The Sovereignty Illusion
There is a widespread and consequential misunderstanding embedded in how organisations think about cloud infrastructure and data governance. The misunderstanding is this: that storing data in a data centre located within a particular country's borders confers meaningful protection under that country's laws. It does not. And in 2026, the regulatory frameworks of the European Union, the United Kingdom, and an increasing number of other jurisdictions are forcing organisations to confront this gap between data residency and data sovereignty — often at significant cost, and with no easy answers.
The distinction matters because of a single piece of American legislation: the Clarifying Lawful Overseas Use of Data Act, known as the CLOUD Act, enacted in 2018. The CLOUD Act requires US-incorporated companies to produce data stored anywhere in the world in response to lawful US government requests. It does not matter whether the data is stored in Frankfurt, Dublin, Singapore, or São Paulo. If the company holding the data is incorporated in the United States — or is a subsidiary of a US-incorporated company — the CLOUD Act applies.
Storing data in an AWS Frankfurt data centre does not make it European data — it makes it American data that happens to be physically located in Frankfurt. The CLOUD Act does not respect geography.
This is not a theoretical risk. It is a structural feature of the legal relationship between US-incorporated cloud providers and the US government. And it creates a fundamental tension with the General Data Protection Regulation (GDPR), which prohibits the transfer of personal data to third countries without adequate protections. The CLOUD Act and the GDPR are, in certain scenarios, directly incompatible — and organisations that have built their compliance strategies on the assumption that data residency equals data sovereignty are discovering that they have been operating on a false premise.
The Regulatory Cascade of 2026
The regulatory environment governing cloud infrastructure has intensified dramatically in 2026, with an interlocking set of frameworks that collectively constitute what analysts have termed a "compliance cascade." Understanding the architecture of this cascade is essential for any organisation planning its infrastructure strategy.
The EU AI Act: Full Enforcement
The EU AI Act reached full enforcement for high-risk AI systems on 2 August 2026. For cloud infrastructure, the most significant provision is Article 10, which mandates strict data governance and documentation standards for high-risk AI systems. Non-compliance carries severe penalties: fines up to €35 million or 6% of global annual turnover, whichever is higher. The Act does not specify where data must be stored, but its documentation and audit requirements create practical pressures toward infrastructure that can be fully audited and controlled — a condition that is easier to satisfy with EU-incorporated providers than with US hyperscalers subject to CLOUD Act exposure.
The EU Data Act: Portability and Interoperability
The EU Data Act, fully applicable since September 2025, fundamentally reshapes the cloud market by mandating data portability and removing technical barriers to switching providers. By January 2027, all switching fees for cloud services will be eliminated — a provision specifically designed to reduce the lock-in effect that has historically deterred organisations from migrating away from hyperscalers. The Act also mandates interoperability, requiring providers to support open standards that enable data to move between clouds without proprietary format dependencies.
The Data Act's portability requirements are significant not because they immediately change where data is stored, but because they change the cost calculus of moving it. An organisation that previously faced prohibitive egress fees and format conversion costs when considering a migration to a European provider will, by 2027, face neither. The structural barriers to sovereignty are being legislated away.
DORA: Concentration Risk as Systemic Risk
Storing data in an AWS Frankfurt data centre does not make it European data — it makes it American data that happens to be physically located in Frankfurt. The CLOUD Act does not respect geography.
The Digital Operational Resilience Act (DORA), which has been in force since early 2025, represents the most direct regulatory challenge to hyperscaler dependency in the financial sector. DORA mandates that financial entities treat reliance on a single US-based hyperscaler as a systemic concentration risk, requiring robust exit strategies and multi-cloud architectures. As of November 2025, 19 providers have been designated as Critical Third-Party Providers (CTPPs) subject to direct oversight.
The UK has implemented a parallel regime. As of July 2026, the Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority have moved from general outsourcing oversight to the direct supervision of designated Critical Third Parties — specifically AWS, Google Cloud, Microsoft, and Oracle. This regime acknowledges that these providers have become "infrastructure-like," necessitating a regulatory view that transcends individual bilateral contracts between banks and vendors.
The systemic risk framing is analytically important. Regulators are not merely concerned about the risk to individual institutions from cloud outages; they are concerned about "common-mode risk" — the scenario in which a single cyber event, software defect, or regional outage at a provider triggers a systemic collapse across the financial sector. This is a different order of risk than operational resilience at the firm level, and it requires a different order of governance response.
The Cloud and AI Development Act (CADA)
The most recent addition to the regulatory landscape is the Cloud and AI Development Act (CADA), introduced as part of the EU's 2026 Tech Sovereignty Package. CADA establishes a four-level "Union cloud computing sovereignty framework" that creates structural barriers for non-EU hyperscalers in sensitive public-sector and critical infrastructure procurement. Levels 3 and 4 impose strict requirements regarding EU ownership and control — requirements that US hyperscalers, regardless of their sovereign cloud offerings, cannot satisfy through their current corporate structures.
