The GTC Berlin keynote got the headlines, but two of NVIDIA's same-day infrastructure posts say more about where AI capacity is going in Europe and how it is meant to be secured. One, on Confidential Computing, introduces Confidential Bare Metal. The other, on NVIDIA Cloud Partners, lists the European, Nordic, African and Central Asian clouds building Vera Rubin capacity and backing the OpenShell reference architecture. This post explains both, flags the vendor-only numbers, and links them to our keynote coverage.
TL;DR: what was announced
| Item | What NVIDIA says |
|---|---|
| Confidential Bare Metal | New option letting frontier model builders run sensitive workloads on third-party bare metal while keeping control of models and data |
| Converged options | Confidential Bare Metal, Confidential Containers (Kubernetes) and Confidential Virtual Machines |
| Hardware | Support extends to Grace Blackwell NVL72, HGX Rubin NVL8 and DGX Rubin NVL8 |
| DSX OS | Will support all Confidential Computing modes as a reference for AI factory builders |
| Cloud partner capacity | Nscale, Crusoe, Nebius, Mistral, Verda and others expanding NVIDIA-based capacity |
| Nscale power result | 37% more GPUs and nearly 50% higher aggregate inference throughput in the same power budget (NVIDIA-reported) |
| OpenShell reference architecture | Supported by a long list of AI clouds |
What problem does Confidential Bare Metal solve?
Model builders want to rent GPU capacity wherever it exists, including neoclouds and third-party data centers, without handing the operator a view of their weights or customer data. Standard virtual machines keep tenants apart, but the operator still controls the host. Confidential Computing uses hardware-rooted isolation and cryptographic attestation so that models and data stay protected while they run, and so that the tenant can check what software is actually running.
Confidential Bare Metal adds a missing deployment style. Until now, NVIDIA's confidential options centered on virtual machines and containers. Bare metal matters because frontier labs often want to own the whole stack, including host and platform software, for performance and control. NVIDIA says new platform controls protect data in transit, measure platform integrity and enforce hardware-level access restrictions, letting builders operate their own software stack on third-party infrastructure. NVIDIA's post frames this as a way to serve "high-value workloads" that need strong model and data privacy.
Locked box with gears turning inside, illustrating NVIDIA Confidential Bare Metal keeping a model protected while it runs
Who is on board?
Two named integrations stand out. Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault, extending hardware-rooted security to the GPU, protecting models and data in memory and across interconnects during execution, according to CTO Phil Blunsom, quoted by NVIDIA. Google Cloud is extending Confidential Bare Metal support to A4X Max instances powered by GB300 NVL72, combining non-virtualized compute with cryptographic protection for training data and model IP, in a statement attributed to distinguished engineer Andrés Lagar-Cavilla.
NVIDIA lists CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr as supporting Confidential Computing deployments, and says Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull will support the capabilities through NVIDIA-Certified Systems. "Supports deployments" is a broad phrase: the post does not say which providers offer Confidential Bare Metal today versus plan to, so check each provider's availability before assuming it can be bought. This sits next to the earlier Google Cloud news that its Vera Rubin A5X instances reach general availability next month.
What do the European AI clouds add?
The cloud-partners post is a roster with a few measurements. Highlights:
- Nscale says, in NVIDIA's account, that in tests on GB300 NVL72 systems the NVIDIA DSX MaxLPS power-allocation feature enabled 37 percent more GPUs and nearly 50 percent higher aggregate inference throughput within the same provisioned power. It plans Vera Rubin deployment for frontier-model training across five European markets.
- Crusoe is developing Spark, liquid-cooled modular AI factories designed for Vera Rubin, for low-latency inference in EMEA.
- Nebius has adopted NVIDIA Groq 3 LPX, using Spectrum-X Ethernet to integrate it with Vera Rubin NVL72 on its Token Factory, offers a Physical AI Workbench, and launched three NVIDIA retail agent blueprints in early access.
- Baseten built a specialized code-review routing model with Nemotron 3.5 Lightning for CodeRabbit, improving routing agreement from 75.8 to 80.7 percent while cutting estimated inference cost 50 percent on the evaluated workload.
- Fireworks and Era4 are partnering on direct liquid-cooled Blackwell Ultra capacity in Chesterfield, UK.
