Summary

• A5X instances using NVIDIA Vera Rubin and wider EMEA regional availability are planned for November 2026.
• HGX B300 on Distributed Cloud and confidential G4 instances are generally available, while enterprise search is in preview.
• Regional data residency, local operational sovereignty and hardware protection during processing address different risks.

Google Cloud is expanding its collaboration with NVIDIA to supply new AI computing systems, confidential processing and sovereign deployment options in Europe. The announcements bring together infrastructure at different stages of release, from generally available local accelerators to future A5X capacity.

Unveiled on 21 October at NVIDIA GTC Berlin, the programme includes A5X instances using NVIDIA’s Vera Rubin NVL72 platform, improvements to large scale networking and storage, and additional services within Google Distributed Cloud. Google also describes new hardware-backed protections for models and data processed on public cloud systems.

The company says general availability of A5X and expansion into new regional locations to support Europe, the Middle East and Africa are planned for November 2026. That timetable should not be confused with currently available confidential G4 instances or NVIDIA HGX B300 systems on Google Distributed Cloud, which Google identifies as generally available now.

A European processing location can help with data residency, an isolated local installation can provide different operational controls, and confidential computing can protect selected information during processing. No single feature establishes complete sovereignty, security or compliance for every workload.

Scale promises depend on deployed capacity

A5X is designed around NVIDIA’s Vera Rubin NVL72 accelerator system, with Google’s Virgo Network providing connections within and between buildings. The proposed architecture could support as many as 80,000 Rubin processors at one site and 960,000 across several locations, according to the company.

These are architectural scaling figures, not a report that customers are currently running installations at those sizes. Real deployments depend on hardware supply, electrical capacity, cooling, network equipment and the ability to operate systems reliably across facilities.

Google also plans support for NVIDIA GPUDirect Storage through Managed Lustre, allowing some data to pass more directly from parallel storage into processor memory. Removing unnecessary transfers can improve performance when training or inference repeatedly consumes substantial datasets, although results depend on how applications organise data.

A separate caching layer will allow A5X applications to retain and reuse information from earlier model processing across different memory and storage resources. This is designed for lengthy conversations and agent workflows that repeatedly access a large context. Caching can reduce repeated computation, but capacity, retention and data separation still need careful management.

Google Kubernetes Engine is being extended with networking and scheduling features for distributed AI jobs. Managing a large cluster requires more than deploying accelerators: operators need to decide which application runs where, how network resources are allocated and what happens when a job fails or a shared component becomes congested.

Local infrastructure supports different sovereignty models

Google Distributed Cloud brings a managed software and computing environment into a customer’s premises or another controlled facility. Its air-gapped configuration is intended for applications that cannot depend on a normal internet connection, including uses involving sensitive intellectual property or restricted operational information.

Google says NVIDIA HGX B300 hardware, following an earlier preview, is now generally available in Distributed Cloud. It is also expanding the platform with Gemini 3.5 Flash for multimodal tasks involving text, images, audio and video. Enterprise search powered by retrieval-augmented generation remains in preview, not general availability.

In an isolated environment, enterprise search can index records and retrieve supporting passages without sending documents to an ordinary hosted application. That may help organisations control the movement of sensitive information, but the quality of answers still depends on document permissions, current records and the way retrieved passages are interpreted.

Air-gapped systems impose operating responsibilities of their own. Administrators must introduce software updates, models and authorised external information without undermining isolation. Data access, backup, monitoring and incident response remain essential even when network exposure has been reduced.

Google is also extending support for open-weight models such as Gemma, Mistral and NVIDIA Nemotron within its sovereign portfolio. Running model weights in a controlled environment can offer customers more deployment choice, but it does not guarantee that training data, licensing obligations or every software dependency is fully transparent.

Other offerings include Google Cloud Data Boundary for regional controls on public infrastructure and Google Cloud Dedicated, with independent partners such as S3NS in France and Thales in Germany. These arrangements involve different administrative and contractual responsibilities. Buyers need to establish which entity operates a service rather than treating every product carrying a sovereign label as equivalent.

Confidential computing addresses data in use

Google has separately made confidential G4 instances generally available with NVIDIA RTX PRO 6000 Blackwell Server Edition processors. Confidential computing is also available on specified A4 instances using NVIDIA HGX B200 hardware and Intel Trust Domain Extensions.

These technologies use hardware-backed trusted execution environments to reduce exposure of information while it is being processed. Conventional encryption protects data at rest or during transmission, but calculations require information to be available within a computing environment. Confidential computing aims to restrict who or what can inspect it at that stage.

Google has also introduced confidential bare metal capabilities for high performance systems, including an A4X Max configuration based on NVIDIA GB300 NVL72. The announcement describes this as an extension of hardware-rooted protection, but does not establish that every configuration has the same availability, location or security properties.

Attestation can help verify that a workload is running in an expected protected environment. However, it does not determine whether users are correctly authorised, whether information should have been processed in the first place or whether an AI response is accurate.

A practical procurement assessment must therefore combine technical controls with operational and legal evidence. The supplier must identify which hardware is available in the desired region, how data and keys are handled, and which parties retain administrative access. Prospective capacity figures and product announcements cannot substitute for those details.

Google’s investment broadens choices for running AI in public, partner operated and isolated environments. Its near term value will depend on confirmed regional availability, consistent performance and controls that remain effective once multiple models and enterprise applications share the same infrastructure.