CADA is significant because it moves beyond voluntary frameworks like Gaia-X toward legally binding mandates. While it does not bar US hyperscalers from the European market, it effectively excludes them from the most sensitive workloads — a segmentation that will reshape procurement patterns across the public sector and regulated industries.
The Hyperscaler Response: Sovereign Cloud Variants
US hyperscalers have not been passive in the face of this regulatory pressure. AWS, Microsoft, and Google have all launched "sovereign" cloud variants designed to address European concerns about jurisdictional exposure. The AWS European Sovereign Cloud, located in Brandenburg, Germany, is the most prominent example: it offers physical isolation, EU-based governance, and operational independence from AWS's global infrastructure.
But legal analysts have identified a fundamental limitation in these offerings. Sovereign cloud variants are typically subsidiaries of US parent companies. The CLOUD Act applies to US-incorporated companies and their subsidiaries. The structural defence against CLOUD Act exposure that EU-native providers can offer — being incorporated and headquartered in the EU, with no US parent company — is not available to hyperscaler sovereign variants, regardless of how they are marketed.
This is not a minor technical distinction. It is the central question of cloud sovereignty: not where the data is stored, but who can be legally compelled to produce it. And on that question, the hyperscaler sovereign variants do not provide the same assurance as EU-native providers.
The EU-Native Provider Landscape
The alternative to hyperscaler sovereign variants is a growing ecosystem of EU-native cloud providers that offer what analysts call "Full EU Isolation" — infrastructure operated by companies incorporated and headquartered in the EU, with no US parent company, and therefore no CLOUD Act exposure.
The leading EU-native providers include OVHcloud (France), STACKIT (Germany, operated by the Schwarz Group), Outscale (France, a subsidiary of Dassault Systèmes), and Open Telekom Cloud (Germany, operated by Deutsche Telekom). These providers offer a structural defence against CLOUD Act exposure that hyperscaler sovereign variants cannot match.
However, they face a genuine "feature gap" compared to US hyperscalers, particularly in advanced AI/ML services, global edge networks, and serverless compute. The deployment of high-performance hardware — including NVIDIA DGX B200 systems — within European data centres has reduced the performance gap for AI training workloads, but the breadth of managed services, developer tooling, and global reach that hyperscalers offer remains difficult to replicate.
Gartner projects European spending on sovereign cloud infrastructure to grow from $6.9 billion in 2025 to $23.1 billion by 2027 — a trajectory that reflects not market enthusiasm but regulatory compulsion.
Investment is flowing into the EU-native ecosystem at scale. The Schwarz Group has committed €11 billion to STACKIT. The EU's Jupiter supercomputer project represents significant investment in sovereign HPC capacity. Gartner projects European spending on sovereign cloud infrastructure to grow from $6.9 billion in 2025 to $23.1 billion by 2027 — a trajectory that reflects not market enthusiasm but regulatory compulsion.
Gartner projects European spending on sovereign cloud infrastructure to grow from $6.9 billion in 2025 to $23.1 billion by 2027 — a trajectory that reflects not market enthusiasm but regulatory compulsion.
The Hybrid Architecture: Pragmatism Under Pressure
The practical response of most organisations to this regulatory landscape is not a wholesale migration to EU-native providers, but a hybrid architecture that segments workloads by sensitivity and regulatory requirement. The emerging pattern is:
- Tier A (Sovereign-critical): Sensitive personal data, regulated financial data, health records, government workloads — hosted on EU-native providers with Full EU Isolation. This tier is driven by GDPR, DORA, CADA Level 3/4, and sector-specific regulations.
- Tier B (Compliance-managed): Business-critical workloads that require strong compliance posture but not full jurisdictional isolation — hosted on hyperscaler sovereign variants with appropriate contractual protections and audit rights.
- Tier C (General purpose): Non-sensitive workloads, development environments, global CDN, SaaS applications — hosted on hyperscalers for performance, cost, and feature access.
This segmentation approach is pragmatic, but it introduces its own governance challenges. The boundaries between tiers are not always clear. Data that begins as Tier C can become Tier A through aggregation or contextual change. The management of data flows between tiers requires sophisticated data governance tooling that many organisations do not yet have in place.
AI gateways are emerging as a practical solution to this challenge. Tools like NeuralTrust's TrustGate act as an enforcement layer that inspects and redacts PII, enforces routing policies to compliant providers, and generates the audit trails required by EU AI Act Article 10. These gateways allow organisations to use hyperscaler AI services for general workloads while ensuring that sensitive data is routed to compliant infrastructure — a pragmatic bridge between the performance of hyperscalers and the sovereignty requirements of regulation.
