Digital sovereignty is increasingly shaping cloud strategies. We briefly outline the current legal and political framework and show how to approach this topic systematically. Our assessment process provides a roadmap, including a sovereignty self-assessment, which allows you to evaluate your own profile in five questions.

The framework for cloud and operational decisions has changed significantly since cc.systems was founded five years ago. Geopolitical tensions and the dependence of European organizations—especially on U.S. cloud providers—are becoming more widely recognized. Meanwhile, technological innovation continues to accelerate. Digital sovereignty is becoming a central aspect of strategic decision-making. But what might a sovereignty strategy look like?

→ Where does your company stand? Take the self-assessment now.

At a hearing before the French government in June 2025, Microsoft stated that the company could not guarantee that data from European authorities would not be transferred to U.S. agencies. The U.S. Cloud Act requires Microsoft to cooperate under certain circumstances (see OpenCloud). A quick look at the Microsoft ecosystems within our government agencies, hospitals, or other industries makes the collective frown of German data protection officials understandable. As long as central digital services run on foreign cloud providers, it is doubtful that critical infrastructures are truly sovereign.

Europe is taking a different approach and is primarily seeking to regulate the market power of large U.S. platform providers more strictly. The goal is to ensure fair competitive conditions and reduce the one-sided concentration of key digital infrastructure. As justified as these measures may seem, they harbor new potential for conflict. Under the Digital Markets Act, the European Commission launched two investigations on November 18, 2025, against Amazon Web Services and Microsoft Azure. The investigations also examine whether the companies are “gatekeepers.” Under EU law (the Digital Markets Act), “gatekeepers” are defined as companies with particularly significant market power in key digital services, which are therefore subject to stricter competition requirements. An Amazon spokesperson responded that “classifying large cloud providers as ‘gatekeepers’ is not worth the risk of stifling innovation or driving up costs for European companies” (see Reuters).

The Digital Markets Act is just one part of a broader regulatory trend in Europe. Other European legislation, such as the EU Cybersecurity Act (2019), the EU Data Act (September 2025), and the EU AI Act (effective 2026), are significantly changing the landscape. While they reinforce the goal of gaining more control over data and critical infrastructure, they also increase complexity and the pressure on organizations and companies to take action.

For organizations and companies, it is anything but trivial to understand when which requirements apply and how they affect existing cloud contracts–let alone which cloud services remain permissible. Keeping track of providers’ sovereignty promises, legal texts, initiatives, and current developments is a challenge we must face together.

Against this backdrop, the perspectives of many IT decision-makers in Western Europe are shifting. A survey recently published by Gartner illustrates that concerns about dependencies are growing in light of geopolitical tensions. Gartner predicts that by 2030, over 75 percent of companies outside the U.S. will pursue a digital sovereignty strategy, coupled with running their applications on sovereign cloud providers (see Gartner).

However, Europe is noticeably lagging behind in implementing these regulatory efforts. The EU Cloud Certification System (EUCS) continues to face delays. It is intended to establish an EU-wide security standard for cloud providers, but member states cannot agree on common criteria (see EUISS). While political sovereignty is being demanded, European cloud offerings are technologically nowhere near as powerful as those of U.S. hyperscalers. The result: cloud sovereignty is becoming a strategic trade-off.

When considering the overall situation, it is incredibly difficult to make the right strategic and economic decisions. That is precisely why our goal must be to gain a clear understanding of all relevant aspects.