The Residency Trap
There is a comfortable fiction at the heart of European cloud strategy, and it has persisted long enough to become expensive. The fiction is this: that storing data within European borders constitutes meaningful digital sovereignty. It does not. And the gap between what residency provides and what sovereignty requires is precisely where Europe's most significant strategic vulnerability resides.
The distinction matters because of a single piece of American legislation: the Clarifying Lawful Overseas Use of Data Act, better known as the CLOUD Act, enacted in 2018. Under its provisions, US authorities can compel US-headquartered companies to disclose data stored anywhere in the world — including in European data centres — regardless of where the data physically resides. An AWS server in Frankfurt, an Azure facility in Amsterdam, a Google Cloud node in Warsaw: all remain legally accessible to American authorities through the CLOUD Act, irrespective of their geographic location.
This is not a theoretical risk. It is a structural feature of the legal architecture governing the world's three dominant cloud providers, which collectively control over 70% of the European cloud market. And it is the central problem that Europe's 2026 regulatory wave — the EU Data Act, the Cloud and AI Development Act (CADA), and the Cloud Sovereignty Framework — is attempting, with varying degrees of success, to address.
"Data residency is a geographic fact. Data sovereignty is a legal and architectural condition. Conflating the two has cost European organisations a decade of strategic clarity — and is now costing them something more tangible: control."
The 2026 Regulatory Architecture
What CADA Actually Does
The Cloud and AI Development Act, introduced by the European Commission on 3 June 2026, represents the most ambitious attempt yet to operationalise European digital sovereignty. Its central mechanism is a four-tier "Sovereignty Effectiveness Assurance Level" (SEAL) framework that evaluates cloud services across 48 criteria, including infrastructure location, software supply chain transparency, corporate ownership structure, and the citizenship requirements for key technical personnel.
The framework's architecture is revealing. Level 1 requires EU establishment and data residency — a threshold that current hyperscaler offerings generally meet. Level 2 requires localised personnel screening and independent audits to verify protection against foreign government access — achievable by hyperscalers operating through local partners. Level 3 requires EU-based ownership and control, with all technical support performed by EU citizens — a threshold that effectively excludes US hyperscalers unless granted specific exceptions. Level 4 represents full independence from non-EU influence and complete control over the software stack — a standard that no current provider, European or otherwise, fully meets.
The European Commission estimates that approximately 70% of public contracts will fall into Level 1, 20% into Level 2, and less than 10% will require the more restrictive Level 3 and 4 tiers. This distribution is politically significant: it acknowledges that full sovereignty is neither achievable nor necessary for most public-sector workloads, while creating a credible pathway for the most sensitive applications to migrate toward genuinely sovereign infrastructure.
The EU Data Act's Portability Mandate
Data residency is a geographic fact. Data sovereignty is a legal and architectural condition. Conflating the two has cost European organisations a decade of strategic clarity — and is now costing them something more tangible: control.
Running in parallel with CADA, the EU Data Act — formally applicable since September 2025 — addresses a different dimension of the sovereignty problem: vendor lock-in. By January 2027, cloud providers are prohibited from charging exit or switching fees, and must guarantee the technical ability to migrate workloads to alternative providers without contractual or technical roadblocks.
The portability mandate is significant because lock-in has been one of the primary mechanisms through which hyperscalers have maintained their market dominance despite growing sovereignty concerns. Organisations that have built complex workloads on proprietary managed services — AWS Lambda, Azure Cognitive Services, Google BigQuery — face migration costs that can dwarf the annual licensing fees, creating a structural disincentive to switch even when sovereignty concerns are acute.
The Data Act's prohibition on switching fees removes one layer of this lock-in. It does not, however, address the deeper technical lock-in created by proprietary APIs, data formats, and service architectures. That problem requires a different solution — one that the European cloud ecosystem is only beginning to develop.
The Hyperscaler Response: Sovereign in Name Only?
The Sovereign Cloud Programmes
All three major US hyperscalers have launched "sovereign cloud" programmes in response to European regulatory pressure. AWS's European Sovereign Cloud achieved general availability in Germany in January 2026. Azure's EU Data Boundary programme has been progressively expanded. Google Cloud has established dedicated European infrastructure with enhanced access controls.
These programmes share a common architecture: they create operationally isolated European environments with enhanced data residency guarantees, localised support personnel, and contractual commitments to resist foreign government access requests. They are genuine improvements over standard hyperscaler offerings, and they satisfy the requirements of SEAL Levels 1 and 2.
What they cannot do is satisfy Level 3 or above. The fundamental constraint is corporate structure: AWS, Azure, and Google Cloud are subsidiaries of US-incorporated parent companies. Regardless of the operational isolation of their European environments, they remain subject to the CLOUD Act through their parent entities. A sufficiently motivated US government request, backed by appropriate legal process, can reach data in these environments in ways that a genuinely EU-owned provider cannot be compelled to facilitate.
This is not a criticism of the hyperscalers' sovereign programmes — they are doing what their corporate structure permits. It is an observation about the structural limits of what residency-based sovereignty can achieve when the provider's ultimate legal domicile lies outside the jurisdiction seeking protection.
The Market Share Problem
The scale of European dependence on non-EU cloud infrastructure is striking. Three US hyperscalers control over 70% of the European cloud market. The market share of EU-based cloud providers has declined from 29% in 2017 to approximately 15% by 2022, and has remained stagnant since. Meanwhile, worldwide sovereign cloud IaaS spending is projected to reach $80.4 billion in 2026, with European regional spending forecast to increase from $6.9 billion in 2025 to $12.6 billion in 2026 — an 83% year-on-year increase that reflects the urgency of the sovereignty agenda without yet reversing the underlying market structure.