The Concentration Risk That Multi-Cloud Does Not Solve
A critical insight from the DORA regulatory framework deserves particular attention: the multi-cloud strategy that was once considered a best practice for resilience is now recognised as potentially insufficient if it relies on the same underlying control planes or proprietary services from the same small ecosystem of providers.
The multi-cloud strategy that was once considered a best practice for resilience is now recognised as potentially insufficient if it relies on the same underlying control planes or proprietary services from the same small ecosystem of providers.
An organisation that runs workloads on AWS, Azure, and Google Cloud simultaneously has not eliminated concentration risk — it has distributed it across three providers that share common dependencies in identity management, DNS infrastructure, BGP routing, and the underlying hardware supply chain. A systemic event that affects the shared infrastructure layer — a zero-day vulnerability in a widely used hypervisor, a BGP hijacking event, a coordinated attack on cloud control planes — could affect all three simultaneously.
The multi-cloud strategy that was once considered a best practice for resilience is now recognised as potentially insufficient if it relies on the same underlying control planes or proprietary services from the same small ecosystem of providers.
Effective risk management strategies now include service-level mapping (identifying dependencies across the entire business service chain rather than simply counting vendors), exit testing (performing actual recovery exercises that assume the primary provider's control plane is unavailable), and selective portability (prioritising portability for critical services where the failure impact exceeds the cost of maintaining redundant, vendor-neutral architectures).
The Gaia-X Evolution: From Vision to Operational Framework
Gaia-X, the European initiative for a federated data infrastructure, has evolved significantly from its origins as a voluntary industry framework. While critics previously labelled hyperscaler participation in Gaia-X as a "Trojan horse" — because it certified portability rather than sovereignty — the initiative now provides the technical foundation for federated data spaces across Europe.
The Gaia-X Digital Clearing House (GXDCH) serves as the operational mechanism for certifying services based on transparency and interoperability criteria. This certification is not sovereignty certification — it does not address the CLOUD Act question — but it provides a standardised framework for assessing and comparing cloud providers on dimensions that matter for data governance: transparency of data processing, interoperability with other providers, and compliance with EU data protection requirements.
The relationship between Gaia-X and CADA is complementary: Gaia-X provides the technical standards and certification infrastructure; CADA provides the legal mandate that makes compliance with those standards a procurement requirement rather than a voluntary choice. Together, they represent a more coherent European approach to cloud governance than either could provide alone.
Strategic Implications for Infrastructure Decision-Makers
The cloud sovereignty landscape of 2026 presents infrastructure decision-makers with a set of choices that are more complex, more consequential, and more politically charged than at any previous point in the cloud era. Several strategic implications deserve explicit attention:
- The residency/sovereignty distinction is now a compliance requirement, not a philosophical preference. CADA Level 3/4, DORA, and the EU AI Act collectively create legal obligations that cannot be satisfied by data residency alone. Organisations that have not yet mapped their workloads against these requirements are operating with unquantified regulatory exposure.
- The feature gap is closing, but not closed. EU-native providers have made significant progress in AI/ML capabilities, but the gap with hyperscalers in breadth of managed services remains real. Infrastructure strategies that require full EU Isolation for all workloads will face capability constraints that need to be explicitly managed.
- The switching cost reduction is a strategic opportunity. The elimination of egress fees by January 2027 changes the economics of cloud migration. Organisations that have deferred sovereignty-aligned migrations because of switching costs should reassess their timelines in light of this regulatory change.
- Concentration risk requires a different analytical framework than operational resilience. The DORA framework's distinction between firm-level operational resilience and systemic concentration risk is analytically important. Multi-cloud strategies designed for operational resilience may not address systemic concentration risk — and regulators are increasingly treating these as distinct requirements.
Conclusion: The Reckoning Has Arrived
The cloud sovereignty reckoning of 2026 is not a future event — it is the present condition. The regulatory frameworks are in force. The market for sovereign cloud infrastructure has reached $195 billion. The EU-native provider ecosystem is receiving unprecedented investment. The hyperscalers are launching sovereign variants that address some concerns but not others. And organisations across regulated industries are discovering that the compliance strategies they built on the assumption of data residency equivalence need to be rebuilt on the more demanding foundation of genuine jurisdictional sovereignty.
The path forward is not simple, and it is not cheap. But it is increasingly clear. Data residency and data sovereignty are not the same thing. The CLOUD Act does not respect geography. And the regulatory frameworks of 2026 are designed to ensure that organisations can no longer treat the distinction as a technicality. The reckoning has arrived — and the organisations that engage with it seriously, rather than waiting for enforcement action to force the issue, will be better positioned for the infrastructure landscape of the decade ahead.
