Since January 2025, EU financial entities must hold documented exit strategies for critical ICT providers, and since November 2025 the providers themselves are under direct supervision. The plan is now a compliance artifact. A real one is still rare.
GAIA-X, EuroStack, and now a 180-million-euro sovereign tender with Google inside the tent. Europe keeps trying to build a thing when what it lacks is a property, and the property is portability.
The proposed Cloud and AI Development Act sorts cloud providers into four sovereignty levels. Tier lists reshape markets faster than mandates do, and startups selling into the EU public sector should read this one now, not at adoption.
In June 2025, Microsoft France's legal director was asked under oath whether he could guarantee French data would never be handed to US authorities. He said no. It wasn't a scandal. It was a clarification, and Brussels heard it.
AWS built a physically separate cloud in Brandenburg with its own IAM, billing, and EU-only operators. It's the most serious sovereignty engineering a hyperscaler has shipped, and the question that matters about it is legal, not technical.
Deploying to eu-central-1 makes you compliant with almost nothing. Jurisdiction follows the company that controls your data, not the building that houses it, and a growing amount of sovereignty marketing depends on you confusing the two.