Defense Industry Defense Technologies Europe NATO

Issue Brief October 9, 2026 • 2:24 pm ET

Enabling NATO’s technological transformation

Bottom lines up front

NATO has access to advanced technology; its ability to adopt it is another matter.
Cloud-enabled infrastructure is a critical enabler—and a central test of NATO’s ability to close this gap.
NATO’s future advantage will depend on how quickly and effectively it can turn technological advances into Alliance-wide operational effects.

Executive summary

NATO has made significant progress in advancing emerging technologies, including cloud-enabled infrastructure, artificial intelligence (AI), data analytics, and other digital capabilities. Initiatives such as the NATO Innovation Fund, the Defence Innovation Accelerator for the North Atlantic, the Alliance’s digital transformation agenda, and emerging cloud-and-edge efforts such as Allied Software for Cloud and Edge Services reflect a clear recognition that technological advantage will be central to future deterrence and defense.¹

Yet the core challenge facing the Alliance is not access to technology. It is NATO’s ability to adopt, scale, integrate, and ensure interoperability of these technologies into operational capabilities at the speed required by the modern battlefield.

Cloud-enabled infrastructure is a central test case for this challenge. Cloud is more than an information technology modernization effort; it is the enabling layer for data sharing, artificial intelligence, distributed command and control, logistics visibility, operational resilience, and rapid software deployment across the Alliance. Without trusted, secure, and interoperable cloud environments, NATO’s ability to turn data into decision advantage will remain constrained.

This challenge is structural rather than technical.

While NATO has begun adapting its processes, many remain rooted in legacy, platform-centric approaches that are not optimized for rapidly evolving, software-driven, cloud-enabled, and data-centric systems. Governance and institutional dynamics continue to complicate the Alliance’s ability to move from agreement to execution. Decision-making authority remains distributed across multiple bodies, often resulting in misalignment between NATO institutions and national and EU-level frameworks. While senior leaders may agree on priorities, implementation can stall due to differing national perspectives on risk, investment, security, sovereignty, and execution. The result is a system in which many stakeholders have influence, but no single entity is clearly accountable for delivery.

These dynamics are further compounded by a federated Alliance moving at different speeds and with varying levels of ambition. Interoperability, particularly at the level of digital and cloud infrastructure, emerges as a central challenge. Allies understandably seek to preserve control over national data, systems, security requirements, and industrial choices, including through sovereign cloud approaches. But without common standards, trusted security frameworks, and deliberate alignment, NATO risks not simply inefficiency but the development of parallel, incompatible digital environments that limit its ability to operate as a coherent force.

At the same time, the character of warfare has evolved. Recent operational experience, particularly from Ukraine, demonstrates that the ability to compress the timeline from sensing to decision to action is now a decisive advantage. That compression depends increasingly on cloud-enabled data environments, AI-enabled analytics, resilient networks, and the ability to move information securely across commands, nations, domains, and classification levels. The barrier to generating strategic effect has dropped, while the importance of speed, scale, and integration has increased.

Against this backdrop, NATO allies are increasing defense spending at levels not seen in decades, with a growing emphasis on digital infrastructure, resilience, cloud, data, artificial intelligence, and emerging technologies. This presents a significant opportunity to strengthen both national and collective capability. NATO’s early cloud-and-edge initiatives show that progress is possible. But they also highlight the larger challenge: moving from promising initiatives to operationally relevant, secure, Alliance-wide capability at scale.

However, without corresponding reforms to how NATO develops, secures, and delivers capability, increased investment risks reinforcing existing inefficiencies. Resources may continue to flow through processes that are not optimized for speed, integration, interoperability, security modernization, or scalability—ultimately scaling fragmentation rather than capability.

This issue brief argues that NATO’s technology challenge is fundamentally a challenge of capability delivery. Cloud-enabled infrastructure makes this challenge visible. The issue is not whether NATO can access the cloud, AI, data tools, or commercial innovation. The issue is whether the Alliance can translate those capabilities into secure, interoperable advantages across thirty-two nations.

Building on prior analysis of cloud infrastructure and operational applications, this issue brief focuses on the institutional and process changes required to translate technological potential into operational capability. NATO’s future advantage will depend on how quickly and effectively it can turn that technological potential into Alliance-wide operational effects.

I. NATO faces a capability-delivery challenge

NATO has made meaningful progress in prioritizing emerging technologies and fostering innovation across the Alliance. The restructuring of elements within NATO’s cyber and digital enterprise, the establishment of the Defence Innovation Accelerator for the North Atlantic (DIANA), the NATO Innovation Fund (NIF), the Alliance’s digital transformation agenda, and emerging cloud-and-edge initiatives all reflect a clear recognition that technological advantage will be central to future deterrence and defense.²
Access to and availability of technology are not the issues.

Across the Alliance, there is no shortage of innovation, experimentation, and operational testing environments or exposure to emerging technologies in areas such as artificial intelligence, cloud computing, autonomy, data analytics, and advanced sensing. Many allies are advancing these capabilities at the national level, and NATO has taken steps to enable greater collaboration, experimentation, and digital transformation.³

Yet despite this progress, the Alliance continues to face persistent challenges in consistently translating technological potential into operational capability. Recent analysis of NATO innovation efforts suggests that the limiting factor is often the ability of organizations and operators to adopt, experiment with, and implement new capabilities effectively.⁴

NATO’s challenge is not innovation—it is delivery.

