Encrypting data at rest and in transit is already routine. Encrypting it while it's actively being processed on a GPU — that's what confidential computing promises, and by 2026 it's a real option for AI workloads.
Confidential computing places workloads inside a hardware-protected Trusted Execution Environment (TEE) that encrypts memory and strictly controls access — helping ensure that not even the cloud provider, system administrators, or system-level software can see or modify the data while it's in use. It's the missing piece: encryption at rest and in transit were already standard; encryption "in use" during active processing is what's new.
Process-based TEEs, like Intel SGX, isolate a small application enclave with the CPU as the root of trust. Confidential VMs built on AMD SEV-SNP or Intel TDX extend hardware-based memory encryption to an entire guest virtual machine, trading a larger trusted computing base for dramatically less adoption friction — you don't need to redesign the application to run it inside a full confidential VM.
AWS doesn't have a branded "confidential VM" product — by default it applies always-on memory encryption across the entire Nitro System, and adds isolated Nitro Enclaves for the most sensitive workloads, a different architecture from a traditional confidential VM. Azure announced general availability of confidential VMs with Intel TDX in early 2026, and offers confidential computing with NVIDIA H100 GPUs through the NCC H100 v5 series under AMD SEV-SNP, plus a regional option with an Intel TDX + H100/H200 stack.
Fortanix Confidential AI wraps NVIDIA confidential computing GPUs (H100, H200, Blackwell) with a key management and attestation control plane, aimed at enterprise model serving — with March 2026 announcements covering both inference and model IP protection in enterprise "AI factories." It's the piece that was missing to be able to say, verifiably, that not even the cloud provider can see the model weights or inference data while they're being processed.
Confidential computing isn't free in terms of complexity or performance — it makes sense when the data in use is genuinely sensitive (healthcare, finance, classified government data) and the threat model explicitly includes the infrastructure provider itself as part of the surface that needs protecting. For most enterprise AI workloads without that level of regulatory sensitivity, standard encryption at rest and in transit remains sufficient — it's worth evaluating case by case before taking on the extra cost.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel