Inside the Confidential Computing Summit: Trusted AI

SAN FRANCISCO — What began as a niche security technology focused on protecting data in memory is rapidly evolving into a foundational trust layer for artificial intelligence, sovereign cloud infrastructure, and autonomous AI agents. That was the central message emerging from keynote presentations at the Confidential Computing Summit in San Francisco, where leaders from the Linux Foundation, Microsoft, Google, Intel, the Confidential Computing Consortium, and the UAE’s Technology Innovation Institute outlined a future in which confidential computing becomes a core architectural component of AI systems.

In an opening talk, Linux Foundation Executive Director Jim Zemlin connected confidential computing to one of the most important challenges facing AI adoption worldwide: digital sovereignty. While open-source software and foundation models are increasingly accessible, Zemlin argued that many nations remain constrained by access to GPUs, capital, and domestic AI infrastructure. Confidential computing, he said, provides a mechanism for organizations and governments to securely use external infrastructure while maintaining cryptographic assurances over privacy and control. Zemlin noted that the topic has become increasingly relevant in discussions at the United Nations, where AI sovereignty and national control over digital infrastructure are growing policy concerns.

Microsoft Technical Fellow and Azure CTO Mark Russinovich expanded on that vision by describing a decade-long effort to make confidential computing a standard component of cloud infrastructure. Russinovich introduced a roadmap extending beyond traditional confidential computing toward what Microsoft calls “confidential tenancy”—an architecture that would give organizations cryptographic control over data movement and cloud operations. Microsoft has already migrated critical services including Entra token signing, Windows licensing, Xbox licensing, payment processing, and passkey synchronization into confidential computing environments. Russinovich argued that advances in trusted execution environments, attestation technologies, and secure CPU-to-GPU communications are eliminating many of the performance and operational barriers that historically limited adoption.

Google and Intel focused on confidential AI deployment at scale. Nelly Porter of Google said customers increasingly demand assurances that cloud administrators, privileged insiders, and infrastructure operators cannot access sensitive models or data. She described a shift from confidential virtual machines toward fully confidential systems spanning CPUs, GPUs, networking, storage, and key management infrastructure. Google also highlighted confidential AI deployments supporting Gemini workloads, sovereign cloud initiatives, external key management, and its roadmap toward post-quantum cryptography. Intel’s Anand Pashupathy described Intel TDX as a foundational technology providing workload isolation, attestation, and customer-controlled encryption keys, arguing that confidential computing helps remove one of the biggest barriers to AI adoption: trust.

Mike Bursell, Executive Director of the Confidential Computing Consortium, framed the challenge from an enterprise perspective. As AI agents become embedded throughout business processes, traditional security models based on network perimeters and reactive defenses become increasingly inadequate, he argued. Organizations need cryptographic guarantees that sensitive data, business processes, and agent interactions remain protected even if surrounding infrastructure is compromised. Bursell described confidential computing as an architectural shift from reactive security toward hardware-rooted trust, enabling verifiable confidentiality, integrity, and attestation across modern AI environments.

Perhaps the broadest vision came from Dr. Najwa Aaraj, CEO of the UAE’s Technology Innovation Institute (TII), who positioned confidential AI as the key to unlocking collaboration across industries and nations. Aaraj argued that healthcare providers, financial institutions, governments, and enterprises possess vast stores of valuable data that remain isolated because privacy regulations, competitive concerns, and sovereignty requirements prevent sharing. The result is that AI systems are often unable to benefit from the collective intelligence embedded across these fragmented datasets. TII is developing technologies that combine fully homomorphic encryption, secure multiparty computation, federated learning, post-quantum cryptography, and trusted execution environments to enable privacy-preserving AI training and inference. The organization is also working on identity frameworks for AI agents, addressing what Aaraj described as a growing need for authentication, authorization, and accountability as autonomous systems increasingly interact with one another.

Key Takeaways

• Confidential computing is evolving from workload protection into a broader trust architecture for AI.

• Sovereign AI initiatives are becoming a major driver of confidential computing adoption.

• Cloud providers are extending confidential computing beyond CPUs to encompass GPUs, networking, storage, and AI accelerators.

• Microsoft introduced the concept of “confidential tenancy,” combining confidential computing with customer-controlled data governance.

• Google emphasized confidential systems that protect AI models, agents, and data from cloud operators and privileged insiders.

• Intel highlighted trusted execution environments and attestation as foundational technologies for confidential AI.

• The Confidential Computing Consortium sees AI agents as a major catalyst for industry adoption.

• TII presented confidential AI as a mechanism for enabling collaboration across organizations and nations without exposing sensitive data.

• Post-quantum cryptography is increasingly being integrated into confidential computing roadmaps.

🌐 Analysis

The strongest theme emerging from the summit is the convergence of four previously distinct technology domains: (1) Confidential Computing (2) Sovereign AI / Sovereign Cloud (3) Agentic AI (4) Post-Quantum Cryptography

Rather than being treated as separate initiatives, speakers repeatedly described them as interdependent components of a future trust architecture for AI.

I also note that the range of presentations at this event made clear that the privacy conversation has expanded significantly beyond protecting data at rest or data in motion. Industry leaders are now discussing end-to-end confidential systems that encompass model training, inference, agent interactions, cloud governance, identity management, auditing, and sovereignty controls. Microsoft’s concept of confidential tenancy, Google’s confidential AI systems, and TII’s privacy-preserving AI framework all point toward the same objective: enabling organizations to use powerful AI systems without surrendering control over sensitive data or intellectual property.

Perhaps most notably, several speakers suggested that AI agents may become the force that finally drives mainstream adoption of confidential computing. As agents gain access to enterprise applications, financial systems, healthcare records, and government services, hardware-rooted trust, cryptographic attestation, and verifiable execution may become prerequisites rather than optional security enhancements. Let’s hope that the next generation of AI infrastructure becomes truely grounded by confidentiality, attestation, sovereignty, and trust.