Broadcom’s sovereign agentic AI, run through the 5 Pillars
On 19 March 2026, CISPE filed a competition complaint with the European Commission against Broadcom. The number in it is worth reading twice: cumulative cost increases of more than 1,000 percent. Francisco Mingorance, CISPE’s Secretary General, called the termination of the European VMware Cloud Service Provider program the “coup de grâce.”
Five months later, at VMware Explore 2026, Broadcom announced the foundations for sovereign agentic AI.
I want to be precise about what happened in between, because the sequence is the story. In January 2026 Broadcom closed the Advantage Partner Program for VMware cloud service providers across Europe. Renewals stopped on 26 January. The open pipeline had to close by 31 March. In the US, according to reporting by The Register and ITdaily, the provider list went from over a thousand to nineteen. Kristian Liivak, CTO of WaveCom, described it as “a bulldozer named Broadcom.” Some of the providers rolled over were carrying long-term government procurement obligations. Which is to say: the operators actually delivering sovereign workloads to European public sector customers were removed from the board by the vendor now selling sovereignty as a product category.
To better assess the story, we will run them through the 5-Pillar litmus test properly. Forget the marketing; let’s see where they really score.
What Broadcom actually shipped
Let’s give credit first, because there is real engineering here, and pretending otherwise cheapens the rest of the argument.
The Tanzu Platform for Agents, expected to go GA this fall, is the best-specified agent containment model any major infrastructure vendor has shipped. Providing deny-by-default sandboxes with baseline networking stripped out. Credentials held in a store positioned outside the agent’s sandbox, reachable only through brokered service bindings. An AI gateway that intercepts all agent traffic, with tool filtering, token rate limiting, and per-agent journaling into Tanzu Hub. MCP servers published through a governed marketplace rather than pulled off GitHub by a developer at 11pm.
Purnima Padmanabhan, VP and GM of the Tanzu division, framed it well: “Enterprises do not have an AI ambition problem. They have an agent trust problem.”
She’s right. That is a genuine problem, and this is a genuine answer to it.
It is not, however, an answer to the sovereignty question, and the two keep getting welded together by people who should know better. Containment is about what your agent can reach. Sovereignty is about who can reach you.
Pillar 1, Territorial: a conditional pass
To start, as one would expect, the underlying infrastructure posture is legitimately strong. The VCF 9.1 runs in your data center or that of your provider. Their AI-Ready Data Foundation keeps parsing, structuring, and enrichment local, with vSAN S3 object tiering underneath. Greenplum now queries Iceberg directly with CDC streaming and FIPS 140-3, vector indexes co-located with relational stores behind your own firewall. The VMware AI Factory currently boasts over 150 open and commercial models, including Nemotron 3, Gemma 4, and Qwen 3.7-Max, all served locally- those are all a W.
Look at the GenAI on Tanzu Platform release notes. It reads Azure OpenAI, Google Vertex, and Amazon Bedrock integrations were all promoted from beta to GA. A new Anthropic integration was also GA.
My standing rule applies without modification. If a hosted frontier model sits anywhere in the request path, the deployment auto-fails Territorial. An AI gateway that logs, filters, and rate-limits your egress to a US frontier lab makes that egress observable. It does not make it local. Governed egress is not residency, and a beautifully audited log of your crown jewels leaving the building is still your crown jewels leaving the building – there is no way to dress that one up.
This is a Passing Grade if you stay on the path of vLLM; however, a Fail the moment someone in the platform team enables the convenient thing.
Pillar 2, Operational: architecture passes, org chart fails
Who runs it, who holds the keys, who gets paged, who can read the audit log.
On keys and paging, Tanzu’s answer is good. Credential isolation is real, the journaling is real, TrueSource with SLSA Level 3 builds and automated CVE patching across Spring, PostgreSQL, MySQL, Valkey and RabbitMQ is real supply chain hygiene that most vendors don’t bother with.
On who runs it, the answer is now: an operator Broadcom selected. Hundreds of European providers, many with more than a decade of VMware delivery experience, cannot buy new licenses, cannot expand with existing customers, and cannot onboard new workloads. Customers get migrated to the handful of chosen partners, typically onto new bundles at higher prices.
Arvato Systems, one of the survivors, announced a sovereign private cloud with Broadcom on 3 September. Hansjörg Metzger, their MD for Multi-Cloud and Infrastructure, put it plainly: “We host everything in our own data centers for healthcare, government, regulated industries. They know where the data are.”
It’s not that I do not believe him, as Arvato is a serious operator. But notice what just happened…….. that was a Territorial answer given to an Operational and Legal question, and the entire industry does this reflexively. Knowing where the data resides is table stakes. Operational sovereignty asks whether you chose your operator or whether your vendor chose them for you- it’s a matter of control. In 2026, for VMware, the honest answer is the second one.
Pillar 3, Technological: split down the middle
Can you audit it, fork it, self-host it.
