Digital Sovereignty & Sovereign Cloud: The CTO’s Perspective

Estimated reading time: 10 minutes

Introduction

Gartner estimates the sovereign cloud market to grow to $169 billion by 2028. Driven by a combination of geopolitical pressures, EU regulations, and the growing role of AI and cloud infrastructure in critical national systems, sovereignty has moved from a theoretical concern to an operational one. The growing strategic tension between Europe and the United States, amplified in 2025 by geopolitical instability and laws like the U.S. CLOUD Act has brought digital dependency into sharp focus. The concern over data exposure and control catalysed renewed efforts across Europe to reclaim digital sovereignty. Both governments and enterprises, especially in critical sectors like defence, healthcare and public administration, began to reassess whether sensitive national data and infrastructures should be entrusted to foreign-owned technology providers. 

From this article, you will learn what digital sovereignty is and why it has become a critical issue. We wil explore the current sovereign cloud market and help you understand the trade-offs between solutions from U.S. hyperscalers and EU-based providers. 

From Digital Sovereignty to Sovereign Cloud

What is Digital Sovereignty? 

Digital sovereignty is a principle that refers to a nation’s ability to govern and protect its digital infrastructure, data, and technology decisions, often across dimensions like privacy, security, and regulatory compliance. Organisations operating in sovereign regions must navigate local rules to align their data governance, IT systems and partner ecosystems accordingly. While the parameters of digital sovereignty are easy to identify, there is no consensus on what sovereignty is and how people achieve it. 

What is Sovereign Cloud? 

Within this context, the sovereign cloud is one specific lever of digital sovereignty. While digital sovereignty spans entire technology stacks, sovereign cloud initiatives typically emphasise cloud infrastructure and services that respect national controls over data residency, access and compliance. 

While this article focuses on the Sovereign cloud, another critical layer of Digital sovereignty is Sovereign AI, as its multi-layered role is deeply intertwined with the cloud. The EU’s ambition to invest €200bn in AI, and Nvidia’s partnership with Mistral for a Sovereign AI infrastructure hint at the possible rise of Sovereign AI as the next major frontier in sovereignty strategies, which could also further drive a need for sovereign cloud.

Lastly, hardware remains the foundational layer of digital sovereignty. Despite having a significant role in the semiconductor production cycle, the EU only produces around 10% of the world’s chips. Through the Chips Act, the EU aims to double that share to 20%, which will strengthen the entire digital value chain. From local chip design and production to sovereign data centres and cloud ecosystems, this will add resilience and reduce dependency on foreign providers.

Defining the range of the Sovereign Cloud

The sovereign cloud is a spectrum of solutions. At one end, hyperscalers offer localised services that just meet regulations, but still fall under foreign jurisdiction; notably under the U.S. CLOUD Act. At the other end lies a private cloud and locally developed solutions, offering nearly full operational and legal control. In between, the concept of a “Trusted Cloud” is emerging. It combines the scalability of public cloud with enhanced legal and operational safeguards. Examples include Microsoft’s Azure Local and joint ventures like S3NS.

This diversity of offers reflects varied interpretations of sovereignty and makes it difficult for clients to navigate without external guidance.

Different needs for different industries

Regulatory requirements vary significantly by sector. Examples include DORA in finance or health-specific residency rules, which are pushing organisations toward tailored cloud solutions rather than one-size-fits-all models.

Cross-border operations add further complexity. A European pharmaceutical firm, for example, may face strict local data laws for R&D in Germany, distinct certifications in France (SecNumCloud), and looser controls in Spain. This often leads to hybrid, multi-vendor architectures spanning both hyperscalers and regional providers.

For many firms, choosing the right mix of technologies and partners will require external guidance. The diversity of offerings, legal frameworks and maturity levels makes this an area where sector-specific advisory is essential. 

Why Does Digital Sovereignty Matter?

Digital sovereignty matters for a range of reasons, spanning legal compliance, strategic policy, economic growth, and societal security.

Let’s look closer at the reasons why we should be talking about digital sovereignty:

1. Regulatory Compliance 

A growing wave of regulations, such as the EU’s DGA, NIS2, and DORA, creates a direct legal necessity for digital sovereignty. These rules compel organisations to take strict control over where and how their data is stored, processed, and accessed to ensure security and privacy, making compliance a primary driver.

2. Governmental and Geopolitical Pressure 

Governments are often the primary force shaping demand for sovereign solutions through public procurement and national policies like data localisation. This is amplified by geopolitical factors, such as the U.S. CLOUD Act, creating a strategic urgency for technological independence to protect data from foreign jurisdictions and influence.

3. Customer Trust and Business Resilience

For businesses, guaranteeing that customer data remains under the protection of local laws is a powerful competitive differentiator that builds trust. Furthermore, it enhances business continuity by reducing the operational and supply chain risks associated with relying on infrastructure that could be affected by the politics or laws of another country.

4. Societal Values and National Security

Fundamentally, digital sovereignty is about maintaining democratic control over a nation’s digital future. It ensures that a society’s own laws and ethical values govern its data. It is also a critical component of national security, protecting critical national infrastructure—like power grids, financial systems, and healthcare—from potential foreign interference or disruption.

