Artificial intelligence is ready to rewrite how banks underwrite loans, how hospitals read diagnostic scans, and how governments model risk. There is just one problem: the sensitive data these institutions hold cannot leave their walls, and the developers whose models could put that data to work refuse to hand their proprietary systems over to infrastructure they do not control. This is not a technical inconvenience. It is a structural stalemate.
The reason it matters right now is that AI capability has outpaced the trust architecture needed to deploy it safely in regulated environments. Frameworks like PCI-DSS, Know Your Customer (KYC), anti-money-laundering (AML) rules, and HIPAA are not advisory. They materially dictate which infrastructure an AI workload is legally permitted to touch, which means entire sectors sit locked out of the productivity gains that less-regulated industries are already banking.
The answer to this deadlock is a category of technology called confidential computing, and its relevance to finance is becoming impossible to ignore. This piece explains what confidential computing actually is, why it is the structural fix for this specific problem, and why the companies building this infrastructure layer represent a theme worth watching as AI enters its next deployment wave.
The two-sided trust problem blocking AI in regulated industries
If you assume AI adoption in banking or healthcare is mainly a cost or capability question, the reality is more awkward than that. The blocker is not budget and it is not model quality. It is a trust impasse that neither party can break by moving first.
Here is the shape of it. Data owners, a bank holding transaction records or a hospital holding genomic files, cannot legally send that data out to external AI infrastructure. At the same time, the model developers whose tools could analyse it will not expose proprietary model weights, the trained parameters that make a model valuable, to infrastructure they do not oversee.
The deadlock is simple to state and hard to solve: the data cannot go out, and the models cannot safely come in.
What makes this structural rather than a matter of preference is regulation. In financial services, PCI-DSS, KYC, and AML frameworks bind which systems can process customer information. In healthcare and life sciences, HIPAA governs protected health information and genomic data with equal force. These are legal constraints, not internal policies an institution can waive when convenient.
You might assume conventional encryption already handles this. It does not, and the reason is precise.
Encryption protects data in two states: when it sits in storage and when it moves across a network. It does nothing while the data is being actively computed on. The moment information is loaded into memory and processed, it is exposed, which is exactly the gap where the trust problem lives.
The PCI DSS requirements for AI in payment environments confirm that an AI system’s complexity does not relax the obligation to protect data during storage, processing, and transmission, meaning the execution gap that conventional encryption leaves uncovered is a compliance exposure, not merely a theoretical risk.
- Data at rest: covered by conventional encryption (storage).
- Data in transit: covered by conventional encryption (moving across networks).
- Data in use: not covered. This is the execution gap where sensitive information sits unprotected during computation.
The takeaway is that you cannot solve this by shifting workloads to the cloud or bolting on more encryption layers. The vulnerability is in the execution phase itself, which means a genuinely new category of infrastructure is required.
This is not an abstract concern. The commercial pressure is concentrated exactly where the regulation bites hardest. The banking, financial services, and insurance (BFSI) vertical accounts for roughly 28.5% to 30% of global confidential computing revenues, according to DataIntelo and SNS Insider. Healthcare is the fastest-growing vertical, expanding at 14.2% annually per DataIntelo, driven by HIPAA obligations and genomics research. Together, finance and healthcare are the two sectors most desperate to break this deadlock, which is why they represent the largest share of near-term demand.
When big ASX news breaks, our subscribers know first
How confidential computing works: hardware enclaves, attestation, and the execution gap
Read a product sheet for a regulated-sector AI platform and you will likely see a phrase like “TEE-protected workload.” That acronym is the entire mechanism, so it is worth unpacking layer by layer, because the architecture does not just assert trust. It engineers it.
A trusted execution environment (TEE) is a hardware-isolated region of CPU and GPU memory where computation happens under protection enforced by the chip itself, not by software policy that an administrator could override. That distinction matters: hardware enforcement means the rules cannot be quietly changed by whoever runs the machine.
The second piece is cryptographic attestation. Before any sensitive data or model is decrypted and loaded into the enclave, attestation cryptographically verifies that the execution environment and its enforced policies are exactly what they claim to be. This verification step is what lets both sides trust the environment without having to trust each other.