Cloud-enabled infrastructure makes this delivery challenge especially clear. Cloud is the enabling layer for many of the capabilities NATO needs: data sharing across national and NATO systems, AI-enabled analysis, distributed command and control, logistics and sustainment visibility, resilient mission operations, and rapid software deployment.⁵ Without secure, trusted, and interoperable cloud environments, NATO’s ability to turn data into decision advantage will remain limited.

This is why NATO’s emerging cloud-and-edge efforts are important. Initiatives such as Allied Software for Cloud and Edge Services (ACE) demonstrate that the Alliance recognizes the need for cloud-enabled, classified, and operationally relevant digital infrastructure.⁶ But these efforts also illustrate the larger challenge: moving from promising initiatives and limited implementation toward scalable, secure, and interoperable capability that can be used across the Alliance.

Specifically, the Alliance faces persistent difficulty in transitioning innovation into fielded capability, scaling solutions across thirty-two nations, and integrating those capabilities into coherent operational effects. Technologies that demonstrate promise in experimentation or limited fielding do not always progress into scalable, interoperable solutions that can be employed effectively across the Alliance.

This gap is becoming more consequential as the character of warfare evolves. Recent operational experience, particularly from Ukraine, demonstrates how rapidly the battlefield is changing. The proliferation of low-cost drones, persistent sensing, operating on secure and effective cloud platforms, commercial technologies, and networked data has compressed the timeline from sensing to decision to action, making speed and integration decisive factors in combat effectiveness.⁷

No longer theoretical, these trends are shaping operational outcomes today.

In this environment, speed, scale, and integration matter as much as, if not more than, technological sophistication. The side that can collect, move, protect, analyze, and act on data fastest will have the advantage. This shift reflects a broader transition toward warfare that is increasingly human-directed, machine-enabled, and executed at scale and speed.⁸

For NATO, this creates a fundamental challenge. The Alliance must first develop or access advanced technologies; it must also integrate them across a federated system of nations, commands, and institutions, each with its own authorities, priorities, risk tolerance, security requirements, and constraints. In many cases, the challenge is not only technical integration but overcoming legacy processes and cultural attitudes toward risk that slow adoption and implementation.

This is where the problem becomes structural.

While NATO’s processes have evolved, many were originally designed for an era defined by platform-centric systems, longer development timelines, and more centralized delivery models. Similar dynamics exist in information security practices and risk culture, where approaches rooted in earlier eras can slow the adoption of cloud-enabled, software-driven, and data-centric capabilities. Today’s environment is fundamentally different. Digital capabilities evolve rapidly, require continuous iteration, and depend on data and cloud architectures that must operate securely and seamlessly across national boundaries.⁹

At the same time, decision-making and implementation remain distributed across multiple bodies and stakeholders. While this reflects the political realities of the Alliance, it can create challenges in execution. Alignment at the senior level does not always translate into coordinated action at the working level. Institutional and national risk tolerance vary, and processes can prioritize consensus, sovereignty concerns, and security assurance over speed, despite recent efforts to streamline coordination across NATO structures.

The result is a system where progress is made—but often not at the pace or scale required.

This challenge is further magnified by uneven adoption across the Alliance. Some allies are advancing rapidly, while others face resource, institutional, or political constraints. Analysis of NATO capability development and integration highlights persistent variation in how allies adopt and implement new technologies and processes, reflecting differences in national capacity, governance, and prioritization.¹⁰ Without deliberate efforts to ensure interoperability, particularly at the level of cloud, data, and digital infrastructure, these differences risk creating fragmentation rather than strengthening collective capability.¹¹

This dynamic reinforces the central argument of this issue brief: NATO’s technology challenge is fundamentally a capability delivery challenge—ensuring that technologies can be adopted, scaled, secured, and integrated into operational capability across the Alliance, at speed.

II. The structural barriers to delivery

The challenge of translating technological potential into operational capability is the cumulative effect of multiple structural barriers—across governance, acquisition, security, industrial alignment, and institutional dynamics—that collectively slow the Alliance’s ability to move at the speed required. Individually, these challenges are manageable. Collectively, they create systemic friction.

Cloud-enabled infrastructure makes these barriers especially visible. Cloud is central to how NATO will share data, enable artificial intelligence, support distributed command and control, improve logistics visibility, and sustain mission operations across a federated Alliance.¹² Yet cloud also exposes the most difficult parts of NATO modernization: managing security accreditation, data governance, sovereignty, interoperability, industrial competition, and unclear ownership for delivery.¹³

These challenges are reinforced by the realities of a federated Alliance, where authority is distributed across NATO bodies and national governments, and where alignment must be continuously negotiated rather than assumed. The result is a system that can generate consensus but struggles to consistently deliver outcomes at speed and scale.

Five structural dynamics are particularly consequential.

