Sovereign Cloud 2026: What European options SMEs have

Sovereign cloud is no longer a niche topic in 2026. Amazon launched its European Sovereign Cloud in Brandenburg in January, Microsoft is expanding its Sovereign offerings, and German providers such as STACKIT and IONOS are investing massively. For medium-sized companies, this is good news – and a new confusion. Because “sovereign” is now on almost every offer. This post explains how you recognize true sovereignty, what options there are and how to find the right one for your business.

What “Sovereign” Should Mean

A data center in Frankfurt alone does not make a cloud sovereign. The decisive factor is who has access to your data in an emergency – and who can decide about it. Four criteria have established themselves as a test standard:

1. Data location: Is data stored and processed exclusively in the EU – including backups, log data and support access?
2. Legal area of the operator: Is the operator exclusively subject to European law, or can a parent company outside the EU be obliged to provide data?
3. Operations personnel: Is the platform operated and maintained by staff in the EU?
4. Key jurisdiction: Are the keys to encrypt your data with you – or with the provider?

There is also a fifth, often overlooked point: the Changeability. A cloud from which you do not come back is not sovereign, no matter where it stands. What the Data Act changes here from 2027 onwards, we describe in the article on Cloud provider change under the Data Act.

The options at a glance

European suppliers

STACKITESchwarz Group’s cloud is the most visible German provider and is increasingly used by regulated industries. IONOS offers a cloud certified according to the BSI criteria catalogue C5. In addition T cloud fIG. Telekom’s Open Telekom Cloud on an OpenStack basis, OVHcloud from France and Plus servers. Your advantage: You are completely subject to European law. Their disadvantage: The range of functions is – especially for specialized services – smaller than for the large US platforms, even if the distance shrinks.

Sovereign offers of US hyperscalers

The AWS European Sovereign Cloud is available since January 2026 with its first region in Brandenburg. According to AWS, it is physically and logically separated from the remaining AWS regions and is operated by EU personnel. Microsoft has completed its EU Data Boundary, which stores and processes customer data from Microsoft 365 and most Azure services in the EU, and is also building its own sovereign cloud offerings. For the public sector in Germany Delos Cloud a Microsoft-based platform under German control.

The advantage of these offers: You keep the familiar range of functions and your existing tools. The open question: Whether the constructions stand up to a demand for release under US law, such as the CLOUD Act, in any case, is legally controversial and has not yet been conclusively clarified.

Own operation and hybrid models

The most sovereign solution remains the operation under its own responsibility – in its own data center or with a German hosting partner. For many medium-sized companies hybrid model the most sensible: sensitive data and core systems under own control, standard services and load peaks in the public cloud. Especially for AI applications with confidential data, this way has proven itself, as we have explained in our contribution to AI on-premises and in the hybrid cloud show.

Which option suits you?

The right choice depends less on the provider than on your data and requirements. A rough orientation:

• Standard applications without particularly sensitive data: The EU regions of the major providers, at Microsoft with EU Data Boundary, are sufficient in many cases.
• Personal data on a larger scale, health data, business secrets: A European provider or a sovereign offering with key sovereignty with the customer is the better choice.
• Critical infrastructure, contracting authorities, NIS2 obligations: Certifications such as BSI C5, clear specifications for operating personnel and a documented exit strategy should be mandatory here – see also our contribution to the NIS2 registration.
• Dependence on special cloud services: Check what services you really need. The more your applications rely on a provider’s proprietary services, the harder it will be to switch later.

What You Should Consider When Choosing

• Check certifications, not advertising claims. BSI C5, ISO 27001 and – depending on the industry – other attestations say more than the word “sovereign” in the product name.
• Reading contracts. Where are support cases handled? Who can access data? How are government requests handled?
• Clarify key management. Can you bring in your own key (Bring Your Own Key) or even keep it outside the cloud (Hold Your Own Key)?
• Take portability into account. Containers, open data formats and infrastructure as code keep your options open.
• Compare costs realistically. Sovereign offers are not automatically more expensive, but pricing models differ greatly. Compare based on your actual use, not list prices.

Conclusion

The selection of sovereign cloud offerings has never been as large as 2026 – and never so difficult to overlook. For SMEs, there is rarely the right solution, but a suitable combination: European providers or sovereign offers for sensitive data, proven platforms for standard services and an architecture that does not allow for a later change. Those who classify their data before deciding on a provider make the better choice.

We advise manufacturer-neutral in the selection and accompany the Cloud Migration – from data stock to operation. If you want to discuss your options, talk to us.