European Sovereign Cloud — when hosting becomes a matter of law

In brief

In April 2026, the European Commission awarded a cloud contract worth 180 million euros to four groups of European providers — Scaleway, Post Telecom/OVHcloud, StackIT, and Proximus/S3NS — requiring SEAL-3, the highest level in its sovereignty framework. This signal illustrates a tension that has structured the market since 2018: storing data in a European datacenter does not necessarily protect against a requisition by US authorities. Sovereign cloud, by contrast, refers to an operator registered, controlled, and operated under European law — a legal distinction, not a geographic one. This article explains what that distinction means in practice, who the capable actors are, and what trade-offs remain unavoidable.

The fundamental distinction: located is not sovereign

Picture a French subsidiary of a US group. Its headquarters are in Paris, its servers are in an Alsatian datacenter — but if an American court orders the parent company to hand over data, the French subsidiary has little to oppose. Cloud works the same way.

Two realities are often confused:

Located cloud: data is physically stored in a datacenter situated in Europe — Dublin for AWS eu-west-1, Amsterdam for Azure West Europe, Frankfurt for GCP europe-west3. The location is real. But the operator remains Amazon, Microsoft, or Google — that is, a US company subject to US law.

Sovereign cloud: the operator is registered, controlled, and operated under European law. Data cannot be reached by foreign law without a European judicial procedure. The reference example in France is the SecNumCloud certification, issued by ANSSI (the French National Agency for the Security of Information Systems).

In plain terms: choosing a European datacenter protects against an outage on the other side of the world. It does not protect against a US subpoena. Only a sovereign operator can provide that final guarantee.

Why the CLOUD Act changed everything

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act), enacted in March 2018, authorizes US authorities to demand access to data held by US companies — regardless of the country where that data is physically stored. AWS can be compelled to hand over data hosted in Frankfurt. Microsoft can be compelled for data in Amsterdam.

Vocabulary

• CLOUD Act: US federal law (2018) allowing US authorities to access data held by US companies in any country.
• GDPR: General Data Protection Regulation, applicable since May 2018 across the EU. Requires prior agreement for any transfer of personal data outside the EU.
• SecNumCloud: French ANSSI certification for cloud providers. Version 3.2 (2024) explicitly protects against extraterritorial laws.
• EUCS: European Cybersecurity Certification Scheme for Cloud Services — European equivalent of SecNumCloud, being adopted by ENISA.

The tension is structural. A US company that refuses to hand over data violates US law. If it complies, it risks violating the GDPR. In practice, major platforms negotiate emergency procedures and delays — but the exposure remains real for sensitive data.

This situation has accelerated European regulatory production:

• Data Act (applicable September 2025): provides explicit mechanisms to block illegal access by foreign governments to non-personal data.
• AI Act (in force August 2024): for high-risk systems, requires proof that data has not left approved jurisdictions — making sovereign cloud directly operational.
• EU Cloud and AI Development Act (proposal expected 2026): aims to triple European datacenter capacity in five to seven years.

Five years of attempts at a European ecosystem

2020 — The launch of Gaia-X

In 2020, at the Franco-German Digital Council, Europe launched Gaia-X: the ambition to create a federated and interoperable data ecosystem at continental scale. The initiative quickly gathered more than 400 members in 20 countries.

By 2021, the main criticism had emerged: US hyperscalers (AWS, Azure, GCP) were founding members. The phrase “Trojan horse” spread widely. The market share of European providers fell from 26% to 10% of European cloud between 2017 and 2020 — precisely during the rise of the initiative supposed to reverse it.

By 2024-2025, assessments were mixed. Gaia-X had launched more than 180 industrial data spaces. But analysts at the Euro-Stack Directory described the result as a “paper monster” producing specifications without large-scale practical applications. The interoperability promised between OVHcloud, Scaleway, and Outscale had not produced unified interfaces.

2022-2023 — European market share stabilizes, not upward

In 2022, EU providers represented 15% of the European cloud market, down from 29% in 2017 (Synergy Research Group). The three US hyperscalers captured 70%. This proportion has not reversed: it has stabilized.

It is in this context that Scaleway, a subsidiary of Iliad (Xavier Niel’s group), pivoted heavily toward AI in 2023. The company deployed Nabuchodonosor, its Paris supercomputer: 1,016 NVIDIA H100 Tensor Core GPUs on DGX H100 infrastructure. It forged a strategic partnership with the nascent Mistral AI — an example of a French-to-French model + infrastructure chain that no US hyperscaler can claim.

2024-2026 — Certifications, GPU, and public contracts

The movement accelerated on three simultaneous fronts.

Certifications: Outscale (Dassault Systèmes subsidiary) obtained in 2024 the first SecNumCloud 3.2 certification covering AI GPUs — a distinction that positioned it alone in the sensitive-data segment. Orange Business obtained the same qualification for Cloud Avenue SecNum in July 2025.