1. One-size-fits-all governance model

NATO’s current approach to capability development and acquisition has historically applied a common governance model across a wide range of capability types, from major platforms to software-enabled systems, cloud infrastructure, and data architectures. This approach is increasingly misaligned with the nature of artificial intelligence, cloud-enabled capabilities, and other rapidly evolving digital systems, despite ongoing efforts to adapt governance and acquisition pathways.

Digital capabilities evolve rapidly, require continuous iteration, and depend on flexible integration across federated systems, cloud environments, and data architectures.¹⁴ Applying traditional, platform-centric acquisition processes to these capabilities introduces delay and limits the ability to adapt as technologies evolve.

Cloud makes this problem clear. A cloud environment is not a static platform that can be acquired once and left largely unchanged. It requires continuous software updates, security monitoring, data governance, user adoption, and integration with applications, networks, and mission systems. Treating cloud-enabled capability like a traditional platform risks slowing adoption and limiting the very flexibility that makes cloud operationally valuable.¹⁵

At the same time, more complex, long-term programs require structured oversight and industrial coordination that cannot be compressed without risk.

The core issue is that NATO’s governance model is not yet sufficiently tailored to the problem being solved, despite ongoing efforts to adapt and improve coordination across the Alliance.

Different capability categories require different pathways.

2. Conflating speed, production, and scale

A second challenge is the tendency to conflate distinct elements of capability delivery that require different approaches and policy levers. In practice, three separate challenges are often treated as one:

Acquisition speed: How quickly requirements are defined, decisions are made, and contracts are awarded.
Production speed: How rapidly industry can build and deliver capability once a decision is made and contracts are awarded.
Delivery scale: The ability to field, sustain, and integrate capability across the Alliance over time.

Progress in one area does not automatically translate to progress in others. This distinction is especially important for AI-enabled and software-driven capabilities, where the technology may evolve quickly but operational use still depends on trusted data, integration pathways, security approvals, user adoption, and sustainment.

Cloud again demonstrates the distinction. Procuring access to cloud services is not the same as delivering cloud-enabled operational capability.¹⁶ The Alliance must also address network connectivity, cross-domain solutions, identity and access management, data standards, application migration, cybersecurity, and the ability to operate across classification levels and national systems.¹⁷

As the US Government Accountability Office has noted, and as NATO Defense College analysis similarly highlights, major defense acquisition programs often take more than a decade to deliver capability—timelines that are fundamentally misaligned with the pace of technological change. For example, accelerating acquisition processes without addressing production capacity or long-term sustainment can result in limited fielding without meaningful operational impact. Similarly, industrial capacity without clear demand signals or integration pathways does not produce usable capability at the Alliance level.¹⁸

NATO’s emerging cloud-and-edge efforts show that the Alliance recognizes the need to move in this direction.¹⁹ But they also reinforce the broader point: Success depends not only on acquiring cloud capability but also on delivering it securely, integrating it with operational systems, and scaling it across the Alliance.

Failure to distinguish between these challenges leads to partial solutions and reinforces the gap between development and delivery.

3. The “pilot trap”: Innovation without scale

NATO and many allies have become increasingly effective at experimentation and early-stage innovation. Exercises, pilot programs, and limited fielding efforts have demonstrated the potential of emerging technologies across a range of mission areas. However, transitioning these efforts to scalable, fielded capability across the Alliance remains a persistent challenge.

Recent NATO and allied initiatives, including efforts by Allied Command Transformation, DIANA, and emerging cloud-and-edge programs, reflect a growing recognition of the need to bridge the gap between innovation and operational adoption. However, NATO does not appear to publicly track or report a consistent measure of how often pilots, experiments, or early-stage initiatives transition into fielded capability across the Alliance—a gap that itself underscores the need to focus on delivery outcomes, not just innovation activity.²⁰

The transition from prototype to operational capability requires sustained funding, production planning, security approval, integration across systems, and alignment among multiple stakeholders. Without these elements, promising solutions remain isolated demonstrations rather than fielded capabilities.

This dynamic, often referred to as the “pilot trap,” creates a perception of progress without delivering meaningful operational effect, particularly when pathways to scale and sustainment are not established from the outset.²¹

The pilot trap is especially relevant for cloud-enabled operational use cases.²² Demonstrating a cloud application, data-sharing tool, AI model, or logistics dashboard in an exercise environment is important, but it is not the same as fielding that capability across NATO commands and allied nations under real security, classification, bandwidth, sovereignty, and operational constraints.²³

Speed to prototype is not the same as speed to capability. In practice, this gap reflects the difficulty of aligning requirements, funding, security, production, sustainment, and integration across multiple stakeholders from the outset. Without that alignment, innovation efforts risk reinforcing fragmentation rather than reducing it.

4. Fragmentation outpacing integration

As allies invest in new technologies and capabilities, the pace of development is increasingly outstripping the Alliance’s ability to integrate those capabilities into a coherent and interoperable operational framework.²⁴

This imbalance is particularly evident in the digital domain. Differences in national systems, data standards, security requirements, cloud environments, and infrastructure create persistent challenges for interoperability. While individual nations may achieve significant advances within their own systems, those capabilities do not always translate seamlessly into Alliance-wide operations.