Here is the sequence in practice:
- The workload is submitted to the infrastructure.
- Cryptographic attestation verifies the environment and its policies.
- A hardware-isolated enclave is established.
- Sensitive assets, customer data and model weights, are decrypted only after verification and loaded into the enclave.
- Computation runs entirely inside the protected memory region.
- Results are returned, with the underlying data and model never exposed.
The consequence for each party is specific. Customer data encryption keys stay under the customer’s control throughout processing. Model weights and their keys remain inside the developer’s trust domain, inaccessible even to the operator or administrator running the physical hardware. Neither the cloud provider nor the data centre operator can see either asset during execution.
The table below shows where conventional encryption stops and where confidential computing extends coverage.
| Data state | Conventional encryption | Confidential computing |
|---|---|---|
| At rest (storage) | Covered | Covered |
| In transit (network) | Covered | Covered |
| In use (execution) | Not covered | Covered, via hardware TEE and attestation |
What the NVIDIA Confidential Computing platform delivers in practice
NVIDIA Confidential Computing is the leading GPU-based implementation of this architecture, now in its third generation across the Hopper, Blackwell, and Vera Rubin hardware platforms. Each generation has widened the deployment envelope: Hopper established GPU-based enclaves, Blackwell brought performance overhead down to production-viable levels, and Vera Rubin extends near-unencrypted performance to rack scale via NVLink and NVLink-C2C, allowing secure deployment on shared infrastructure from edge to cloud.
That performance overhead figure is the detail that should catch your attention. On Blackwell-class hardware, the overhead of running inside a protected enclave is typically under 10%. That is not a benchmark curiosity. It is the signal that confidential computing is now commercially deployable, because earlier generations carried overhead heavy enough to make production AI workloads uneconomical.
Adoption confirms the shift. Cloud infrastructure operators including CoreWeave and Microsoft Azure have taken up the platform, which tells you this has moved from experimental to infrastructure-grade.
NVIDIA’s platform strategy of supplying every major frontier lab without competing with them is the same logic playing out in confidential computing: the Hopper, Blackwell, and Vera Rubin hardware families become infrastructure that model developers and cloud operators build on top of rather than around.
DataEnclave in practice: what VAST Data’s announcement reveals about where the market is heading
A single product announcement rarely tells you much on its own. This one is worth reading closely, because the decisions inside it, who partnered, what architecture was chosen, how it will ship, point to where the whole market is moving.
On 22 September 2026, VAST Data introduced DataEnclave, a confidential AI runtime built into the VAST DataEngine and VAST AI Operating System. It is in preview now, with general availability scheduled for Q1 2027 through VAST and participating hardware partners, including original equipment manufacturer channels.
The architecture is a direct implementation of everything described above. DataEnclave creates hardware-isolated confidential virtual machines spanning CPUs and GPUs, using NVIDIA Confidential Computing to establish the secure runtime and attestation service. Model owners control when their keys are released, based on verified environment policies, while customer data keys stay under customer control throughout. Both the model and the data remain protected inside CPU and GPU memory during computation.
The most strategically revealing detail is the partner list, grouped here by role:
- AI model providers: Cohere, Deepgram, Factory, Fundamental, TwelveLabs
- AI security: CrowdStrike
- Infrastructure and hardware: NVIDIA, Cisco, Supermicro
When model developers of Cohere’s profile commit engineering effort to a confidential computing runtime, that is the signal to watch. It means they judge the regulated-sector AI market large enough to build for, not merely tolerate as an edge case. Model developers are moving to participate, not waiting on the sidelines.
VAST Data frames the value proposition as giving customers simultaneous authority over cost, performance, model selection, and data privacy, a combination that was structurally impossible before confidential computing existed.
There is a second framing here worth noting. VAST Data positions model weights as an emerging category of enterprise intellectual property that requires secure management at scale, which reframes this as an infrastructure management challenge rather than a narrow security feature.
For anyone tracking AI infrastructure as an investment theme, DataEnclave is a concrete, dateable signal. It has a named launch window, named partners, and a named hardware foundation. That is evidence the confidential computing layer is moving from research toward revenue.
How big is the market, and which sectors are driving demand?