- Mistral is expanding its NVIDIA infrastructure, including Vera Rubin planned for delivery in 2027, after training Mistral Large 4 on 3,800 Grace Blackwell GPUs. See our report on the Mistral and NVIDIA engineering collaboration.
- Verda plans Vera Rubin deployment, and Aleria, Cassava, Firebird, G42, Radiant, SWI Compute and Vultr are also expanding NVIDIA-powered capacity.
How much should you trust the power claim?
The Nscale figure is the most interesting number in the post, because power is the binding constraint for AI factories, and a feature that squeezes more GPUs into a fixed budget would be valuable. It is also the least checkable. NVIDIA gives no workload, no baseline configuration, no duration and no indication of whether the 37 percent more GPUs ran at lower clocks. "Nearly 50 percent higher aggregate inference throughput" is the output of a test on NVIDIA's DSX feature run by a partner and reported by NVIDIA. Treat it as a promising vendor claim that needs a published methodology or an independent measurement. We applied the same lens to the keynote's container-deployment claim in our DSX POD check, and for how independent measurements of NVIDIA's Vera CPU compare with the marketing, see the Chips and Cheese tests.
The CodeRabbit result is similarly narrow: an estimated 50 percent saving on one evaluated routing workload, with agreement rising by under five points. Useful as an example of customizing a small model; not evidence about general cost.
How does this tie to agent safety?
The cloud post also repeats the OpenShell Reference Architecture, with Vera Rubin NVL72 for inference, Vera CPUs running OpenShell for harnesses and tool use, and BlueField-4 DPUs running Sentry for in-silicon enforcement. A long list of providers, including CoreWeave, Crusoe, DigitalOcean, G42, Lambda, Nebius, Nscale and Vultr, say they support it. Confidential Computing is positioned as the layer underneath: OpenShell limits what an agent can do, and Confidential Computing protects the models and data those agents rely on while they run. For background on the agent-side pieces, see our explainers on OpenShell and Sentry and BlueField-4 hardware agent security.
Two cautions. Confidential Computing protects against a curious or compromised operator and neighboring tenants; it does not stop an agent from misusing the access it legitimately has, and it does not fix a vulnerable model or tool. And hardware-rooted trust only helps if customers actually verify attestation; a protection nobody checks is a checkbox. If you run coding agents and want a policy layer that blocks dangerous actions before they execute, see AgentBeam, the agent security platform from the explainx.ai team.
What should buyers ask providers?
- Is Confidential Bare Metal generally available on your platform today, and on which GPU generations?
- What does attestation show, who verifies it, and can we automate that check?
- What is the performance overhead versus non-confidential bare metal on our workload?
- Which parts of the host software stack do we control, and which does the provider keep?
- How are logs, crash dumps and support access handled so they do not leak protected data?
- For power claims such as MaxLPS: what test conditions and what independent numbers exist?
What does "sovereign" mean in this context?
NVIDIA uses the word repeatedly, and it is worth pinning down. In the cloud-partners post, sovereign means regional AI clouds that keep compute close to the data and expertise of the country or region where it is used, giving customers "greater choice and control over where workloads and data reside." That is a statement about location and control, not about who owns the chips: the stack is still NVIDIA's from silicon to networking to the DSX platform software. Confidential Computing adds a technical meaning on top, since attestation lets a customer verify what runs on rented hardware even when the operator is a third party.
For a European company, the practical test is contractual and technical together. A provider can host in the right country and still be unable to prove isolation from its own staff; a provider with attestation can offer a stronger guarantee even when hardware sits abroad. Buyers weighing the two should treat location, legal jurisdiction of the operator, and verifiable isolation as separate questions rather than one box labeled sovereign.
Why it matters
The pattern across both posts is that AI infrastructure is being sold as a trusted, sovereign, power-efficient stack, not just as chips. For European customers, that package addresses three worries at once: where compute sits, who can see the data, and whether power limits cap growth. Whether it delivers will depend on measured numbers that, for now, mostly come from NVIDIA and its partners. Our GTC Berlin 2026 recap covers the rest of the keynote.
Related reading
Details reflect NVIDIA's October 21, 2026 blog posts; availability and figures are vendor-reported and may change.