This issue highlights a broader strategic trade-off between Alliance-wide resilience and member-state sovereignty. NATO’s ability to operate as a coherent force depends on shared data, interoperable digital infrastructure, trusted cloud environments, and common standards. Yet individual allies understandably seek to preserve control over national systems, security requirements, industrial choices, sovereign cloud arrangements, and data governance. Managing this tension is central to preventing national modernization efforts from producing collective fragmentation. Sovereign cloud requirements are understandable. Allies have legitimate concerns about data control, jurisdiction, security, resilience, and industrial dependence.²⁵ But if sovereign cloud approaches are pursued independently, without common standards and interoperability requirements, they can create parallel digital environments that are secure nationally but difficult to integrate operationally.

This challenge is especially acute at the level of underlying digital and cloud infrastructure, where interoperability is a prerequisite for enabling data-driven operations and decision-making across the Alliance.²⁶ NATO’s Digital Backbone concept and data strategy recognize the need for shared data spaces, federated data meshes, cross-domain solutions, and federated stakeholder clouds.²⁷ These concepts are essential, but their operational value will depend on consistent implementation across NATO and national systems.

Without deliberate alignment, the risk is the emergence of parallel systems that are individually capable but collectively fragmented.

Recent operational observations reinforce the consequences of this fragmentation. Small, distributed forces leveraging drones and real-time data have demonstrated the ability to generate disproportionate effects against traditional formations, exposing vulnerabilities in survivability, dispersion, and decision-making speed.²⁸

The result is an Alliance that is technologically advanced, but operationally constrained.

5. Risk aversion and misaligned incentives

Finally, institutional, policy, and national-level dynamics often work against the speed and scale required for effective capability delivery, particularly when legacy rules and approval processes are not calibrated to rapidly evolving digital capabilities.

Across the Alliance, risk aversion—political, institutional, and security-related—can slow decision-making and limit willingness to adopt new approaches. This is especially true for cloud-enabled capability. Legacy security models were designed for more static systems and more controlled environments. Cloud, by contrast, requires continuous monitoring, rapid updates, shared data environments, and more dynamic approaches to identity, access, and risk management.

Security must be modernized. If security approval processes cannot move at the pace of digital capability, they become a delivery bottleneck. NATO’s challenge is to preserve trust and assurance while adopting more risk-informed, continuously monitored, and operationally relevant security models.²⁹

At the same time, industry requires predictable and aggregated demand signals to justify investment in production capacity, infrastructure, cloud services, software development, and long-term support.³⁰

NATO, as a coordinating body rather than a centralized procurement authority, faces inherent challenges in aggregating demand and providing long-term certainty across multiple stakeholders. Structures such as D2IA (Defence Industry, Innovation, and Armaments Division) and the CNAD (Conference of National Armaments Directors) are intended to improve coordination, align industrial priorities, and secure allied buy-in, but they do not by themselves resolve the larger challenge of translating shared priorities into committed demand and delivered capability.

Responsibility for coordination and execution is distributed across multiple entities—including the CNAD, NCIA (NATO Communications and Information Agency), NSPA (NATO Support and Procurement Agency), CDT (Cyber and Digital Transformation Division), and D2IA—without a single organization clearly accountable for aggregating demand and driving delivery across the Alliance. Allied Command Transformation also plays a key role in shaping capability requirements and aligning demand signals but does not control procurement or delivery. The result is a system in which no single entity owns the end-to-end process of translating demand into delivered capability at scale.

The result is a system in which:

Innovation is encouraged, but scaling is uncertain.
Cloud and data ambitions are recognized, but implementation remains uneven.
Security assurance is essential, but legacy approaches can slow adoption.
Demand signals are fragmented, limiting industrial expansion.
Delivery timelines are extended by misaligned incentives and authorities across stakeholders.

Taken together, these structural barriers reinforce the central challenge identified in this issue brief: NATO’s difficulty in delivering capability at speed, at scale, securely, and in an integrated manner.

As the operational environment continues to evolve, the consequences of this gap are becoming more pronounced.

The question is no longer whether NATO can access or develop advanced technologies but whether the Alliance can translate those technologies—including cloud, data, artificial intelligence, and software-enabled systems—into operational advantage before the pace of change outstrips its ability to adapt.

III. The risk of falling behind the pace of modern warfare

These structural challenges would be concerning in any context. In the current security environment, they are increasingly consequential. The character of warfare is evolving at a pace that places a premium on speed, scale, integration, and data-driven decision-making.³¹

Recent operational experience, particularly from Ukraine, demonstrates that the ability to compress the timeline from sensing to decision to action is decisive. Distributed sensing, commercial technologies, cloud connectivity, and AI-enabled tools are enabling forces to identify, assess, target, and engage at speeds that challenge traditional command-and-control structures.³² Analysis of the war in Ukraine highlights that forces have significantly compressed the timeline from detection to engagement, in some cases reducing it to minutes rather than hours, fundamentally reshaping expectations for speed in modern conflict.³³

