The sovereignty choice isn't binary; it's a spectrum between two extremes: complete dependency on foreign hyperscalers versus total operational self-sufficiency. Accept state-level access to your data and sudden loss of service (e.g., due to export controls) versus responsibility for operating, securing & running services that hyperscalers spend billions perfecting.
When you move critical workloads away from US providers, you're not eliminating risk; you're trading one risk profile for another. The question becomes: can you protect yourself from state actors and geopolitical changes without dramatically increasing integrity and availability risks while maintaining competitive advantage?
Repatriating your entire IT infrastructure takes years during which your technical team has no capacity for strategic projects. During this period, your competitors (especially US competitors) may continue building new capabilities and take market share. Even after transition, European alternatives demand more active management than hyperscaler services, shifting your technical resources from business-enabling projects to infrastructure maintenance. The sovereignty transition doesn't just cost money, it costs opportunity and market position.
A big-bang exit probably introduces more risks than it solves.
European cloud alternatives exist, but they're not equivalent to hyperscaler ecosystems. They are lacking in both breadth of service and technical abstraction. You're not switching brands of the same product; you're accepting different operational & integration responsibilities. Exactly the things you were happy to be rid of.
The service breadth problem: European providers offer very good hosting and basic platform services. They may offer other specific services but lack the breadth of the integrated tooling ecosystem that makes hyperscalers attractive. No integrated identity and access management spanning thousands of services. No click of the button automated threat detection.
The skills investment: Running workloads on European providers demands more technical expertise from your team. You'll have to do more yourself since the offering is not on the same level as hyperscaler services: you’ll have to convert workloads so they can run on a different system (e.g., by using containers), and then you’re responsible for operations. Security monitoring you currently outsource becomes your responsibility. Infrastructure management that happens automatically requires active oversight. Compliance frameworks you inherit through hyperscaler certifications must be built and maintained internally. This is why you need more technical expertise either in-house or from a supplier who understands both sovereignty objectives and operational requirements.
European providers are working to close the gaps, but this will take months if not years.
The Network and Information Systems Directive (NIS2) requires that companies assess the risks (e.g., export control risks, state actor confidentiality) and implement measures to control or accept them. This changes the conversation for regulated organizations across energy, transport, banking, healthcare, and digital infrastructure sectors.
- The control requirement: NIS2 demands that organizations maintain “technical and organisational measures” even when outsourcing to cloud providers. You cannot simply point to your hyperscalers’ compliance certifications; you must demonstrate meaningful control over business continuity and security oversight.
- The sovereignty implication: Microsoft's confirmation that US legislation takes precedence over European data promises, forces NIS2-covered organizations to take action. Compliance may require taking steps in the sovereignty trade-off whether they feel operationally ready or not.
- The capability demand: NIS2 doesn't just require sovereignty, it requires competence. Organizations must prove they can maintain security and continuity standards regardless of their provider's nationality, policies, or operational status.
For regulated entities, the trade-off is no longer theoretical. It's a compliance requirement with measurable consequences.The sovereignty challenge extends beyond individual organizational choices to market dynamics that complicate any migration strategy.
- The ecosystem effect: Your suppliers, partners, and customers may remain dependent on US platforms, creating integration challenges that sovereignty alone cannot solve. Independence without ecosystem alignment creates operational isolation.
- The innovation lag: US hyperscalers drive cloud innovation globally. European alternatives often implement capabilities months or years after AWS, Azure, and Google introduce them. Sovereignty may mean accepting slower access to emerging technologies.
- The cost reality: European hosting and cloud services typically have lower direct costs than hyperscaler equivalents, but organizations may face higher total cost of ownership. The additional internal expertise required, extended management overhead, and reduced operational efficiency can offset initial savings. Sovereignty includes hidden costs that affect competitiveness in cost-sensitive markets.