What IT Systèmes Offers in Terms of Confidential Computing and the Protection of Sensitive Data
IT Systèmes supports small and medium-sized businesses (SMEs) and mid-market companies across the entire data protection chain—from traditional encryption at rest and in transit to assessing the suitability of a confidential computing architecture for truly critical workloads. This support involves an audit of your current systems, mapping data flows to the cloud and external large language models (LLMs), and then selecting a cloud architecture aligned with your GDPR, NIS2, and AI Act compliance requirements.
.svg)