In the corridors of the Berlaymont building and across the policy institutes clustered around the European Quarter, a conversation that spent years at the margins of Brussels discourse has moved decisively to the center. Digital sovereignty — the question of who legally controls the infrastructure on which Europe’s governments, hospitals, banks, and businesses run — is no longer a theoretical concern for regulators and think tanks. It is now a live compliance obligation, a procurement requirement, and increasingly, a geopolitical priority.
The timing is not coincidental. Three major regulatory frameworks have converged in 2025 and 2026 to make cloud sovereignty not just desirable but legally necessary for a wide range of European organizations. The NIS2 Directive, the Digital Operational Resilience Act, and the EU Artificial Intelligence Act together constitute the most comprehensive digital governance framework any major jurisdiction has ever assembled. For organizations trying to navigate all three simultaneously, the question of which cloud provider they use has become inseparable from the question of whether they are compliant at all.
The Jurisdiction Problem That Policy Couldn’t Paper Over
Brussels has known about the structural vulnerability for years. The collapse of the Privacy Shield agreement — the legal mechanism that governed data transfers between the EU and the United States — offered a sharp early warning that the conflict between European privacy law and American surveillance authority could not be resolved through contractual arrangements alone. The Schrems II ruling by the Court of Justice of the European Union made explicit what many had long suspected: that U.S.-controlled cloud providers operating in Europe were subject to legal demands from American authorities that directly conflicted with EU data protection obligations.
The response from major American technology companies was to offer reassurances, restructured data processing agreements, and — more recently — a new generation of “sovereign cloud” products designed to address European concerns while keeping European customers on American platforms. AWS launched its EU Sovereign Cloud. Microsoft established EU-specific legal entities to govern its Azure services for regulated customers. Google has followed similar paths.
These offerings represent a genuine attempt to address sovereignty concerns within existing commercial structures. But critics — and a growing number of European regulators and procurement officials — argue that they do not fully resolve the jurisdictional problem. When the underlying company is incorporated in the United States and subject to U.S. law, the legal exposure created by the CLOUD Act and related legislation does not disappear simply because a European subsidiary is named in a contract.
What the Regulatory Triad Actually Requires
Understanding why digital sovereignty has become mandatory in 2026 requires understanding what each of the three major frameworks actually demands — because they approach the problem from different angles and together leave very little room for ambiguity.
NIS2 expanded the definition of “essential” and “important” entities to encompass a far broader range of organizations than its predecessor, and it introduced meaningful supply-chain accountability requirements. Organizations cannot simply sign contracts with cloud providers and assume compliance; they must be able to demonstrate actual control and visibility over their digital supply chain, including subcontractors and platform operators. For many organizations, this is the provision that has most forcefully raised questions about whether U.S.-owned cloud infrastructure can be part of a compliant architecture.
DORA, which applies to the financial sector and its technology service providers, introduces resilience and concentration risk requirements that directly challenge the industry’s dependence on a small number of large hyperscalers. Financial institutions must demonstrate not just that they can operate on their chosen cloud platform, but that they can survive its unavailability — and that they have credible exit strategies that do not create further concentration risk.
The EU AI Act adds a dimension that extends sovereignty concerns into entirely new territory. High-risk AI systems must operate under EU jurisdiction end to end — not just where the model is deployed, but where it was trained, where its inference happens, where its logs are stored, and where its telemetry is collected. For organizations building AI-powered products and services, this creates architectural requirements that are very difficult to meet on non-EU-governed infrastructure.
The European Providers Stepping Into the Gap
The good news from Brussels’ perspective is that the European cloud industry has matured considerably from the underpowered collection of national champions it was five years ago. A new generation of EU-native providers has built genuinely competitive infrastructure — and a growing number of European enterprises have begun migrating serious workloads to them.
OVHcloud, the French company that operates more than thirty data centers globally with a strong European core, has become the reference point for large-scale EU-sovereign cloud deployments. It participates actively in Gaia-X, holds the certifications relevant to healthcare, government, and financial services, and offers a product portfolio spanning IaaS, managed Kubernetes, and AI infrastructure. For organizations that need the breadth of a hyperscaler with EU jurisdictional guarantees, OVHcloud is the most established choice.
Germany’s Hetzner has built a different kind of reputation — exceptional price-to-performance, flat-rate pricing, and reliable infrastructure that makes a genuine cost case for EU-sovereign cloud rather than just a compliance case. Cloud architecture firm Gart Solutions, which specializes in sovereign-first cloud design and migration, has documented migration projects where organizations moved from major American providers to Hetzner and reduced infrastructure costs by sixty percent while simultaneously improving their compliance posture. The firm’s case studies offer useful evidence that sovereign cloud is not simply an expensive regulatory burden but can represent genuine operational improvement.
Scaleway, also French, has positioned itself as the developer-friendly end of the EU sovereign market — modern tooling, managed databases, serverless functions, GPU compute for AI workloads, and a pricing model built for the startup and scaleup market. For Brussels-based tech companies and EU-funded projects that need compliant infrastructure without sacrificing developer experience, Scaleway has become an increasingly common choice.