Regulation can mandate sovereignty requirements. It cannot conjure the infrastructure, talent, and capital required to meet them. Europe's cloud sovereignty agenda will succeed or fail on the basis of investment, not legislation.
The European Commission has identified a €120 billion investment gap that must be bridged by 2035 to achieve meaningful competitive capacity. This figure encompasses data centre construction, semiconductor supply chain development, and the talent infrastructure required to operate genuinely sovereign cloud environments at scale. It is a number that underscores the depth of the structural challenge — and the inadequacy of regulatory frameworks alone as a response to it.
"Regulation can mandate sovereignty requirements. It cannot conjure the infrastructure, talent, and capital required to meet them. Europe's cloud sovereignty agenda will succeed or fail on the basis of investment, not legislation."
The EU-Native Alternative Ecosystem
Who Is Building Genuine Sovereignty
The European sovereign cloud provider landscape in 2026 is more developed than its market share figures suggest. Several EU-native providers have built credible alternatives to hyperscaler offerings, particularly for the regulated workloads where sovereignty requirements are most acute.
OVHcloud, headquartered in France, holds Gaia-X Label Level 3 certification — the most rigorous sovereignty credential available — along with SecNumCloud and HDS certifications. It offers the broadest managed service catalogue among EU-native providers, covering IaaS, PaaS, Kubernetes, and AI workloads. STACKIT, the cloud arm of the Schwarz Group (the parent company of Lidl and Kaufland), has committed €11 billion to cloud infrastructure development and offers an "European Sovereign Stack" standard for enterprise workloads. IONOS operates air-gapped private clouds for German federal agencies and AI inference hubs in cooperation with the Federal Office for Information Security. T-Systems provides both OpenStack-based public cloud and an Industrial AI Cloud designed to expand regional GPU capacity.
For compute-intensive workloads where sovereignty requirements are less acute, Hetzner and Scaleway offer compelling price-performance ratios. Hetzner, in particular, delivers approximately 14.3 times the compute value of AWS as of early 2026 — a differential that makes it an attractive option for organisations willing to accept a narrower managed service catalogue in exchange for cost efficiency and EU legal domicile.
The Gaia-X Clarification
Gaia-X is frequently misunderstood, and the misunderstanding has consequences for how organisations evaluate their sovereignty options. Gaia-X is not a cloud provider. It is a Brussels-based non-profit that establishes standards for federated data spaces and interoperability. Membership in Gaia-X does not automatically signify sovereignty — the organisation includes hyperscaler members — but the Gaia-X Label Level 3 certification is a rigorous credential that confirms a provider is headquartered in the EU and operates beyond the reach of foreign laws including the CLOUD Act.
The distinction matters because organisations that conflate Gaia-X membership with sovereignty certification may believe they have achieved a level of protection that their actual provider cannot deliver. The certification, not the membership, is the relevant signal.
The Strategic Architecture of Genuine Sovereignty
The sovereignty illusion — the belief that residency equals sovereignty — has been expensive. The 2026 regulatory wave is dismantling it, one framework at a time.
Multi-Cloud by Classification
The most effective sovereignty strategies in 2026 do not attempt to migrate all workloads to EU-native infrastructure simultaneously. They classify workloads by sensitivity and regulatory requirement, then apply appropriate infrastructure to each classification.
Non-sensitive global workloads — public-facing applications, development environments, analytics on anonymised data — can remain on hyperscaler infrastructure where the cost and capability advantages are most pronounced. Personal data, regulated workloads, and sensitive government applications migrate to EU-native providers capable of achieving SEAL Level 3 or above. The most sensitive applications — those involving classified information, critical infrastructure, or data subject to the highest regulatory scrutiny — may require on-premises or air-gapped infrastructure that no cloud provider, European or otherwise, can adequately protect.
This "multi-cloud by classification" approach requires a governance architecture that can enforce workload placement policies, monitor compliance with classification rules, and audit the actual location and access patterns of sensitive data. It is more complex than a single-provider strategy, but it is the only approach that can simultaneously satisfy sovereignty requirements and maintain access to the capabilities that hyperscalers provide.
Contractual Safeguards
Beyond infrastructure selection, organisations pursuing genuine sovereignty must address the contractual architecture of their cloud relationships. Experts recommend including "change-of-control" clauses that allow for contract termination without penalty if a provider is acquired by a non-EU entity — a lesson learned from the Kyndryl acquisition of Solvinity, which transferred a nominally EU-aligned provider into a US corporate structure without triggering automatic contract review.
Data portability provisions, audit rights, and incident notification requirements should be specified in contractual terms rather than assumed from regulatory compliance. The EU Data Act's portability mandate establishes a floor; organisations with genuine sovereignty requirements should negotiate above it.
The Honest Assessment
Europe's cloud sovereignty agenda is serious, well-resourced by regulatory standards, and structurally necessary. The CADA framework, the EU Data Act, and the Cloud Sovereignty Framework together constitute the most coherent attempt yet to operationalise digital independence at continental scale.
But regulation cannot substitute for infrastructure. The €120 billion investment gap is real, and it will not be closed by legislative mandates alone. The European cloud ecosystem needs capital, talent, and time — and it needs organisations willing to accept the capability trade-offs that come with choosing EU-native providers over hyperscalers for regulated workloads.
The sovereignty illusion — the belief that residency equals sovereignty — has been expensive. The 2026 regulatory wave is dismantling it, one framework at a time. What replaces it must be built on a clearer understanding of what sovereignty actually requires: not just where data sits, but who can reach it, under what legal authority, and with what recourse for the organisations and individuals whose data it is.
That is a harder problem than geography. It is also the only problem worth solving.