In these circumstances, cloud becomes operationally relevant. Modern warfare increasingly depends on the ability to collect, move, secure, process, and exploit data across dispersed forces, headquarters, sensors, platforms, and national systems.³⁴ Cloud-enabled infrastructure supports the operational functions NATO says it needs: shared situational awareness, AI-enabled analysis, distributed command and control, logistics and sustainment visibility, rapid software updates, and mission continuity in degraded or contested environments.³⁵

At the same time, the barrier to generating strategic effect has dropped significantly. Capabilities that once required nation-state resources are now accessible to a broader range of actors, while the proliferation of low-cost, scalable systems has increased the importance of mass, adaptability, and sustainability in high-intensity operations.³⁶

In this environment:

Speed of decision-making determines relevance.
Scale of production and sustainment determines endurance.
Integration across systems and domains determines effectiveness.
Secure data movement determines whether advanced technologies can be employed operationally.

These dynamics are increasingly reflected in both operational experience and strategic analysis.³⁷ The side that can combine these elements most effectively will have the advantage. As retired General David Petraeus (a member of the Atlantic Council’s Board of Directors) has argued, future conflicts will increasingly be characterized by operations at “machine speed,” requiring command structures that enable rapid, decentralized decision-making.³⁸

This does not suggest a near-term transition to fully autonomous and AI warfare. Rather, it reflects a shift toward conflict that is increasingly human-directed, AI-enabled, and executed at machine speed—placing new demands on decision-making, command structures, cloud and data infrastructure, and institutional adaptability.³⁹

For NATO, this creates a growing strategic risk. The Alliance is investing in advanced capabilities and emerging technologies. But without corresponding improvements in delivery, integration, security, and interoperability, these investments may not translate into operational advantage. Instead, this approach risks producing a force that is technologically advanced, but operationally fragmented.

This risk is especially acute in cloud and data infrastructure. If allies pursue national cloud environments, data architectures, and security models without sufficient alignment, the Alliance may gain national digital capability while still lacking the ability to operate as an integrated force.⁴⁰ In that case, cloud modernization could reinforce fragmentation rather than reduce it.

NATO’s own digital transformation efforts recognize this challenge. The Alliance’s Digital Backbone, data strategy, AI strategy, and cloud-and-edge initiatives all point toward the same operational requirement: NATO must be able to move, secure, process, and exploit data across domains, commands, and nations at operational speed.⁴¹ The strategic risk is that these initiatives remain uneven, partial, or disconnected from the broader capability delivery process.

This risk is magnified by the scale of current and projected defense investment. NATO and its allies are committing significant new resources to defense, including significantly higher defense spending, with a substantial portion directed toward digital infrastructure, resilience, cloud, data, artificial intelligence, and emerging technologies.⁴² This presents a historic opportunity to modernize the Alliance’s capability base.

However, without reforms to the underlying processes that govern capability development and delivery, increased investment risks reinforcing existing inefficiencies. More resources moving through the same structures may simply produce greater fragmentation, increased duplication, and slower integration of capability across the Alliance.

In short, the risk is that the Alliance fails to translate technological advantage into operational advantage. In modern conflict, the side that integrates capabilities and acts most quickly—not the one with the most advanced individual systems—will have the advantage. For NATO, that means cloud, data, AI, networks, and operational processes must be treated as connected parts of the same capability delivery challenge. The challenge for NATO is not conceptual understanding of this shift but institutionalizing the ability to act on it consistently across the Alliance.

If NATO cannot adapt its processes to deliver secure, interoperable, cloud-enabled capability at the speed and scale required, it risks eroding its deterrence credibility—not because it lacks capability, but because it cannot employ that capability effectively, collectively, and in time.

IV. How the Alliance can achieve speed and scale

Addressing these challenges does not require wholesale reinvention of NATO’s structures. The Alliance’s existing institutions remain essential to coordinating thirty-two nations and maintaining political cohesion. However, it does require targeted adjustments that shift the focus from process compliance to capability delivery as the primary outcome.

For cloud-enabled infrastructure, this shift is especially important. Cloud is a useful test of NATO’s broader delivery challenge: its value depends not simply on access to the technology, but on the Alliance’s ability to integrate and employ it across NATO and national systems.⁴³ If NATO cannot deliver secure, interoperable, cloud-enabled capability at speed and scale, many of its broader digital transformation ambitions will remain constrained. Six areas of change are particularly important.

1. Differentiate capability development and acquisition pathways

NATO must move away from applying a single governance and acquisition model across all capability types. Emerging technologies—particularly software, data systems, cloud infrastructure, and AI-enabled capabilities—require different governance, acquisition, and delivery approaches than traditional platforms such as aircraft, ships, or large-scale weapons systems.

Software-driven capabilities require iterative development, rapid fielding, continuous updates, and flexible funding enabled through modular architectures and cloud-based delivery models. The model is closer to updating a smartphone than buying an entirely new platform: The system must be designed so components, applications, algorithms, and security updates can be improved without rebuilding the whole capability.
Cloud-enabled capabilities require continuous security monitoring, data governance, user adoption, integration with networks and applications, and the ability to operate across NATO and national systems.⁴⁴ They should not be treated as static infrastructure acquired once and then left unchanged.
Platform-centric programs require structured oversight, long-term planning, and industrial coordination.