T-Systems, backed by Deutsche Telekom, occupies the government and enterprise end of the spectrum — operating the Open Telekom Cloud with the kind of high-assurance certification and hybrid cloud capabilities that public sector organizations and critical infrastructure operators require.
The Metadata Question That Brussels Hasn’t Fully Resolved
Among the nuances of the digital sovereignty debate, one issue has received less attention than it deserves, even in well-informed Brussels circles: the question of metadata sovereignty.
Sophisticated cloud platforms do not simply store the data that organizations put into them. They continuously generate operational metadata — logs, diagnostics, traffic patterns, API call records, access credentials, latency data, and telemetry. This metadata can reveal remarkably detailed information about an organization’s operations, its customers, its transaction patterns, and its commercial relationships.
The critical point is that this metadata may fall under foreign jurisdiction even when the underlying data is encrypted and stored within EU borders. If the platform generating and handling the metadata is operated by a U.S.-controlled entity, the CLOUD Act exposure extends to the metadata regardless of the physical location of the servers.
For organizations in regulated sectors, this represents a compliance gap that is frequently underestimated. A genuinely sovereign architecture requires that data, metadata, and support services all remain under EU legal authority — closing a vulnerability that more superficial compliance assessments tend to miss. Firms like Gart Solutions have made metadata sovereignty a specific focus of their cloud assessment methodology, helping organizations identify where their exposure actually lies rather than where they assume it lies.
Gaia-X and the Federated Vision
Any serious treatment of European digital sovereignty must address Gaia-X — the EU’s flagship initiative to create a federated cloud ecosystem that would connect European providers, users, and platforms under shared standards of trust, interoperability, and portability.
The honest assessment from Brussels is that Gaia-X has delivered less than its original ambitions promised. Critics have noted that the inclusion of major American technology companies in the initiative’s governance structures created contradictions at its core, and the gap between the project’s vision and its practical outputs has attracted significant commentary. Six years on from its launch, the federated European cloud it described remains more aspiration than reality.
But this critique, while fair, understates what Gaia-X has actually accomplished. Its standards work on data portability, federated identity, and interoperability has created a common framework that individual EU cloud providers are increasingly adopting. Its governance model for trusted data spaces has influenced sector-specific initiatives in automotive, healthcare, and energy. The vision of vendor-neutral cloud architectures that allow organizations to move workloads between compliant providers — rather than recreating the proprietary lock-in that characterizes the hyperscaler model — is being built out incrementally, even if more slowly than hoped.
The more recent EuroStack initiative, which takes a narrower and more focused approach than Gaia-X to building genuinely European alternatives to hyperscaler infrastructure, represents a second attempt to organize European cloud independence around more concrete deliverables.
What Organizations in Brussels Should Be Doing Now
For the organizations — European institutions, national government bodies, regulated enterprises, international NGOs, and the dense ecosystem of policy-adjacent consultancies and think tanks that populate Brussels — the practical question is what to do with this regulatory environment.
The starting point is an honest cloud audit. Many organizations have less visibility into their actual cloud posture than they believe. Data that is nominally stored in EU data centers may be governed by non-EU legal frameworks. Metadata generated by EU-hosted workloads may be collected and processed by U.S.-controlled entities. Support and diagnostic access may involve personnel outside EU jurisdiction. Mapping the actual situation — rather than the assumed situation — is the necessary foundation for any sovereignty strategy.
From that baseline, a workload classification exercise determines where sovereignty requirements are most acute. Not every digital function requires the same level of jurisdictional protection. Public-facing communications, content delivery, and non-sensitive operational tools may be appropriate for continued use of global platforms. But citizen data, financial records, health information, AI training datasets, and the operational telemetry of critical systems warrant sovereign infrastructure.
The architecture that emerges from this exercise for most large organizations will be hybrid — not a wholesale migration away from all existing platforms, but a deliberate separation of workloads by sensitivity, with clear governance frameworks determining which infrastructure each category of data and application may use.
The Strategic Dimension
It is worth stepping back from the compliance detail to observe what is happening at a strategic level. Europe is, for the first time, assembling the regulatory architecture and the industrial capacity to make a credible claim to digital independence. The question of whether that claim is realized in practice depends heavily on decisions being made right now — by procurement officers, technology architects, board-level executives, and the policy officials in institutions along the Rue de la Loi who are writing the implementing rules for the frameworks already on the books.
The organizations that treat digital sovereignty as a compliance checkbox to be managed will find themselves repeatedly surprised by tightening requirements and shifting enforcement priorities. The organizations that treat it as a strategic infrastructure decision — one that shapes their long-term operational resilience, their competitive positioning in regulated markets, and their relationship with the EU regulatory ecosystem — are building durable advantage.
Brussels, of all places, should understand that the gap between policy aspiration and operational reality is closed not by announcements but by implementation. Digital sovereignty is now in the implementation phase.
