Introduction
Confidential computing has moved from a niche hardware feature to a regulatory focus point for protecting data‑in‑use. Ubuntu’s official blog explains that confidential computing “uses trusted execution environments to help isolate workloads from parts of the underlying infrastructure, reducing the amount of software and privileged access that must be trusted by default” Ubuntu. The same announcement notes that while encryption at rest and in transit remains essential, runtime protection is now being codified into standards and regulations worldwide.
Why data‑in‑use matters
Most security programs protect data at rest (e.g., encrypted disks) and data in transit (e.g., TLS). However, when an application processes sensitive information, that data resides in memory and can be accessed by privileged components such as the hypervisor, OS, or cloud provider. The Ubuntu article highlights high‑risk use cases—financial analytics, healthcare research, public‑sector data sharing, and confidential AI inference—where any leakage during processing could have severe compliance or reputational consequences. By moving the protection boundary into the CPU’s enclave, confidential computing reduces the attack surface for these critical workloads.
Emerging regulatory drivers
Regulators are beginning to require explicit guarantees for data‑in‑use. The National Institute of Standards and Technology (NIST) Cybersecurity Framework now includes subcategory PR.DS‑10, which mandates the confidentiality, integrity, and availability of data‑in‑use PR.DS‑10. CSF Tools expands on this requirement, describing concrete implementation examples such as removing confidential data from memory when no longer needed CSF Tools.
In Europe, the Digital Operational Resilience Act (DORA) forces financial institutions to demonstrate robust technical controls, and confidential computing is positioned as a way to satisfy those controls. The UK’s Prudential Regulation Authority (PRA) SS2/21 explicitly calls for robust controls for data in memory, aligning with the NIST guidance. Meanwhile, the General Data Protection Regulation (GDPR) requires “appropriate technical and organisational measures” to protect personal data throughout its lifecycle, which now implicitly includes the processing stage.
China has also joined the movement, publishing GB/T 45230‑2025—a national standard on confidential computing that came into effect in August 2025. These parallel developments illustrate a global consensus: safeguarding data while it is being processed is no longer optional for regulated sectors.
Standards converging on confidential computing
Standardisation is solidifying the technology’s legitimacy. The ISO/IEC committee is drafting DIS 25093‑1, titled “Cybersecurity, Confidential computing, Part 1: Overview and concepts.” The draft signals that confidential computing is moving beyond vendor‑specific marketing into a broadly applicable technical domain. NIST’s “Hardware‑Enabled Security: Confidential Computing of Data in Use in Cloud Computing and AI Workloads” further details how confidential computing can be employed for AI inference, where model weights and prompts often contain proprietary or sensitive data.
These standards are not merely academic—they provide concrete reference points for procurement, audit, and compliance teams. By aligning with ISO or NIST guidance, organizations can demonstrate that they have adopted a recognized best practice, simplifying regulatory reviews and third‑party assessments.
Practical implications for organizations
For enterprises, the shift to data‑in‑use protection translates into concrete operational steps. Below is a practical roadmap that synthesises the guidance from Ubuntu and the regulatory bodies:
- Assess workloads for sensitivity – Identify applications that handle personal data, financial records, health information, or intellectual property. The Ubuntu article lists several high‑risk categories; use those as a checklist.
- Select appropriate hardware – Choose a platform that offers trusted execution environments (e.g., Intel SGX, AMD SEV, ARM TrustZone). The Ubuntu blog notes that confidential computing is now available as a managed service from cloud infrastructure providers.
- Integrate attestation – Deploy remote attestation mechanisms so that a workload can prove it is running inside a verified enclave before receiving secrets. This aligns with NIST’s recommendation to protect keys and data during processing.
- Update CI/CD pipelines – Incorporate enclave‑compatible build steps, ensuring that container images are signed and that secrets are injected only after successful attestation.
- Audit and monitor – Continuously log enclave lifecycle events and enforce policy that any deviation (e.g., unexpected exits) triggers alerts. Audits can reference NIST’s PR.DS‑10 implementation examples.
- Document compliance – Record the technical controls, hardware specs, and attestation logs in a compliance artifact that maps to ISO/IEC DIS 25093‑1 and DORA requirements.
These steps are echoed in other zBrandco analyses. For example, How Art Museums Use Visitor Data to Reshape Exhibits discusses the importance of protecting visitor analytics—a use case that similarly benefits from confidential compute. Likewise, Hugging Face data: 98% of PEFT fine‑tunes use LoRA… illustrates how model fine‑tuning pipelines can leverage confidential hardware to keep proprietary weights secure.
Vendor landscape and adoption
The Ubuntu blog explains that confidential computing is increasingly available as a managed service from cloud infrastructure providers, enabling organizations to run sensitive workloads in hardware-backed enclaves without trusting the underlying platform.
Organizations should evaluate these offerings based on:
- Performance overhead – Confidential enclaves introduce CPU and memory constraints that vary by workload and hardware generation.
- Attestation APIs – Ensure the selected platform exposes an API that integrates with your existing secret‑management solution.
- Ecosystem support – Look for ready‑made development kits and community‑maintained libraries that simplify enclave development.
By grounding decisions in published data from each provider, readers can make informed trade‑offs between security and performance.
Real‑world use cases
Beyond the regulatory narrative, confidential computing is already powering real‑world solutions across multiple sectors:
- Financial services – Banks are using enclaves to run risk models on customer data without exposing the raw inputs to the underlying cloud infrastructure.
- Healthcare research – Projects that analyse genomic data can keep patient‑level records encrypted while still enabling large‑scale computation.
- AI inference – Companies deploying large language models on shared clouds employ confidential compute to protect model weights and inference prompts from rogue insiders.
These examples reinforce the article’s core premise: protecting data‑in‑use is no longer a technical curiosity—it is a compliance imperative. As more jurisdictions adopt data‑in‑use regulations, the demand for hardware‑backed runtime protection will continue to grow across industries.
Getting started: A concise checklist
| Step | Action | Why it matters |
|---|---|---|
| 1 | Identify sensitive workloads | Targets the data‑in‑use risk surface. |
| 2 | Choose a TEE‑enabled platform | Provides the cryptographic isolation needed. |
| 3 | Enable remote attestation | Guarantees the enclave’s integrity before secrets are released. |
| 4 | Integrate into CI/CD | Prevents accidental deployment of non‑confidential binaries. |
| 5 | Log and monitor enclave events | Enables detection of breaches or misconfigurations. |
| 6 | Map controls to standards | Simplifies audit and regulatory reporting. |
Following this checklist will help organizations align with emerging standards while avoiding the common pitfalls highlighted in the Ubuntu source.
Conclusion
Confidential computing is poised to become a cornerstone of modern data‑security architectures. With regulatory bodies from the United States, Europe, and China explicitly addressing data‑in‑use, the technology is moving from an optional add‑on to a mandated control. By leveraging trusted execution environments, integrating attestation, and aligning with standards such as NIST’s CSF and ISO/IEC DIS 25093‑1, enterprises can protect sensitive workloads, satisfy compliance demands, and maintain a competitive edge in an increasingly data‑driven world.
This guide is based on the Ubuntu announcement and publicly available standards. All external references are linked directly to the factual statements they support.