Applying a uniform process to all three categories creates inefficiencies in each case.

NATO and allies should establish distinct pathways for different categories of capability, ensuring that governance, timelines, risk frameworks, and security approval processes are aligned with the nature of the problem being solved.⁴⁵ In practice, this could include differentiated pathways for software-intensive capabilities, cloud-enabled digital infrastructure, major platform programs, and more standard capability efforts—an approach that has been explored within NATO capability development processes to better align oversight and speed with the complexity of the capability being delivered.
This approach is particularly important for cloud and data infrastructure because the operational value comes not simply from acquisition but also from continuous improvement, integration, security, and adoption over time.⁴⁶

2. Create protected priority pathways

Speed is achieved when priority efforts are clearly defined, senior leaders align around them, and those efforts are protected from unnecessary friction. Experience across NATO and national systems suggests that rapid progress is most likely when:

The problem is narrowly defined.
Senior leadership provides sustained focus.
Decision-making authority is aligned with the objective.
Resources are protected.
Implementation responsibility is clear.

While these conditions are often present in principle, translating them into consistent execution across the Alliance remains challenging in practice.

NATO should formalize this approach by identifying a limited number of priority capability initiatives and protecting them from normal bureaucratic drift. Cloud-enabled operational capability should be one of those priority areas. NATO’s digital transformation agenda, Digital Backbone work, and ACE initiative already point in this direction.⁴⁷ The challenge is ensuring these efforts do not remain disconnected initiatives but become operationally relevant capabilities delivered at scale.

In practice, this could include designating specific cloud-enabled capability efforts as Alliance priorities, with clearly assigned leadership, streamlined decision pathways, dedicated resourcing, defined security-approval processes, agreed interoperability standards, and clear transition paths from pilot to operational use.⁴⁸ This does not require bypassing governance, but it does require discipline in prioritization and protection. The challenge is aligning the will and authority to implement these changes at speed.

3. Design for scale from the start

Capability development efforts must be structured from the outset with scale, sustainment, security, and integration in mind. Too often, efforts focus on early-stage success—demonstrations, pilots, or limited deployments—without a clear pathway to broader adoption across the Alliance.

Because no single NATO body owns the full pathway from requirement to delivery, these functions must be assigned deliberately at the start of any priority capability effort. To avoid the pilot trap, NATO and allies should take a deliberate approach for each priority capability effort:

Assign responsibility for production, implementation, and adoption planning early in the process, including which national, NATO, or multinational mechanism will support scale.
Align funding mechanisms to support transition from prototype to fielded capability.
Define interoperability and integration requirements early, with ACT shaping requirements and operational architecture, and delivery organizations responsible for implementation.
Identify security accreditation and data-governance requirements at the beginning, not after technical development is complete.
Define sustainment, training, and upgrade pathways before fielding begins.

For cloud-enabled capability, designing for scale means more than providing cloud access.Jarnecki and Sylvia,⁴⁹ It requires planning for identity and access management, cross-domain solutions, data standards, application migration, bandwidth, edge connectivity, cyber defense, user adoption, and sustainment across NATO and national environments.⁵⁰

Ukraine’s rapid transition from innovation to battlefield application demonstrates the importance of integrating production, sustainment, and operational use from the outset.⁵¹

The objective is to move beyond isolated success toward repeatable, scalable capability delivery.

4. Leverage NATO’s comparative advantage: aggregation

NATO’s greatest structural advantage is its ability to aggregate demand across multiple nations. No single ally may generate sufficient demand to justify large-scale industrial investment. Collectively, however, the Alliance can provide the scale and predictability required to drive production, reduce costs, strengthen resilience, and enable sustained capability delivery.

This applies to cloud and digital infrastructure as much as it does to traditional defense production.⁵²Allied demand for secure cloud services, data platforms, AI-enabled tools, software development environments, cyber defense, and edge computing could create the scale required to attract investment, reduce duplication, and strengthen interoperability.⁵³

Aggregation will not happen simply because NATO identifies common needs. It requires a mechanism that can translate shared requirements into committed demand, reconcile national industrial interests, and identify who is responsible for moving from coordination to execution.

To realize this advantage, NATO and allies should:

Identify priority capability areas where multinational demand aggregation is operationally necessary and politically feasible.
Use coordination structures such as D2IA and CDT, in conjunction with the CNAD, to align requirements, reconcile national industrial interests, and secure allied buy-in.
Determine early whether NSPA, NCIA, a lead nation, or another multinational mechanism is best positioned to execute procurement and sustainment.
Develop shared approaches to sustainment and life-cycle management, including common maintenance frameworks, pooled logistics, and coordinated upgrade pathways, as well as shared cloud-service models across participating allies.
Create incentives for participation, including shared procurement frameworks, long-term demand commitments, and mechanisms that ensure equitable industrial participation across allies.

NATO’s ability to aggregate demand represents a critical but underutilized advantage in scaling capability delivery.⁵⁴

Aggregation is not simply an efficiency measure—it is a strategic enabler of scale.

