As AI becomes the latest impost to drive up the cost of doing business, prudent Australian organisations reconsider what stays in public cloud and what returns home.
Although hyperscalers can hike subscription prices at a whim, on-premises hardware is a single, upfront investment against which a business can budget for years, Neil Shan, managing director of IT Ecosystems, told an iTnews audience recently.
“[Hyperscalers] can put it up every six months, and you’re at the mercy of them, especially when your data is in there.”
Joining Shan on the Own your data, own your future webinar, Synology A/NZ country manager Jacqueline Graciella, agreed that predictability was a price Australians were ever more willing to pay upfront as they sought greater control or ‘sovereignty’ over their data.
However, she warned against conflating ‘sovereignty’ with ‘residency’.
“Data residency is where your data is physically stored but data sovereignty talks about who has authority over that data,” Graciella said.
“So even if it’s stored in an Australian data centre, you don’t necessarily have data sovereignty. The question should shift from just, ‘Where is my data stored?’ to ‘Where is it stored?; Who controls it?; Who can access it? and Can I still maintain that control and authority as I start using AI?”
It’s a distinction filtering up to the boardroom. A February 2026 survey of Australian business leaders found 63 percent discuss data sovereignty at board level while 80 percent considered it essential to scaling AI. But conviction had outpaced capability as few organisations enabled sovereignty, which limited their ‘model autonomy’ or ability to change AI providers without losing grip on underlying data workflows and decision logic.
Know thyself: Can you answer these five simple questions about your data?
Pointing to the Five Knows of Cybersecurity, Shan said a fundamental problem was most small to mid-sized businesses can’t answer basic questions about their own data such as its value, who can access it, or even where it is.
“So they hear about [sovereignty and conclude] we don’t need to worry about that,” he said.
“When [data] goes into a hyperscaler, they assume the hyperscaler is protecting it. And as the data gets fragmented over time, they lose control” scattered across a Dropbox account or Microsoft cloud tenant with no unified view of its disposition.
Subscription trap: Is cloud convenience a hidden cost you can’t escape?
Graciella pointed to Korean Air’s 1000-user aerospace division as an example of a business that clawed back control of its data delivering immediate benefits. Consolidating clumsy emails for file sharing and collaboration on premises cut complexity and boosted productivity 80 percent while slashing 40 percent off variable subscriptions.
And it’s not just overseas firms bringing their data back home.
More than a quarter of Australian businesses were intending to repatriate cloud workloads, propelled by cost, sovereignty and AI economics, Sydney-based IT research and advisory firm, ADAPT, found in a July 2026 survey. It also found 77 percent of infrastructure leaders were mandated to wrestle back control over spiralling AI consumption costs, yet only 14 percent knew what they were spending.
Trust but verify: Why recoverability is non-negotiable in an AI world
Owning the infrastructure was irrelevant if a business couldn’t prove it had control.
Shan said cyber-insurers tested their customers’ recoverability claims: “‘Can you prove it?’ is one of the first things they would [ask]. They want to see that it is recoverable.”
It was essential that only a good or ‘gold’ backup was recovered, especially after a cyber incident or a breach, otherwise it risked reinstating a bad actor or compromised backup.
Shan said that even the smallest businesses should observe the ‘3-2-1-1-0’ rule of data backup, ie three copies of data, on two different media, with one copy offsite, one immutable (or offline shielded from attackers), and zero errors on recovery.
The immutable copy (untouchable for a set period) had become an especially important safeguard to limit fallout from rogue AIs, he said.
“You don’t know what the AI agent’s going to do or how it misinterprets your particular prompt,” he said.
Shan warned such a rogue AI agent could do far more damage than a human in a blink of an eye.
“AI is only as good as the data behind it,” Graciella echoed, adding AI demanded stronger data governance before granting it corporate access.
Next steps: Secure the ‘Keys to your Kingdom’
Shan advised business leaders unsure where to start to resist peer-group pressure.
“Don’t worry about AI FOMO [fear of missing out]. Control your stuff first. Own your data. Work out how much your budget is, and then take it from there,” he said.
He said that started with the ‘Keys to the kingdom’: Laying your hands on your passwords, domain registrations, and account access rapidly in an emergency without going through a third party.
“Own your data, protect it, and build your infrastructure around the value that the data can create,” said Graciella.
Want more? Join Synology to learn how to regain control over your data at Insights Day 2026, to be held at the Hotel Shangri-La, Sydney, on 18 September. Register here.
And check out Synology’s deployment consultation and partner page, a starting point for businesses working through their Data+AI strategy.
