Confidential computing is becoming the default way to run AI inference you don't control
Every company sending proprietary data to a third-party AI model — a hospital running patient records through a clinical summarization API, a law firm feeding contracts into a document-review model, a bank scoring transactions through a fraud-detection endpoint — is making the same trust assumption: that the cloud provider and model vendor aren’t reading the data in transit. For most of the industry’s history, that assumption has rested entirely on contracts and reputation. Confidential computing is the technical answer that replaces trust with proof, and in 2026 it’s moving from a niche compliance checkbox to a default expectation for sensitive AI workloads.
What confidential computing actually does
The core idea is a trusted execution environment, or TEE: a hardware-isolated region of a chip where data is decrypted and processed, but which is inaccessible even to the operating system, the hypervisor, or a cloud administrator with root access to the physical machine. For years this existed mainly at the CPU level — Intel TDX and AMD SEV-SNP both create encrypted virtual machines that cloud operators can run workloads inside of, but can’t inspect. That protected data at rest and most of what happened in a CPU, but it did nothing for the GPU, which is where the actual AI inference computation happens.
The missing piece has been GPU-level confidentiality. Nvidia’s confidential computing mode, paired with Azure’s confidential VMs running AMD SEV-SNP alongside H100 GPUs, extends the encrypted boundary across the PCIe bus connecting CPU and GPU, so that the model weights and the data being processed are encrypted in transit between them and decrypted only inside an isolated enclave on the GPU itself. The customer can cryptographically verify — through remote attestation — that their workload is actually running inside that protected enclave before sending any sensitive data, rather than trusting a vendor’s word that it is.
Why this matters more now than it did two years ago
Confidential computing has existed as a concept for years without much adoption pressure, because most AI workloads didn’t involve sending regulated data to infrastructure the customer doesn’t control. That’s changed as healthcare, financial services, and legal sectors have moved from experimenting with AI to running production workloads against patient records, financial transactions, and privileged legal documents through third-party model APIs. Regulators in those sectors increasingly ask not just “do you have a data processing agreement,” but “can you prove, technically, that the vendor cannot access this data even if they wanted to.” A TEE with remote attestation is one of the few answers that satisfies that question with evidence instead of a signature.
The gap between cloud providers
Not every cloud offers the same level of protection, and the differences matter for anyone evaluating vendors. Azure’s approach pairs CPU-level confidential VMs with GPU-level enclaves, covering the full pipeline from data ingestion to inference. AWS’s Nitro Enclaves, by contrast, are CPU-only by design — they isolate the control plane and general compute, but GPU-based inference running alongside a Nitro Enclave requires additional manual architecture work to achieve an equivalent level of protection, since Nitro doesn’t natively extend the encrypted boundary onto the GPU the way Azure’s H100 confidential VMs do. Nvidia has said its newer Blackwell-generation GPUs are designed to run confidential mode with minimal performance penalty compared to earlier generations, which had historically been the main reason teams avoided the feature — confidential GPU workloads used to carry a measurable throughput cost.
What to check before you adopt it
If your organization is sending regulated data to a third-party AI API, three questions determine whether confidential computing is relevant to you right now: does the workload touch the GPU (training or inference), not just CPU-bound preprocessing; does your cloud provider's confidential offering actually extend to the GPU, or only to the CPU layer; and can you get remote attestation evidence you can show to an auditor, rather than a vendor’s written assurance. If the answer to the first two is yes, confidential computing is no longer an exotic option — it’s close to the default architecture regulators will expect you to justify not using.