Current Digital Sovereignty Market in EMEA

The current supply market in Europe is fragmented – on one hand, we have American hyperscalers, on the other, Europe-based providers. In the following sections, we will examine both sides with their strengths and weaknesses.

U.S.-based cloud providers are actively evolving their offers to respond to European sovereignty requirements. AWS, Google and Microsoft have all committed substantial resources to localising infrastructure, adapting their governance models and partnering with national entities. 

Microsoft has taken the most layered approach. It offers a Sovereign Public Cloud model with EU-based data centres operated exclusively by EU personnel, alongside services like Azure Local and the soon-to-launch M365 Local, which allow organisations to deploy Microsoft services on customer-owned infrastructure. In addition, Microsoft has created national joint ventures (e.g. Bleu in France, with Proximus in BeLux).

Google has more recently invested in local infrastructure, namely data centres in Germany and partnering with Schwarz Group (STACKIT) and Thales (S3NS) in France. These moves strengthen its compliance posture.

AWS has announced its European Sovereign Cloud in 2025. The offer will be delivered through a German-based holding and EU-only subsidiaries, with operations run entirely by EU staff. 

Overall, hyperscalers bring maturity, scale, and broad functionality. For clients operating in sensitive sectors or under strict national certifications, these offers may not meet baseline requirements without additional legal, technical, or organisational safeguards.

European cloud providers occupy a critical space in the sovereign cloud landscape. Unlike hyperscalers, they operate entirely within EU jurisdiction and are not subject to extraterritorial laws. This makes them the preferred option for public-sector clients and highly regulated industries.

Their positioning is often reinforced by trusted ownership structures and proximity to national priorities. Many of these providers are backed by telecoms, defence groups, both of which are usually partly state-owned and/or heavily regulated against foreign takeovers, or public-sector partnerships which help build political and institutional trust. In countries like France and Germany, where sovereignty is a strategic priority, these actors are often the only ones eligible for critical certifications such as SecNumCloud in France, ISO 27001 globally or DORA for BFSI. 

However, their offers are not as broad. Most operate only within limited geographic areas, lack the breadth of services found in public cloud platforms, and struggle with interoperability and scale. Their maturity is uneven, with many still building out infrastructure and services. In practice, clients often face higher costs, lower performance and limited flexibility compared to hyperscalers.

As a result, while EU providers are the most compliant from a sovereignty standpoint, they are rarely sufficient on their own. Clients must weigh legal guarantees against technical and economic trade-offs, often accepting complexity and fragmentation to meet both compliance and operational needs.

Devoteam as Your Sovereignty Partner

Many organisations face complex decisions across legal, technical, and organisational dimensions. They must navigate incompatible offerings, unclear certifications, and evolving compliance obligations, often without internal expertise or a clear market reference.

Devoteam is well-positioned to help clients navigate the regulatory, technical and strategic complexity of this evolving market. For over 30 years, we have been delivering lasting results in Cloud, Data, Cyber and AI for industries and public institutions across EMEA. 

Bridging the Sovereignty Gap

As mentioned before, no single vendor offers a complete sovereign cloud solution. Organisations often require a hybrid approach using multiple providers. Devoteam recognises that and combines the best of both worlds. We have a deep expertise in designing and implementing future-ready multi-cloud and hybrid architectures. For maturity, scale, and broad functionality, you can benefit from our strong partnerships with major US hyperscalers, including Microsoft Azure, Google Cloud, and AWS. Simultaneously, to address client concerns regarding foreign jurisdiction, we join forces with providers that operate entirely within European jurisdiction, such as Scaleway, S3NS, or STACKIT. 

EMEA Focus and Local Capabilities

We have established that the European market for sovereign cloud is highly fragmented. Demand is driven by national regulations and strategic priorities, which vary significantly from country to country. To address that, Devoteam combines an EMEA-wide perspective with technical expertise and strategic guidance tailored to local constraints. 

In France, which is the most mature market, Devoteam addresses strict national “Cloud de Confiance” requirements with a dedicated, well-funded program and deep expertise in compliant hybrid architectures. Additionally, we partner with providers like Scaleway, S3NS, and OVHcloud. Devoteam France has structured its delivery around a dedicated cross-functional governance team, reinforced by experts in compliance (SecNumCloud, RGPD, LPM), security architecture, and sovereign cloud engineering. Germany is another high-demand market, where we partner with local providers like Stack-IT and have a team of sovereignty experts. In emerging markets such as Sweden, Devoteam is proactively capturing growth with its G Cloud Nordics team, which is fully equipped with a clear strategy and trained staff to address local data residency rules.

Conclusion

The journey to digital sovereignty isn’t about choosing one provider, but about building the right strategy for you. The current market is fragmented. On one side, you have the power and scale of US hyperscalers, shadowed by questions of foreign jurisdiction. On the other hand, there are EU-based providers offering legal certainty but often with trade-offs in functionality and scale.

The reality is that a ‘one-size-fits-all’ solution doesn’t exist. Success lies in creating a smart, hybrid strategy that draws on the best of both worlds, ensuring you meet both your operational goals and your compliance duties.

This is where expert guidance becomes essential. At Devoteam, we understand both the technology and the landscape. We help you navigate the trade-offs, design a resilient hybrid architecture, and select the right partners to meet your unique needs.