The upper layers are genuinely open, and this is the part I’d defend against a lazy critique. Cloud Foundry mechanics, Spring, Postgres with pgvector, Iceberg, MCP, vLLM, open weights. Real portability. AMD Instinct MI350 with open ROCm alongside NVIDIA is a meaningful anti-lock-in move and deserves to be said out loud.
The control plane is the opposite. VCF, vSAN, vDefend, Tanzu Hub, the AI gateway, the marketplace. Unforkable, unauditable, unrunnable without a subscription.
And the accelerator path carries its own tax. Private AI Foundation with NVIDIA requires a VCF subscription, plus the Private AI Foundation add-on license, plus a separate NVIDIA AI Enterprise license for the vGPU drivers themselves. Three commercial dependencies before you serve a single token.
Here is a test I’d ask any CTO to run: if the vendor price tripled at renewal, which parts of this stack keep running? Is it the data layer and the models? yes. The runtime everything sits on? no.
Pillar 4, Legal: fail, and nobody writes it down
Broadcom Inc. is a US-incorporated company headquartered in Palo Alto. Running VCF in Frankfurt, operated by a German partner, under a Broadcom license, does not move the licensor, the support organization, the telemetry, or the license keys out of US jurisdiction.
If you want to know how seriously to take this, look at Siemens. VMware sued Siemens over licensing. Siemens countersued. The live fight is over jurisdiction, with Siemens pushing for German courts and VMware pushing for US courts.
Just read that sentence again. One of Europe’s largest industrial groups is currently in court arguing about which country’s law governs its VMware relationship, while VMware markets sovereign cloud into the same continent. That is not a hypothetical CLOUD Act thought experiment. That is a filed case with a docket number.
Pillar 5, Financial: the loudest fail on the board
This is where the smoke detector catches fire.
The European Cloud Competition Observatory rates Broadcom’s licensing policy red. Their finding: tenfold increases are common, with peaks at fifteen times. AT&T reportedly faced an annual increase of 1,050 percent. European cloud providers reported 800 to 1,500 percent. Perpetual licenses gone, subscription only, bundles dissolved, minimum commitments set against potential rather than actual usage, payment up front.
Remember my premise around owning your Financial Alpha. Financial sovereignty is the freedom from a forced migration and predictable cost over a multi-year horizon. Broadcom’s post-acquisition conduct is, at this point, the single best-documented case study in the industry for why that pillar exists at all. I have used it in front of boards. And so have you.
A vendor is allowed to change its commercial model. What it cannot do is change its commercial model violently and then sell sovereignty in the very next breath, which is a promise about commercial predictability, to the same customers, in the same fiscal year.
An Executive TCO Exercise
For this example, let’s take the VCF 9.1 that boasts up to 40 percent lower server cost through memory tiering, 39 percent lower storage TCO, and 46 percent lower Kubernetes operational cost. I’m fine with using those at face value, as they are plausible engineering wins.
Now model it the same way a procurement department should.
Use three lines:
- Infrastructure efficiency: real, call it 30 to 40 percent off the hardware and ops line
- License line: ten-fold, per ECCO, with observed peaks at fifteen
- Accelerator stack: VCF subscription plus PAIF add-on plus NVAIE, before inference
Even after factoring in the efficiency gain, this becomes a rounding error against the license line. Saving 40 percent on servers while your license bill goes up an order of magnitude is not cost control, and it is certainly not financial sovereignty. It is a better negotiating slide for the vendor.
How would my Grade change?
I am not grading Broadcom on intent. I’m grading them on the Exit Strategy.
There are three things that would move this materially. 1/ Publish a documented, supported air-gapped reference architecture with no frontier API path and no NVIDIA licensing service dependency. 2/ Reopen the provider program in Europe so customers pick their own operator instead of picking from a shortlist. 3/ Offer multi-year price certainty in contract, not in a press release, for anything sold under a sovereignty label.
None of those are unreasonable. All of them are cheaper than the antitrust file.
Until then: Territorial conditional, Operational split, Technological split, Legal fail, Financial fail. That is a private cloud with excellent agent hygiene. It is not a sovereign stack, and the gap between those two things is exactly where procurement gets caught with its pants down.
The self-awareness is the whole battle. Know your gaps, price the risk, decide if it’s acceptable. The worst posture available is the ostrich.
If you’re mid-renewal, mid-migration, or holding a vendor claim you can’t independently verify, we run vendor estates through the 5 Pillars at Agentcy Labs. Sovereignty is not binary. It’s control with a named risk sidecar, and someone should be naming yours.