5. Modernize security for cloud-enabled capability

NATO cannot accelerate cloud adoption without modernizing the security processes that govern it.⁵⁵ Legacy security models remain essential in protecting classified information, but many were designed for more static, platform-centric environments. Cloud-enabled, software-driven, and data-centric capabilities require a different approach.⁵⁶

The objective is not to reduce security. It is to make security more operationally relevant.⁵⁷

For cloud-enabled capability, security must shift from a primarily static approval model toward a more risk-informed, continuously monitored, and adaptive model. NATO should preserve assurance while enabling trusted cloud services, software updates, data-sharing tools, and AI-enabled applications to be adopted and improved at operational speed.⁵⁸

This model should include:

Clearer guidance on how to balance security assurance, risk tolerance, and operational urgency.
Risk-based security approval processes tailored to cloud-enabled and software-driven capabilities.
Continuous monitoring and security validation rather than one-time approval models.
Common approaches to identity, credential, and access management across NATO and national systems.
Cross-domain solutions that allow data to move securely across classification levels where authorized.
Data-centric security models that protect information while enabling responsible sharing and exploitation.⁵⁹
Earlier integration of security authorities into capability development and acquisition pathways.

This recommendation is especially important because cloud-enabled operational advantage depends on trust. Allies must be confident that data can be protected, accessed appropriately, and used in ways that respect national security requirements. At the same time, security processes cannot become so slow or restrictive that they prevent NATO from exploiting data and digital capabilities at operational speed.

NATO’s challenge is to modernize security in a way that strengthens trust while enabling delivery.

6. Balance speed with integration and interoperability

Efforts to accelerate capability development must be balanced with the need to ensure interoperability and long-term integration. Rapid acquisition without alignment risks creating fragmented systems, interoperability gaps, and increased sustainment burdens.

The objective is not speed alone, but speed with coherence.

NATO should prioritize:

Implementation of common standards for data, interfaces, cloud architectures, and application programming interfaces, building on NATO’s data and AI strategies.⁶⁰
Interoperability as a baseline requirement, consistently implemented across allied efforts and not addressed late in the development process.
Integration across domains, commands, classification levels, and national systems from the outset.
Alignment between sovereign cloud approaches and NATO’s broader requirement for federated, interoperable, multiclassification cloud environments.⁶¹
Common approaches to data governance, metadata, access control, and life-cycle management.
Clear transition pathways from national digital modernization efforts into NATO operational use.

This set of priorities is particularly important as allies pursue national approaches to cloud and data infrastructure. Sovereign cloud requirements are understandable, but if they are not aligned with common standards and interoperability requirements, they risk reinforcing fragmentation rather than enabling integration.⁶² Varied national regulatory and vendor-compliance requirements can also increase complexity and create additional security risks if not harmonized early.

NATO should accelerate mechanisms to integrate real-world operational lessons, particularly from Ukraine, into Alliance doctrine, training, digital infrastructure, and capability development. Ukraine’s experience also underscores that the operational lesson is not only about drones or battlefield adaptation but also the speed at which forces can collect, move, analyze, and act on data. This includes:

Rapid incorporation of battlefield insights into capability planning.
Closer alignment between operational commands and capability development communities.
Treating operational experience as a continuous input to capability delivery.
Testing cloud-enabled data sharing, AI-enabled analysis, and distributed command and control in realistic operational environments.⁶³

This practice requires a shift in mindset. Early in the conflict, some operational insights from Ukraine were viewed as context-specific or not broadly applicable to NATO forces. However, the pace and scale of adaptation demonstrated on the battlefield as well as the demonstrated importance of cloud infrastructure highlight the need to treat these lessons as indicators of broader shifts in the character of warfare.

Ukraine should be viewed not only as a partner but also as a source of real-time operational insight that can accelerate Alliance adaptation.⁶⁴ In this environment, the traditional model of developing and validating doctrine before widespread adoption is increasingly challenged by the speed at which operational practices are evolving.

Speed without scale is a demonstration. Scale without speed is irrelevance. NATO must deliver both, while ensuring security, interoperability, and integration across the Alliance.

The central challenge remains primarily organizational and structural, not technological. The issue is not NATO’s access to advanced cloud, AI, data, and other digital capabilities; it is adapting its governance, acquisition, security, culture, and operational processes quickly enough to adopt and employ them at scale. NATO’s own digital strategy provides a clear 2030 anchor: the Alliance Digital Strategy calls for multi-domain operations to be fully enabled by 2030. NATO’s Digital Transformation Implementation Strategy 2.0 (DTIS 2.0) carries its current work strands through 2030, and participating Allies have committed to roll out ACE’s digital network by 2030. But 2030 cannot be the point at which the hard organizational decisions are completed. Working backward from that operational objective. NATO should have aligned its cloud architecture, security accreditation approach, data standards, sovereign cloud principles, delivery ownership, and operational-command adoption pathways by 2028. This would leave roughly two years to transition from organizational alignment to implementation, integration, collective training, exercising, and validation before the 2030 objective. The 2028 date is therefore an interim planning milestone, not an official NATO deadline. Without that alignment, NATO risks reaching the end of the decade with more digital investment, more national modernization, and more activity—but not a coherent Alliance capability. That would be fragmentation at scale.

