Definition: Confidential Computing
Confidential computing is a hardware-enforced security model that keeps data and code encrypted and isolated while they are actively being processed, using a trusted execution environment (TEE) built into the underlying processor.
Core characteristics of confidential computing
Confidential computing extends encryption to the one phase of the data lifecycle that traditional security left exposed: active use in memory, protecting data even from the infrastructure provider itself.
- Data and code run inside an isolated, hardware-protected enclave
- The operating system, hypervisor, and cloud administrator cannot read enclave contents
- Remote attestation proves the enclave is running unmodified, trusted code
- Encryption keys never leave the protected hardware boundary
Confidential Computing vs. On-Premise AI
Confidential computing and on-premise AI both address the fear of exposing sensitive data to a third party, but they solve it differently. On-premise AI avoids external infrastructure entirely by keeping data inside a company’s own data center. Confidential computing instead makes external infrastructure, including public cloud, trustworthy by cryptographically isolating workloads from the provider, so a company can run on a hyperscaler’s servers and still keep data unreadable to that hyperscaler.
Importance of confidential computing in enterprise AI
As enterprises move sensitive workloads such as patient records, financial data, and proprietary designs into AI pipelines, unresolved data sovereignty and data residency questions have often blocked cloud AI adoption in regulated industries. Gartner projects that by 2029, more than 75% of processing operations on untrusted infrastructure will be secured through confidential computing, up from a small fraction today.
Methods and procedures for confidential computing
Enterprises adopt confidential computing through specific hardware and process layers rather than a single product purchase.
Trusted Execution Environments (TEEs)
A TEE is an isolated region of a CPU or GPU that encrypts memory contents and blocks access from anything outside the enclave, including the host operating system.
- Intel SGX and TDX isolate application memory at the process or virtual machine level
- AMD SEV-SNP encrypts entire virtual machines with per-VM keys
- NVIDIA confidential GPUs extend protection to AI training and inference workloads
Remote attestation
Before trusting an enclave, a client verifies through cryptographic attestation that the code running inside matches an expected, unmodified version, preventing an attacker or compromised administrator from substituting tampered code undetected.
Confidential AI inference
Confidential computing lets a company send sensitive prompts and documents to a hosted model while guaranteeing the provider cannot see the underlying data, making hybrid AI deployment viable for workloads regulation previously forced entirely on-premise.
Important KPIs for confidential computing
Confidential computing programs are measured through coverage, performance, and assurance metrics.
Operational coverage metrics
- Share of sensitive workloads running inside a TEE: target above 90%
- Attestation checks passing before workload execution: target 100%
- Enclave provisioning time: under 1 hour per new workload
- Key rotation frequency for enclave-bound secrets: at least quarterly
Strategic risk metrics
Confidential computing directly reduces the attack surface exposed to cloud insiders and infrastructure compromise. Bitkom’s Cloud Report 2025 found encryption capability now ranks among the top three criteria German companies use when selecting a cloud provider, cited by 96% of respondents.
Compliance and assurance metrics
Mature programs track the share of vendor contracts that reference confidential computing or TEE guarantees explicitly, alongside the frequency of independent attestation audits.
Risk factors and controls for confidential computing
Confidential computing reduces one class of risk while introducing new operational considerations that require dedicated controls.
Performance overhead and hardware dependency
Running workloads inside a TEE adds encryption and attestation overhead and ties deployment to specific processor generations.
- Latency increase for encrypted memory access, typically single-digit percentages on modern hardware
- Limited availability of confidential-computing-capable instances at some cloud regions
- Migration effort when moving between chip vendors with different TEE implementations
Side-channel attacks
Researchers have demonstrated side-channel attacks against early TEE implementations that infer data from timing or power patterns rather than breaking encryption directly, so enterprises must keep firmware current and monitor vendor advisories.
Vendor and hardware lock-in
Because TEE implementations differ across Intel, AMD, and NVIDIA, an application built around one vendor’s attestation model can be costly to port. Enterprises mitigate this by choosing platforms that abstract attestation logic, much as zero trust architecture separates policy from a specific enforcement mechanism.
Practical example
A 110-employee medical technology manufacturer in North Rhine-Westphalia needed an AI system to summarize clinical trial documentation and flag deviations, but its compliance team blocked cloud AI use because patient-adjacent data would be readable by the model provider during processing. The company deployed the document review workload inside attested TEEs on a certified cloud region instead, leaving the model provider technically unable to access plaintext content. Compliance signed off within three weeks once attestation reports and supporting audit documentation were reviewed.
- Automated clinical document summarization with enclave-protected processing
- Attestation reports generated per run for audit evidence
- Deviation flags routed to quality staff without exposing raw patient data
- Vendor contract updated with explicit TEE guarantees
Current developments and effects
Confidential computing is moving from a niche cloud security feature to an expected baseline for regulated AI deployments.
BSI C5:2026 and regulatory recognition
BSI’s updated BSI C5 cloud security catalog, version C5:2026, introduces confidential computing criteria for cloud providers for the first time, alongside post-quantum cryptography requirements.
- Cloud providers must document TEE usage for qualifying workloads
- Auditors now assess attestation processes as part of C5 certification
- Procurement teams increasingly request confidential computing as a contract clause
Confidential AI inference at scale
Cloud providers are extending confidential computing from general compute to GPU-accelerated inference, closing the gap that previously excluded large language model workloads from TEE protection.
Market and hardware expansion
Analyst firms describe double-digit annual growth in adoption as more chip generations ship with built-in TEE support by default rather than as an add-on.
Conclusion
Confidential computing closes the last unprotected gap in the data lifecycle by securing information while it is processed, not only when stored or transmitted. For enterprises with regulated or sensitive data, it turns cloud and hybrid AI deployment from a compliance obstacle into a viable option backed by hardware guarantees rather than contractual promises. As BSI and other regulators formally recognize the technology, it is shifting from a specialist feature to a standard expectation in AI procurement. Companies that build attestation requirements into vendor selection now will face fewer compliance surprises as adoption becomes routine.
Frequently Asked Questions
What is confidential computing in simple terms?
Confidential computing keeps data encrypted while a computer is actively working with it, using a protected hardware area called a trusted execution environment. Neither the cloud provider nor the operating system can read the data during processing.
Is confidential computing worth it for a company with fewer than 200 employees?
Yes, when the company handles regulated data such as patient records, financial information, or proprietary designs. Smaller manufacturers increasingly face data protection questionnaires from larger customers, and confidential computing provides technical evidence rather than policy statements alone.
How does confidential computing relate to GDPR and the EU AI Act?
Confidential computing supports GDPR’s technical and organizational measures requirement by proving data remains inaccessible to third parties during processing. It also helps satisfy EU AI Act data governance obligations for high-risk systems with verifiable proof of controlled processing.
What does confidential computing cost to implement?
Costs depend on workload volume, since confidential-computing-capable instances typically carry a modest premium over standard compute. Most companies start with a pilot on a single sensitive workflow before expanding.
Do we need our own IT infrastructure to use confidential computing?
No. Confidential computing is available through major cloud providers on TEE-enabled instances, so companies can adopt it without operating their own data center. Internal IT typically manages contract terms and attestation review rather than the hardware itself.
How do enterprise AI platforms handle confidential computing?
Platforms such as Superkind can run within a customer’s chosen infrastructure and jurisdiction, with confidential computing available as a control for particularly sensitive workloads. This keeps processing verifiably isolated while a company still benefits from managed AI infrastructure.
