The promise that could never exist

In June 2025, Anton Carniaux, General Manager of Microsoft France, testified under oath before the French Senate that he could not guarantee that data belonging to French citizens — even when hosted by Microsoft under a government procurement agreement — would not be handed over to foreign authorities without the French government’s consent. Shortly before, Kevin Miller, AWS’s VP of Global Data Centres, said in equally plain terms that the same applies to the data of a German SME ^[1].

That is striking, because in the years before, these very companies had flooded Europe with ‘sovereign’ cloud promises. Microsoft launched its “European Digital Sovereignty Commitments”, AWS built a “European Sovereign Cloud”, Google presented “Sovereign Solutions”, and Oracle has been running an “EU Sovereign Cloud” out of Frankfurt and Madrid since 2023. The goal was clear: soothe Europe’s growing concerns about American surveillance and geopolitical pressure with a big word printed on a moving box.

Critics call this sovereignty washing: the marketing claim of digital sovereignty without delivering the control the word implies — comparable to greenwashing, but for data and infrastructure. Researchers Rebecca Adler-Nissen and Kristin Eggeling described the ‘sovereign’ label used by cloud companies as “empty in substance and impossible to implement” ^[4]. And in the summer of 2025, the whole story fell apart — not because of critics, but through the tech companies’ own testimony, under oath ^[1].

The examples: four times ‘sovereign’, zero times control

Microsoft presented “Cloud for Sovereignty” as early as 2022 and expanded it in 2025 into a full “Microsoft Sovereign Cloud”: data stays in Europe, managed by staff residing in Europe, with a “Data Guardian” feature and external key management through partners such as Utimaco. Sounds solid — until you realise that Microsoft still controls the code base, the update cycles and the key mechanisms. Analyst Axel Oppermann therefore called the promise outright an “illusion”: “sovereignty is replaced by the appearance of sovereignty, wrapped in rules that Microsoft helps define itself” ^[3]. How visible that dependency is became clear when Microsoft, under pressure from American sanctions, disabled the email account of the Chief Prosecutor of the International Criminal Court ^[3].

AWS launched its European Sovereign Cloud in January 2026, with an investment of over €7.8 billion in Germany, a dedicated European holding company, a separate Security Operations Center and staff holding only EU nationalities ^[6][7]. Undoubtedly the most elaborate legal construction to date — but it remains an American company, subject to the US CLOUD Act, whose own director could give no guarantee under oath about data disclosure ^[1].

Google chose a partner model: together with Thales (France), T-Systems and Schwarz Group (Germany), Minsait (Spain) and others, it offers “Sovereign Cloud” services on “isolated infrastructure” ^[8]. At the same time, the company openly lobbies against strict European sovereignty requirements: it asked the EU to “revise” provisions of the Cloud and AI Development Act so that “trusted global partners” can simply keep participating ^[9].

Oracle presents its EU Sovereign Cloud as the most ‘real’ of the four: separate legal entities in the EU, operational since June 2023 ^[10]. But here too, the same applies: the entire service runs on proprietary software of which not a single European government can read a single line.

Why the location of your data doesn’t solve the problem

All four providers essentially sell the same thing: data residency — data stored physically in Europe, managed by European staff. But data residency is not sovereignty. The US CLOUD Act of 2018 obliges American companies to hand over data in their “possession, custody or control”, regardless of where in the world that data is stored. This means that a ‘sovereign’ European region of an American provider legally changes nothing about the reach of US law. An SLA that “promises to limit” data disclosure can never defy an American court order ^[1][4].

The deeper truth is this: the problem was never the server location, but the question of who controls the code that runs on the server.

How can you be sovereign over what you cannot read?

Here we arrive at the core argument that every “sovereign cloud” whitepaper carefully avoids. Sovereignty means self-determination: the ability to decide for yourself how your systems work, without having to ask permission from an outside power. With proprietary software, that is technically impossible:

• You cannot audit what you cannot see. With closed source, you must take the vendor’s word that there is no backdoor, no unintended data sharing and no vulnerability. With open source, you can verify this — or have it verified by an independent party.
• The vendor controls the update button. Even if your data sits in your own country, an American vendor can push changes to the code that you never asked for and cannot refuse. Sovereignty over a system that someone else changes remotely does not exist ^[3].
• There is always an off switch. The ICC affair shows that a vendor can remotely disable a service when an American president (indirectly) demands it. With proprietary software, the only exit strategy is a full migration; with free and open source software, you can, as a last resort, fork the code and continue with another party.
• No control over the source, no forward compatibility. File format changes, licence fee hikes and artificial dependencies (lock-in) are business models for proprietary vendors, not side effects.

Free and open source software solves this by guaranteeing four fundamental freedoms: to use, to study, to modify and to distribute. It is precisely these freedoms that make sovereignty technically possible, rather than merely legally plausible. As EDRi puts it: Europe’s digital sovereignty starts with open source in public procurement — it gives governments flexibility, control and the ability to switch vendors ^[13][16].

A caveat: open source is necessary, not sufficient

In all fairness: open source alone is not a sovereignty cure. You can have the source code and still be dependent — on a hosting party, on a monopolist controlling the support contracts, or on your own lack of in-house expertise. Critics rightly point out that a European data centre full of open source software operated by an American parent company is still not sovereign ^[15]. Sovereignty also requires control over infrastructure, operations and knowledge.

The benchmark should be: proprietary = not sovereign by definition. Open source is the necessary condition; infrastructure and governance make it sufficient. Conversely, without the source code nothing else matters — then every ‘sovereign’ region is a black box on European soil.

The EU is washing too

There is one last, uncomfortable layer. The European Commission itself also uses sovereignty vocabulary to sell something else: in the Tech Sovereignty Package, alongside the so-called “Digital Omnibus”, the AI Act and the GDPR are being weakened — deregulation presented as a sovereignty gain, according to ARTICLE 19 ^[5]. And the Cloud and AI Development Act introduces four levels of “sovereignty assurance”, but only at the highest level, level 4, are American hyperscalers actually excluded. For the bulk of European use, they may simply continue to participate ^[5]. The framework was not designed to displace Big Tech, but to set the terms under which it keeps participating.

History, moreover, had already shown how this ends: Gaia-X, Europe’s answer to the hyperscalers, was captured from within when Amazon, Microsoft, Google and Oracle of all companies became members — critics at the time already called it a “Trojan horse” — and the initiative has since largely withered into a bureaucratic remnant ^[11][12].