Why European companies need to rethink their cloud strategy now.
Schrems II was just the start.
For five years, European companies have treated the question of cloud sovereignty as a compliance problem: something to be managed around, documented against, and hedged with contractual clauses. That framing is no longer tenable.
Between Schrems II, the EU AI Act, and the steadily escalating application of the CLOUD Act in US jurisdictions, data residency has moved from legal fine print into strategic architecture. Where your data lives now determines which products you can ship, which customers you can onboard, and which regulators you can satisfy.
The CLOUD Act problem, in one paragraph
The US CLOUD Act of 2018 allows American law enforcement to compel US-headquartered cloud providers to produce customer data, regardless of where that data is physically stored. A European customer of AWS Frankfurt can be subject to a US production order even though their data never leaves German soil. European courts have been consistent in finding this incompatible with GDPR data subject rights.
This is not a theoretical concern. It is the specific legal reason why a growing number of European procurement teams, especially in healthcare, finance, and public sector, now require infrastructure contracts with European-headquartered providers.
The realistic European cloud landscape
"Use a European provider" is easy to say and harder to operationalize. The actual options fall into three categories:
1. Purpose-built European hyperscalers
OVHcloud, Scaleway, Hetzner, IONOS. These providers offer competitive pricing and genuine European legal structure, but the breadth of managed services is narrower than AWS/GCP/Azure. Expect to self-manage more of the stack.
2. Sovereign partitions of US hyperscalers
Microsoft Cloud for Sovereignty, AWS European Sovereign Cloud, Google Cloud Sovereign Solution. These are genuine improvements over standard public cloud, but the legal picture remains mixed. A sovereign partition still runs on software licensed from a US company.
3. Domain-specific compliant platforms
GAIA-X-compliant, BSI C5-certified providers targeting specific verticals (healthcare, defense, regulated finance). Higher cost, but the compliance story is complete out of the box.
What a tiered hybrid strategy looks like
The teams we work with rarely pick one category and commit. They tier workloads by sensitivity:
- Tier 1: Personal data, regulated workloads, anything touching Article 22 decisions. European sovereign providers only.
- Tier 2: Business data, internal tooling, non-customer-facing analytics. US hyperscalers acceptable with contractual safeguards.
- Tier 3: Public data, marketing assets, open-source models. Any infrastructure that's cheapest to run.
The hard part is not picking the tiers. The hard part is having the architectural discipline to move a workload between them when its classification changes. That discipline is what most organizations are missing.
The uncomfortable conclusion
European cloud sovereignty will cost you more than US hyperscaler convenience. It always will. The question is not whether to pay that premium, but where on the stack to pay it, and for which workloads.
The companies getting this right are not the ones choosing between sovereignty and pragmatism. They are the ones designing for both.
