How European research and infrastructure teams are turning sovereignty from a policy goal into an operational reality.
On June 18, 2026, experts and practitioners from research, healthcare, the public sector, and the cloud industry gathered at the de.KCD Industry Forum in Berlin. They spent the day focusing on one central question: what digital sovereignty really means for Germany and Europe, what the risks are, and how sensitive data can be kept within European legal and operational control.
The forum was convened by the Berlin Institute of Health (BIH) at Charité under the banner “Bridging the Gap Between Research and Industry: Secure Data Management.” Speakers ranged from Germany’s Federal Ministry for Economic Affairs and Energy (BMWE) and Intel to BIH at Charité. Among them, Dr. Kenneth Tan, Executive Director of Sardina Systems, examined the practicalities of building sovereign cloud infrastructure in Europe.
The de.KCD event reflected an important shift in Europe’s digital sovereignty discussion. Instead of discussing the theoretical concept, many speakers focused on operational and practical questions: how to build and verify it, how to maintain control and access, how to choose technologies, and what challenges to avoid.
Notably, open source frequently emerged as a foundation on which European organizations can gain control, maintain infrastructure security, and keep operations effective.
Key takeaways for Organizations Pursuing Digital Sovereignty in Europe
- Simply keeping data in the EU does not by itself guarantee legal, operational, or technological sovereignty.
- European research and healthcare organizations are already building secure environments based on open infrastructure and open standards.
- Sovereignty claims need to be verified across jurisdiction, access, architecture, and operations rather than accepted only through marketing or contractual language.
Here are some highlights worth the attention of specialists interested in digital sovereignty as a long-term strategy for Germany and Europe.
Cloud&Heat: why EU data residency does not guarantee legal sovereignty
Perhaps the sharpest reality check came from Dr. Ronny Reinhardt of Cloud&Heat. In his talk, he scrutinized the “sovereign cloud” claims of US-based providers. While almost every hyperscaler lists a European sovereign cloud offering in its portfolio, Reinhardt argued that the data center location does not automatically imply legal sovereignty.
Specifically, Dr. Reinhardt quoted the US CLOUD Act, which requires covered providers to disclose, preserve, and back up communications within their possession, custody, or control. Moreover, the act applies regardless of whether the relevant information is located within or outside the United States.
What does this mean for a data center in Berlin, Frankfurt, or elsewhere in the EU? Based on the evidence presented, if an operator remains subject to US jurisdiction, it may also remain subject to US law, even when the data is physically stored in Europe. EU data residency alone may therefore be insufficient to guarantee legal sovereignty.
Another examination of the claims from hyperscalers like AWS, Microsoft, or Google confirms that neither of them can guarantee full legal and technological sovereignty for European organizations. This further proves the need for tech teams to look beyond marketing terminology.
GHGA: Trusted Research Environments on an OpenStack foundation
Some data, such as human genomic data, requires the utmost attention and care. Research depends on access to high volumes of raw data, which creates additional risks when it comes to storing, processing, and protecting it from unauthorized access or leaks.
GHGA’s Dr. Pascal Kraft explained how its OpenStack-based platform provides a Trusted Research Environment (TRE) for omics data without compromising on security. This session added another angle to digital sovereignty beyond the problem of foreign operators: depending entirely on infrastructure outside an organization’s control can itself create significant risks. Therefore, research teams working with sensitive data need a clear understanding, if not full control, of how their infrastructure is operated and secured, even when parts of it are provided by external partners.
For research organizations looking to retain greater control over sensitive workloads, explore FishOS Cloud for Life Sciences Research: scalable, high-performance infrastructure designed to support data-intensive innovation.
BIH at Charité: building and federating secure environments adhering to digital sovereignty principles
The Berlin Institute of Health (BIH) at Charité contributed several sessions, showing what security and digital sovereignty look like over time and across institutions.
Peter Brunecker’s session traced Charité’s data platform from 2013 through to its 2026 architecture, which currently uses Kubernetes as part of its private cloud infrastructure, kept behind the hospital’s firewall. In turn, Sven Twardziok elaborated shared how the ELIXIR Europe Compute Platform is building federated and secure computing environments using open standards such as the GA4GH Cloud APIs, supporting cloud and hybrid computing environments based on EU standards.
Sardina Systems: architecture, verification and deployment models for Europe
Sardina Systems’ contribution came from Dr. Kenneth Tan, Executive Director, with “Sovereign Cloud in Europe: Architecture, Verification, and Deployment Models.” He focused on the practicalities of approaching and building a sovereign cloud in Europe, from choosing a deployment model and designing its architecture to applying a thorough verification process for technical teams.
The talk addressed an essential gap for European organizations considering a system based on an open-source IaaS: OpenStack, Kubernetes, Ceph, and open hardware. Selecting open technologies can reduce dependence on proprietary platforms, but the deployment still needs to be evaluated across legal, technical, operational, and supply-chain dimensions.
He focused on practicalities of approaching and building a sovereign cloud, from choosing a deployment model and designing its architecture to applying a thorough verification checklist for technical teams. This talk filled an essential gap for anyone considering building a system on the open-source IaaS stack (OpenStack, Kubernetes, Ceph, and open hardware).
Dr. Tan’s presentation also reinforced the growing interest in digital sovereignty among German organizations. Citing Bitkom’s Cloud Report 2025, he highlighted that 82% of German companies supported the development of powerful cloud providers from Europe, while 50% of existing cloud users were rethinking their cloud strategies due to the geopolitical situation.
This framing also reflects Sardina Systems’ work: making open-source-based infrastructure practical to deploy, operate, and upgrade through the FishOS platform, so that “sovereign by design” becomes “sovereign in practice,” specifically for sensitive workloads.
Learn more about sovereign cloud deployment models and how what to look for when choosing one in this article.
scienceOS: secure AI for European researchers
Henrik Deda’s session on scienceOS, an EU-based AI research assistant, provided additional insight into the forum’s fourth theme: Secure AI. The timing could not be more relevant. As US companies dominate much of the AI industry, European researchers in need of advanced tools are often forced to rely on foreign services. This raises familiar questions: where research data is processed, whether prompts and files are retained, whether they are used for model training, and which jurisdictions apply.
In this regard, solutions that keep data on servers within the EU, operate under EU law, and do not train on user data offer an important alternative. Moreover, the case of scienceOS demonstrates that digital sovereignty is not just a buzzword or a distant dream. It is a working and evolving framework for the next generation of Europe’s research and IT sectors.
What digital sovereignty means for European infrastructure teams
If you are running or building infrastructure for a university, research institute, hospital, or government body in Germany or elsewhere in the EU, three things from Berlin are worth carrying forward.
- First, working solutions exist. Projects built on open-source foundations such as OpenStack, Kubernetes, and Ceph are already operating and evolving in European research environments, demonstrating that full control over infrastructure and data is achievable.
- Second, digital, and especially cloud sovereignty has to be provable, not just contractual. European technical teams need to examine where data resides, who can access it, which laws and jurisdictions are involved, and whether their setup complies with the EU regulations.
- Third, digital sovereignty will likely remain a long-term strategy for Europe rather than a reaction to current events. Regulations that are being introduced worldwide, be it the EU Data Governance Act or the US CLOUD Act, complemented by success stories of EU-based organizations indicate that more companies and organizations will be pursuing the strategy in the future.
For teams reflecting on their strategy, the most useful next step is a careful evaluation: which workloads genuinely require full control, which can be placed with a European provider, and what it would take to verify either option.
That is a conversation Sardina Systems is glad to support. Reach out to discuss your workloads, deployment model, and infrastructure requirements.