The honest answer to the market-size question starts with a caveat: analyst estimates vary widely. For 2025, baseline figures span roughly USD 8.2 billion to USD 24.35 billion, and the right move is to present that range rather than pick a single number, because the variation reflects different scope and methodology definitions, not one firm being wrong.
Underneath the spread, the direction is strikingly consistent. Every major forecast points to rapid growth over the coming decade.
| Source | 2025 baseline | Projected CAGR | Forecast horizon |
|---|---|---|---|
| SNS Insider | USD 17.37B | 55.39% | USD 590.16B by 2033 |
| Polaris Market Research | USD 24.11B | 34.7% | Through 2034 |
| DataIntelo (platforms) | USD 8.2B | 14.8% | USD 24.7B by 2033 |
Treat these as complementary rather than competing truths. SNS Insider and Polaris disagree on the baseline and the growth rate, but both describe a market compounding well above the pace of general cloud infrastructure.
The demand engine is concentrated in two verticals and one country:
- BFSI: approximately 28.5% to 30% of global confidential computing revenues, per DataIntelo and SNS Insider, driven by PCI-DSS, KYC, and AML mandates.
- Healthcare: the fastest-growing vertical, expanding at 14.2% annually per DataIntelo, driven by HIPAA and genomics research.
- United States: roughly USD 3.33 billion in 2025 per SNS Insider, around 19% of the global total, driven by financial-services regulation and federal data-in-use protection requirements.
What this tells you is straightforward. Even at the lower bound of the estimates, BFSI and healthcare together represent a multi-billion-dollar addressable market specifically for the trust-layer infrastructure confidential computing provides. That the growth rates across every source outpace general cloud growth signals this is a market still forming, not one nearing saturation.
AI regulation ambiguity across jurisdictions is part of what makes the compliance-by-architecture approach of confidential computing commercially compelling: when statutory frameworks remain a patchwork of voluntary standards and a single enacted federal law, institutions that can demonstrate hardware-enforced data controls gain a structural compliance advantage independent of which rules eventually prevail.
What this technology shift means for AI’s next deployment wave
Step back and the structural picture is clear. Confidential computing is not a discretionary security add-on for regulated industries. It is the prerequisite that makes AI deployment in finance and healthcare viable at scale, which reframes adoption in these sectors as a question of when, not whether.
The broader backdrop shaping this demand is that AI regulatory risk is now a structurally self-reinforcing feature of the sector, not a cyclical episode, which means the compliance architecture that confidential computing provides is not a transitional solution but a permanent infrastructure requirement.
The investable expression of that shift is already taking shape. NVIDIA’s hardware platform sits at the foundation, cloud operators like CoreWeave and Microsoft Azure provide the infrastructure, AI runtimes like DataEnclave productise the layer, and model developers are committing to enclave-compatible deployment. The ecosystem is assembling in public.
The regulated-sector pressure described here maps directly onto the sovereign and enterprise demand that has been driving NVIDIA’s revenue shift, with governments and on-premise deployments now leading growth ahead of hyperscalers, a structural realignment that makes confidential computing infrastructure increasingly central to NVIDIA’s customer base.
The signal that matters most is not the current market size but the structural lock-in. Once a regulated institution adopts a confidential computing runtime and builds its workflows around it, switching costs climb quickly, which makes early platform decisions competitively significant for both vendors and the customers choosing them.
Caution is still warranted. The public record contains no named regulated-sector production case studies yet, DataEnclave remains in preview until general availability in Q1 2027, and the analyst market-sizing range is wide enough to justify scepticism about any specific revenue projection. This is a pre-commercial market at scale, not a proven one.
Here is what to watch:
- DataEnclave general availability and early enterprise uptake from Q1 2027.
- NVIDIA Vera Rubin architecture deployment timelines at rack scale.
- Regulatory decisions that expand or restrict AI use in financial services under PCI-DSS, KYC, and AML.
- The first production case study disclosures from regulated institutions.
This article is for informational purposes only and should not be considered financial advice. Investors should conduct their own research and consult with financial professionals before making investment decisions.
Past performance does not guarantee future results, and the market projections cited here are subject to changing conditions and methodology differences across analyst firms.