GPU offerings: OVHcloud launched its H100 PCIe instances at €2.80/h and its AI Endpoints service (serverless access to open-source models). T-Systems inaugurated its AI Factory Munich on February 4, 2026: 0.5 ExaFLOPS [estimated, published objective by Deutsche Telekom], up to 10,000 NVIDIA Blackwell GPUs, €1 billion investment in partnership with NVIDIA.

Public market signal: in April 2026, the European Commission awarded its Cloud III DPS contract — 180 million euros over 6 years — to four groups, at SEAL-3 level. Scaleway featured independently; OVHcloud in a consortium with Post Telecom (Luxembourg); StackIT (Schwarz Group, Germany); and Proximus with S3NS (Thales–Google Cloud) and Mistral.

The players in detail

OVHcloud — Europe’s largest datacenter operator

Founded in 1999 in Roubaix by Octave Klaba, OVHcloud is Europe’s largest cloud operator by number of datacenters and server surface area. Listed on Euronext Paris since 2021 (IPO at €18.50, raising €350 million), the share fell below €7 in 2024 under competitive pressure.

The infrastructure spans 37 datacenters in 15 countries in 2025, with planned expansion to the Milan region (3 availability zones) and five other European and non-European regions.

Its AI offerings:

• H100 PCIe instances: €2.80/h (OVHcloud.com data, January 2024 — prices subject to revision).
• Managed AI: €3.10/h (same source).
• L40S instances: from €1.40/h; L4 at €0.75/h.
• AI Endpoints: serverless service providing access to open-source models (Mistral, Llama, Qwen) without infrastructure management.

OVHcloud has published a reference architecture for deploying Mistral Large 123B in a sovereign environment via its AI Deploy service.

Scaleway — Iliad’s AI specialist

Scaleway, a subsidiary of Xavier Niel’s Iliad group, operates datacenters in Paris, Amsterdam, and Warsaw. More than one million customers.

Its AI offering rests on the Nabuchodonosor cluster (1,016 H100), complemented by:

• Generative APIs: serverless access to Llama, Mistral, Qwen3, and since August 2025 open-weight OpenAI models (gpt-oss-120B, gpt-oss-20B).
• Managed Inference: dedicated model deployment (pricing not publicly disclosed in sources consulted).

Scaleway won the Commission’s Cloud III DPS contract in 2025 independently, at the highest SEAL-3 level — a claim validated by four independent sources (European Commission, Data Center Dynamics, The Next Web, Compare the Cloud).

Outscale — the SecNumCloud reference for sensitive sectors

Outscale is the cloud subsidiary of Dassault Systèmes (3DS group). Its positioning targets industrial, defense, aeronautics, and sensitive public-sector clients — sectors where sovereignty certification is often a contractual condition.

Its distinction: the first cloud operator to obtain ANSSI’s SecNumCloud 3.2 qualification (2024), covering the entirety of its public cloud services, including AI GPUs. SecNumCloud 3.2 aligns with the future EUCS and explicitly protects against extraterritorial laws.

In September 2025, Outscale integrated Mistral AI’s Le Chat into its SecNumCloud 3.2 environment — a combination that enables French government agencies to deploy a high-performance LLM in a certified environment.

The GPUs deployed by Outscale are NVIDIA-manufactured, but specific types and total capacity are not officially published in sources consulted [total capacity not triangulated].

T-Systems / Deutsche Telekom — the German AI Factory

Deutsche Telekom and its subsidiary T-Systems (enterprise IT services) inaugurated their AI Factory Munich on February 4, 2026, designed as a sovereign training infrastructure for German companies:

• Investment: €1 billion (Deutsche Telekom + NVIDIA partnership).
• Declared capacity: up to 10,000 NVIDIA Blackwell GPUs (DGX B200 + RTX PRO Server) [published objective, not yet verified in production].
• Power: 0.5 ExaFLOPS [published Deutsche Telekom objective].
• Storage: approximately 20 petabytes.
• Connectivity: 4 × 400 Gb/s fiber links, 75 km of fiber for GPU interconnection.
• Partners: NVIDIA (hardware), SAP (platform), Siemens (industrial stack).

First announced users: Agile Robots and Perplexity. The positioning is explicit: enabling German companies to train models on proprietary data without exposing it to foreign laws.

Orange Business — the telecom sovereign cloud

Orange Business is the B2B arm of Orange (formerly France Télécom). Its sovereign cloud offering centers on Cloud Avenue SecNum, SecNumCloud-qualified in July 2025.

GenAI offerings (2024) are developed in partnership with LightOn (French AI startup): SaaS solutions for SMEs and dedicated IaaS GPU-as-a-Service for proprietary LLM deployment. GPU types and total capacity are not officially published [capacity not triangulated].

Orange Business is also a shareholder in Bleu, a joint venture with Capgemini that operates Microsoft Azure on French infrastructure — a different category discussed below.

The Bleu / S3NS controversy: is “trusted cloud” sovereign?