These adjustments do not require a fundamental redesign of NATO’s structures. They require a shift in emphasis: from managing process to delivering outcomes. The Alliance already possesses the institutions, resources, technological access, and emerging cloud initiatives required. The challenge is aligning them to deliver secure, cloud-enabled capability at the speed, scale, and level of integration demanded by the modern operational environment.

While straightforward in concept, these changes require sustained alignment across political, institutional, security, and industrial stakeholders—making execution the true challenge.

V. Conclusion

NATO is not starting from a position of weakness. The Alliance has access to advanced technologies, a growing innovation ecosystem, emerging cloud-and-edge initiatives, and increasing levels of defense investment. It also retains a unique comparative advantage: the collective strength of thirty-two nations aligned around a shared commitment to deterrence and defense.

The risk is not abstract. Without adapting how it delivers capability, NATO risks investing significant new resources without achieving the operational coherence required for modern conflict. The result would be a force unable to employ that capability effectively, collectively, and at speed. The challenge is not access—it is execution.

Cloud-enabled infrastructure makes this execution challenge clear. Cloud is not simply an IT modernization effort. It provides the digital foundation needed to connect information, applications, and operational functions across commands, domains, and nations If NATO cannot deliver secure, interoperable, cloud-enabled capability at scale, many of its broader digital transformation ambitions will remain constrained.

As the character of warfare continues to evolve, advantage will be determined less by the possession of advanced systems and more by the ability to integrate them, scale them, and employ them effectively across the Alliance. Speed of decision, coherence of action, trusted data sharing, and the ability to sustain operations at scale are becoming the defining factors of military effectiveness.

NATO’s current trajectory presents both opportunity and risk. Increased investment, particularly in digital infrastructure, resilience, cloud, data, artificial intelligence, and emerging technologies, creates the conditions for meaningful transformation. At the same time, without corresponding changes to how the Alliance develops, secures, and delivers capability, these investments risk reinforcing fragmentation rather than strengthening collective effectiveness.

This risk is especially important as allies pursue national and sovereign cloud approaches. Sovereign cloud requirements are understandable and often necessary, given national concerns over data control, jurisdiction, resilience, security, and industrial dependence. But if these approaches are not aligned through common standards, trusted security frameworks, and interoperability requirements, they risk producing parallel digital environments that are nationally secure but operationally difficult to integrate.

The central argument of this issue brief is that NATO’s technology challenge is fundamentally a capability delivery challenge. Addressing it does not require reinventing the Alliance. It requires aligning policies, processes, authorities, security models, and implementation across acquisition, production, and delivery.

At present, no single entity is clearly responsible for coordinating and executing this end-to-end delivery process across the Alliance. This lack of clear ownership remains a central barrier to translating technological potential into operational capability.

Integrating how NATO acquires, produces, delivers, and employs capability is essential. Often treated as separate challenges, these functions are inseparable. Cloud-enabled capability demonstrates why: Operational value depends not only on access to technology but also on trusted data, modernized security, common standards, user adoption, sustainment, and integration across NATO and national systems.

Ultimately, NATO’s future advantage will depend not on what it can access, but on how quickly and effectively it can turn that access into secure, integrated, Alliance-wide operational effects.

The opportunity is clear. The requirement is urgent. Without action, the gap between technological potential and operational capability will continue to widen. The time to adapt is now.

About the author

David J. Julazadeh is a retired United States Air Force lieutenant general and a nonresident senior fellow with the Transatlantic Security Initiative at the Atlantic Council’s Scowcroft Center for Strategy and Security. Previously, he was the deputy chief of staff for capability development at NATO Allied Command Transformation in Norfolk, Virginia, where he was responsible for developing operational and strategic capability requirements on behalf of thirty-two NATO nations.

Acknowledgments

The Atlantic Council’s Transatlantic Security Initiative and Cyber Statecraft Initiative are grateful to Amazon Web Services (AWS) for its support for this issue brief. AWS is a provider of cloud services—the subject of this issue brief—including to public-sector clients such as NATO.

This issue brief was written and published in accordance with the Atlantic Council’s Intellectual Independence Policy, which requires all donors to agree to the Council maintaining independent control of the content and conclusions of its work.

The analysis and recommendations reflect the author’s views and do not reflect the views or policy of the US Defense Department, the US Department of the Air Force, or the US government.

Explore the programs

The Transatlantic Security Initiative aims to reinforce the strong and resilient transatlantic relationship that is prepared to deter and defend, succeed in strategic competition, and harness emerging capabilities to address future threats and opportunities.

Learn more

The Atlantic Council’s Cyber Statecraft Initiative, part of the Atlantic Council Technology Programs, works at the nexus of geopolitics and cybersecurity to craft strategies to help shape the conduct of statecraft and to better inform and secure users of technology.

learn more

Image: US Air Force fighter F-15 at the Amari military airfield, Estonia, February 1, 2022. REUTERS/Ints Kalnins

Share

Issue briefs and reports

Fast Thinking

Dispatches

Inflection Points

UkraineAlert

MENASource

Econographics