As European countries continue to feel the extraterritorial reach of American law over global digital infrastructure, the issue of sovereign cloud is no longer theoretical. While there are no new direct sanctions or export restrictions on technology targeting European countries, the ongoing legal framework — particularly the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) — still obliges U.S. cloud providers to comply with data requests from American authorities, even when that data is stored and processed in the EU. Combined with secretive data access provisions and liability waivers for providers, this creates a structural vulnerability in Europe’s digital sovereignty.
American hyperscalers — Amazon, Microsoft, and Google — continue to dominate the European cloud market. In this article, we take a closer look at how these providers comply with GDPR while remaining fully subject to U.S. jurisdiction. We also explore potential exit strategies for organizations seeking to build a truly sovereign cloud infrastructure.
Rooted in 2018: The CLOUD Act and the False Promise of Sovereign Cloud
The text of the CLOUD Act nominally allows for the consideration of foreign laws and legal objections. However, it explicitly shields providers from any legal liability for complying with U.S. government requests. Under Section 2705 — “Delayed Notice”, notification to users can not only be postponed but also completely prohibited (gag order), meaning users may never learn about it. In such cases, it is difficult to go to court or apply EU legal protections if the U.S. administration makes a request directly to an American company and the user is never informed.
Moreover, an additional clause to the CLOUD Act states that the provider bears no liability for cooperating with U.S. authorities, and in the event of legal proceedings, none of the hyperscalers will suffer consequences:
“(d) No Cause Of Action Against A Provider Disclosing Information Under This Chapter. No cause of action shall lie in any court against any provider… for providing information, facilities, or assistance in accordance with a court order under this chapter…”
Hyperscalers operate with massive marketing budgets and are highly effective at shaping narratives at the right moment. Today, nearly every major U.S. cloud provider offers some form of a “sovereign” cloud product tailored to the European market. One of the most frequently cited examples is: “The AWS European Sovereign Cloud will operate with an independent governance structure, a dedicated Security Operations Centre, and under a newly established parent company that will be locally controlled in the EU, led by EU citizens and subject to local laws.”
At first glance, this sounds like compliance with European sovereignty principles. But a closer look reveals that these design elements, such as a locally registered company, EU-based leadership, and adherence to local laws, are primarily designed to meet GDPR and data protection requirements, not to eliminate U.S. jurisdiction.
In fact, no hyperscaler has publicly committed to exiting the scope of U.S. legal authority, nor have they clarified how such “sovereign” products are shielded from obligations under laws like the CLOUD Act. The U.S. legal framework continues to apply extraterritorially and only acknowledges conflicts with EU law after the fact.
Given that ultimately such European sovereign offerings still rely on U.S.-owned technology stacks, including cloud control planes and infrastructure, access to data remains possible — albeit more layered. As already mentioned, access requests can be made in secret, and providers are legally protected from liability for cooperating with U.S. authorities.
This creates a troubling asymmetry: a European legal entity may be held accountable locally, but in the event of a breach or covert access, the business whose data was compromised gains little recourse, and the U.S. parent company faces no legal consequences.
How Did Europe’s Sovereign Cloud Dependence Happen?
At first glance, the legal landscape seems clear. Simply stop using U.S.-based cloud providers. By 2026, it should be obvious to any European citizen that goodwill is no longer the primary driver of American policy. And yet, the numbers tell a different story:
“The European cloud market is largely dominated by U.S. providers, creating structural dependencies and posing risks to the confidentiality of European data. European cloud providers’ market share dropped from 29% in 2017 to 15% in 2022, though it has stayed relatively constant since then. The main beneficiaries of the market growth have been Amazon, Microsoft, and Google, who now account for 70% of the regional market.”
Despite the CLOUD Act being in effect for eight years, since 2018, 70% of the European cloud market still relies on American providers. Given the lack of transparency and marketing phrases like “even we cannot access it,” it’s important to recognize that this is a convenient but incomplete narrative. One could reasonably assume that if a hyperscaler were ever publicly accused of a data leak, the official response would be a carefully crafted denial: “We can’t access your data, so we can’t confirm or deny anything! It’s technically impossible!”
Cloud sovereignty in public clouds ultimately comes down to trust in a black box. When a major provider like AWS says, “not even we can access your data,” thanks to isolation, encryption, and architecture, we are asked to take it on faith. Customers have no technical means to verify how the internal mechanisms work, how data is handled during processing, or how access controls are enforced. But you don’t need to be a computer science expert to understand that encrypted data must be decrypted at some point during processing — specifically, in memory. And in-memory data is, by definition, accessible to the system operating on it. This simple but critical technical fact is often omitted in public statements and marketing materials, yet it sits at the heart of the sovereignty debate.
Legally, the situation is even murkier. Hyperscalers comply with GDPR, obtain certifications (e.g., CISPE), partner with local firms, and offer data residency. But they remain under U.S. jurisdiction, cannot ignore the CLOUD Act, and are obliged to fulfill U.S. government data requests — even if the data resides in Frankfurt or Paris. No matter how many technical assurances providers give, the legal possibility of intervention remains, leaving customers to choose between trust and infrastructure fully governed under European jurisdiction.