An intermediate category is growing in France: the trusted cloud (cloud de confiance). The principle: a French legal entity (Orange + Capgemini for Bleu, Thales for S3NS) operates a US hyperscaler’s cloud (Microsoft Azure for Bleu, Google Cloud for S3NS) on French infrastructure.

In plain terms: in this model, the software and source code remain American. The French operator manages the infrastructure, encryption keys, and access. The open legal question: can a US request addressed to Microsoft reach data managed by Bleu, a French entity? The answer is not settled in law as of 2025.

ANSSI had not yet awarded SecNumCloud 3.2 qualification to these offerings by end 2025. Their inclusion in the Commission’s Cloud III contract (Proximus with S3NS) suggests that SEAL-3 is compatible with this hybrid model — but the exact evaluation criteria are not public.

This debate is unresolved: it reveals that the boundary between “sovereign” and “trusted” is as much political as legal.

Strengths and limits: factual trade-offs

What European sovereign cloud genuinely offers

Native regulatory compliance: an EU-registered operator (OVHcloud, Scaleway, Outscale, T-Systems, Orange Business) is not subject to the CLOUD Act. For regulated sectors — healthcare, defense, public administration, finance — this is a structural advantage that US hyperscalers cannot replicate without relinquishing their US status.

Accumulated certifications: SecNumCloud 3.2 (Outscale, Orange Business) and the forthcoming EUCS create an auditable trust barrier for governments and some private clients. These certifications require on-site audits and a level of transparency that US operators cannot provide within the same regulatory framework.

Competitive GPU pricing: OVHcloud lists its H100 PCIe instances at €2.80/h versus approximately €11.50/h for AWS (p5.48xlarge instance, ~$12.25/GPU/h at 2024 exchange rates) — a ratio of 1 to 4 [January 2024 data, subject to revision]. The gap is partly explained by lower infrastructure costs, aggressive pricing policy, and a structural anti-hyperscaler positioning.

Model + infrastructure ecosystem: the Scaleway × Mistral AI, OVHcloud × Mistral (AI Deploy reference architecture), and Outscale × Mistral (Le Chat SecNumCloud 3.2) partnerships create a French-to-French chain that no US hyperscaler can replicate.

What European sovereign cloud does not solve

Structural GPU lag: the total GPU capacity of EU actors bears no comparison to that of US hyperscalers. AWS, Azure, and Google each spent more than $50 billion in AI capex in 2024. T-Systems’ AI Factory Munich, at €1 billion, represents approximately 2% of a single hyperscaler’s annual investment.

NVIDIA hardware dependency: all EU actors deploy NVIDIA GPUs (H100, Blackwell). The silicon is American or Taiwanese, the supply chain is global. Sovereignty is therefore legal and operational — not technological at the hardware level. For the geopolitical details of this dependency, see the [supply-chain-semiconducteurs] article.

Fragmented offerings: Gaia-X did not produce interoperable APIs. A client using OVHcloud cannot easily migrate to Scaleway, let alone to Outscale. This fragmentation forces clients to juggle incompatible interfaces — a sharp contrast with the standardization offered by hyperscalers.

Stagnant market share: EU providers represent 15% of European cloud in 2022-2025, versus 70% for the three US hyperscalers (Synergy Research Group). This proportion has not improved despite regulatory initiatives.

In plain terms: European sovereign cloud offers real legal protection and competitive GPU pricing. It cannot yet match the raw capacity of AWS, Azure, or GCP. It is as much a compliance and values choice as a performance choice.

Decision matrix — which cloud for which need

A few practical rules:

• Start by clarifying the regulatory question: in unregulated sectors (startups, e-commerce, media), located cloud is often sufficient. In regulated sectors (healthcare, finance, defense, public administration), the certification question is often non-negotiable.
• Audit certifications required by clients: SecNumCloud 3.2 is a condition of access to certain French public contracts, not an option.
• GPU price is not everything: OVHcloud shows €2.80/h versus AWS’s €11.50/h. But managed services, DevOps tools, and integrations available on AWS may justify the gap for teams experienced with those tools.
• Don’t confuse “trusted cloud” with “sovereign cloud”: the two labels do not guarantee the same level of legal protection. Ask for ANSSI qualification status.

What to retain in 2026

European sovereign cloud is not an inferior alternative to US hyperscalers — it is a response to different constraints. The European Commission validated this positioning in April 2026 by awarding 180 million euros to EU operators under SEAL-3 sovereignty criteria. Outscale demonstrates that government certification and AI GPUs can coexist in a SecNumCloud environment. T-Systems and Scaleway show that sovereign computing capacity is growing, even if the gap with US hyperscalers remains considerable.

The real question for 2027-2030 lies elsewhere: will the EU Cloud and AI Development Act effectively triple European datacenter capacity? And if so, how quickly will sovereignty certifications — currently fragmented by country — converge toward EUCS at continental scale?

For now, sovereignty is legal and operational. It is not yet technological: GPUs remain American, and the supply chain that produces them remains Taiwanese-American.