Amit
References
The announcement
- Futurum Group, “Broadcom Builds Sovereign Agentic AI Foundations Around VMware Tanzu”: https://futurumgroup.com/insights/broadcom-builds-sovereign-agentic-ai-foundations-around-vmware-tanzu/
- Broadcom press release, “Broadcom Unveils AI-Ready Data Foundations in VMware Tanzu Platform to Power Secure Enterprise AI Cloud”, 31 August 2026. Source of the Padmanabhan quote and the Fall 2026 GA date: https://investors.broadcom.com/news-releases/news-release-details/broadcom-unveils-ai-ready-data-foundations-vmware-tanzu-platform
- VMware Tanzu blog, “Scaling the Agentic Enterprise: Production-ready AI Agents with Tanzu Platform”. Source for deny-by-default sandboxes, the credential store outside the sandbox, brokered service bindings, AI gateway traffic interception, MCP tool filtering: https://blogs.vmware.com/tanzu/scaling-the-agentic-enterprise-production-ready-ai-agents-with-tanzu-platform/
- Broadcom press release, “Broadcom Announces VMware Cloud Foundation 9.1”, 5 May 2026. Source of the 40 percent server, 39 percent storage and 46 percent Kubernetes figures: https://investors.broadcom.com/news-releases/news-release-details/broadcom-announces-vmware-cloud-foundation-91-enabling-secure
- The Next Platform, “VMware Intros Private AI Cloud, AI Factory As Workloads Shift To On-Prem”, 1 September 2026. Source for the 150+ model catalogue, Nemotron 3, Gemma 4, Qwen 3.7-Max, ReadyNodes and AMD Instinct MI350 with ROCm: https://www.nextplatform.com/cloud/2026/09/01/vmware-intros-private-ai-cloud-ai-factory-as-workloads-shift-to-on-prem/5293559
Territorial and Technological
- Broadcom TechDocs, “Release Notes for GenAI on Tanzu Platform”. Source for Azure OpenAI, Google Vertex and Amazon Bedrock integrations reaching GA, the new Anthropic integration, and vLLM as the self-hosted path: https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/ai-services/10-2/ai/release-notes.html
- Broadcom TechDocs, “Requirements for Deploying VMware Private AI Foundation with NVIDIA”. Source for the three stacked dependencies: VCF subscription, Private AI Foundation add-on license, separate NVIDIA AI Enterprise license: https://techdocs.broadcom.com/us/en/vmware-cis/private-ai/foundation-with-nvidia/9-0/private-ai-foundation-9-x/deploying-private-ai-foundation-with-nvidia/requirements-for-deploying-private-ai-foundation-with-nvidia.html
- NVIDIA, License System User Guide, on CLS and DLS licensing service options: https://docs.nvidia.com/license-system/latest/nvidia-license-system-user-guide/index.html
Operational, the partner programme
- CISPE, “CISPE Files Competition Complaint Against Broadcom, Urges Immediate EU Action”, 19 March 2026. Source of the 1,000 percent cumulative figure and the Mingorance quote: https://www.cispe.cloud/cispe-files-competition-complaint-against-broadcom
- CISPE, court action to annul the European Commission’s approval of the VMware acquisition: https://www.cispe.cloud/cispe-takes-european-commission-to-court-to-annul-approval-of-broadcoms-acquisition-of-vmware/
- The Register, “Broadcom ‘bulldozes’ VMware cloud partners as March deadline looms”, 31 January 2026. Source of the Liivak quote, the 26 January and 31 March dates, and the government procurement obligations point: https://www.theregister.com/2026/01/31/broadcom_vmware_cloud_partners/
- ITdaily, “Broadcom divests European VMware partner network”. Corroborates the European programme termination and the US partner count: https://itdaily.com/news/business/broadcom-divests-european-vmware-partner-network/
- LightEdge, “Broadcom’s VCSP Transition: What CSPs and Customers Need to Know in 2026”. On the 400+ providers losing purchase and expansion rights: https://lightedge.com/resources/broadcoms-vcsp-transition-what-csps-and-customers-need-to-know-in-2026/
- SiliconANGLE, “Arvato and Broadcom integrate security for sovereign private cloud”, 3 September 2026. Source of the Metzger quote: https://siliconangle.com/2026/09/03/arvato-and-broadcom-integrate-security-for-sovereign-private-cloud-vmwareexplore/
Legal and Financial
- Network World, “Lessons learned from Siemens’ VMware licensing dispute”. Source for the jurisdiction fight, Siemens pushing for German courts and VMware for US courts, and the 800 to 1,500 percent range for European providers: https://www.networkworld.com/article/4018256/licensing-lessons-from-vmware-siemens-spat.html
- Techzine, “License fees 8 to 15 times higher since VMware became part of Broadcom”. Reporting the European Cloud Competition Observatory findings, the red rating, and the AT&T 1,050 percent figure: https://www.techzine.eu/news/infrastructure/131677/license-fees-8-to-15-times-higher-since-vmware-became-part-of-broadcom/
- Broadcom, Hock Tan, “A Combined Broadcom and VMware: Clouds and Sovereignty”: https://www.broadcom.com/blog/a-combined-broadcom-vmware-clouds-and-sovereignty