So What’s the Sovereign Cloud Alternative?
Alternatives do exist, even if difficult. If Europe had taken action a decade ago, the landscape might look very different today. The core issue is control, and true control comes only by understanding and governing each stage of data processing and computation.
Today, European organizations have access to a range of real alternatives to U.S. hyperscalers, which allow them to retain data control and comply with sovereignty requirements. Leading providers include T-Systems, Orange Cloud, and others — operating under EU jurisdiction, using local data centers, and increasingly certified under trusted cloud standards like France’s SecNumCloud or GAIA-X.
This ecosystem is further supported by open-source technologies — primarily OpenStack (for IaaS), Kubernetes (for orchestration), Ceph (for distributed storage), and platforms like FishOS. Many niche providers also offer pre-integrated, supported, and hosted solutions, making open source more accessible. Expert support is key here — enabling faster deployment and more effective use of these tools. In practice, a blend of open source with commercial support often proves more cost-effective and sustainable than relying solely on European hyperscalers.
Understanding What You Control: Two Paths to Sovereignty
Full Technical Control: Sovereign Cloud as an Architectural Choice
Full technical control represents the highest level of cloud sovereignty, where the organization governs every infrastructure and software layer directly — without intermediaries. This model is particularly relevant for governments, defense, healthcare, and critical industries.
Key technical components:
- Data center: Located in the EU, operated by the organization or a trusted local provider, not under foreign jurisdiction (e.g., U.S., China).
- Hardware: Sourced from vendors with transparent supply chains; maintained in-house or by local teams.
- Networking: Full control over routing, DNS, and telecom infrastructure; no third-party traffic inspection or SaaS-based firewall services.
- IaaS/container platform: Built on OpenStack (virtualization), Kubernetes (orchestration), Ceph (storage), and Kata Containers (isolation).
- Encryption: Enforced at all levels — at rest in transit; keys managed locally via HSM or BYOK/HYOK — inaccessible to the cloud provider.
- Access control (IAM): Local identity platform, not tied to Azure AD, Okta, AWS IAM; full control over tokens, roles, logs, and MFA.
- Control plane: Deployed in-house, independent of SaaS; tools like CloudKitty (billing), VictoriaMetrics/Prometheus/Grafana (monitoring), and ELK (logging) are used locally.
- CI/CD and DevOps: Self-hosted pipelines (GitLab, Jenkins, ArgoCD); no reliance on external APIs.
- Legal structure: Cloud operated and owned by an EU-registered entity; no foreign capital or control.
This provides true sovereignty, where even theoretical access is eliminated. The downside is higher cost, required expertise, and full operational responsibility.
Legal Guarantees: Delegated Sovereign Cloud via Trusted EU Providers
The second path is delegated control, using a European cloud provider while relying on legal and technical assurances for GDPR and sovereignty compliance. This is a more pragmatic, cost-effective route for most organizations not ready to build their own cloud. Key elements of sovereignty in this model:
- EU jurisdiction: The provider is an EU-registered legal entity, with no ties to jurisdictions with extraterritorial laws.
- Infrastructure: Data centers are located within the EU and operated by European companies.
- Certification: Providers are certified under SecNumCloud (France), CISPE, and EUCS (in development) — ensuring compliance with GDPR and national regulations.
- Technology: Often based on OpenStack or similar stacks. For example, OVHcloud, 3DS Outscale, GRASS-MERKUR, and NumSpot run entirely within the EU using open technologies.
- Encryption: BYOK or HSM options enable customers to manage encryption keys independently.
- Access control: Strict IAM rules, with support for federated identity systems.
- Contracts: Include obligations to notify clients about access requests, define personal data processing, and comply with GDPR.
- Transparency: Providers offer access logs, external audit reports, and compliance disclosures.
This model is already in use in national cloud projects (Bundescloud in Germany, NumSpot in France), and in regulated industries. While not technically absolute, it offers legally delegated and managed sovereignty — a practical compromise between risk, cost, and deployment speed.
Why Are We Still Dependent?
The main reason is the technological maturity and ecosystem depth of American hyperscalers. AWS, Azure, and Google Cloud offer vast service catalogs — from AI to DevOps — and “plug-and-play” solutions that don’t require deep internal expertise.
There’s also a skills gap. The job market is dominated by hyperscaler certifications, while engineers experienced with OpenStack, Ceph, or sovereign stacks are in short supply. Add to this the marketing power of hyperscalers (generous grants, training programs, startup support, and aggressive partnerships). European alternatives are often seen as more complex, expensive, and less scalable — but it doesn’t have to be that way.
Finally, the lack of strong regulatory pressure in the EU to mandate sovereign-only cloud use means many organizations continue to rely on U.S. platforms, prioritizing convenience and scale over long-term autonomy and legal certainty.
