Europe · cloud
Sovereign cloud in Europe: who offers it, what is live, and who certifies it
We track 24 cloud offers sold as sovereign or EU-only in Europe (checked 2026-10-11): 18 fully live, 4 partly live and 2 announced. 12 of the 24 run on AWS, Microsoft, Google or Oracle technology. Of the 8 holding France's SecNumCloud qualification on ANSSI's list, 1 is US-backed. The EU-wide scheme (EUCS) is not adopted, and the Cloud and AI Development Act is a proposal.
Updated 11 October 2026 · data build 2026-10-10 · how we know · corrections
18 of 24 sovereign offers are fully live; 12 run on US hyperscaler technology
Offers sold as sovereign or EU-only cloud in Europe, by status and by whose technology they run on. In the bars, live includes partly live. Measured
Source: Provider announcements and certification registers (see table) · as of 2026-10-11 · Compiled by StackPath
Counts are offers, not market share. A European provider's offer and a hyperscaler's offer count as one each, whatever their size.
Every offer: who runs it, where, and what it is certified for
Same fields for every provider. The CSV has the full operator, certification and notes fields. Reported
Download CSV ↓Source: Provider and register pages, linked per row · as of 2026-10-11 · Compiled by StackPath
'Sovereign' has no single legal meaning yet: the EU cybersecurity scheme for cloud (EUCS) is not adopted, and the Cloud and AI Development Act is a proposal. Offers are listed on their providers' own description, with the certifications they hold or have announced. US-backed means the underlying cloud technology is licensed from or run by a US hyperscaler, even where a European company operates it. That is a fact about the stack, not a judgement on the offer. Status is live when customers can buy and use the service in general availability; preview or announced otherwise. Every SecNumCloud status was checked against ANSSI's own lists (qualified catalogue and in-qualification page, cached 2026-10-11): all found.
The rules that will define 'sovereign' are not settled
EU and national schemes, their status and what each level means. Reported
Source: EU Cloud and AI Development Act (CADA) · EUCS: EU Cybersecurity Certification Scheme for Cloud Services · SecNumCloud (current version 3.2) · C5: Cloud Computing Compliance Criteria Catalogue · Cloud Sovereignty Framework (SEAL levels) · CISPE Sovereign & Resilient Cloud Services certification · as of 2026-10-11 · Compiled by StackPath
Ireland: Dublin hosts AWS and Microsoft EU regions, but no sovereign build
The hyperscalers' Irish cloud regions, and how they relate to the sovereign offers above. Reported
| Provider | Irish cloud region | Notes | Source |
|---|---|---|---|
| AWS | eu-west-1, Europe (Ireland) | 3 AZs, enabled by default. The AWS European Sovereign Cloud has no Irish location; its planned Local Zones are in BE, NL and PT. | link |
| Microsoft | North Europe (northeurope), Ireland; paired with West Europe (Netherlands) | 3 AZs. Covered by the EU Data Boundary and Sovereign Public Cloud, which run in existing EU regions. So Dublin is a Microsoft sovereign-offer region, but not a national partner cloud. | link |
| None. No Google Cloud region in Ireland. | Google's European regions are St. Ghislain BE (europe-west1), London, Frankfurt, Eemshaven, Zurich, Milan, Paris, Berlin, Turin, Madrid, Warsaw, Hamina and Stockholm. Google does run its own data centres in Dublin (Profile Park; first opened 2012, second announced 2014), per https://datacenters.google/locations/dublin-ireland/, but these are not a public cloud region. | link | |
| Oracle | None. No OCI public region in Ireland. | EU OCI regions: Paris, Marseille, Frankfurt, Milan, Turin, Amsterdam, Jovanovac (RS), Madrid x2, Stockholm, Zurich, London, Newport. EU Sovereign Cloud: Frankfurt and Madrid only. | link |
- Ireland was one of seven member states (with DK, EE, GR, NL, PL, SE) in the July 2022 non-paper opposing EUCS sovereignty requirements (EUISS brief, 2025-11-03).
- None of the sovereign-specific builds (AWS ESC, Oracle EU Sovereign Cloud, S3NS, Bleu, Delos, T-Systems/Google, STACKIT, T Cloud Public) has an Irish site. Irish relevance runs through the standard hyperscaler regions (AWS eu-west-1, Azure North Europe), which are in scope for Microsoft's EU Data Boundary and Sovereign Public Cloud and for Google/AWS data-residency controls.
- Under CADA, a Dublin region of a US-owned provider could reach Level 1 (EU location) and possibly Level 2. Level 3 needs EU ownership and control, or Commission recognition of the provider's home country (Art. 18) (our reading of the proposal).
Source: AWS · Microsoft · Google · Oracle · as of 2026-10-11 · Compiled by StackPath
Our reading. Half the offers (12 of 24) keep US hyperscaler technology and change who operates it and under which law. On France's strict test the split is sharper: 7 of the 8 SecNumCloud-qualified offers are European-built, and the one US-technology offer that qualified (S3NS) is run by Thales, not by Google. No offer operated by AWS, Microsoft, Google or Oracle themselves holds SecNumCloud. That is the factual core of the "sovereignty or protectionism" debate. Which offers count as sovereign will depend on the CADA levels, which are still a proposal.
Questions people ask
- What is a sovereign cloud?
- A cloud service sold with guarantees that customer data, operations and support stay inside a jurisdiction (here, the EU or one member state), often run by a locally incorporated company with local staff, and sometimes certified against legal access by non-EU governments. There is no single EU definition yet.
- Is the AWS European Sovereign Cloud live?
- Yes. Its first region, in Brandenburg, Germany, became generally available in January 2026 (2026-01-15). Its first audit reports (C5 and SOC 2, March 2026) are Type 1, a point-in-time check; Type 2 reports are pending. Local Zones are planned in Belgium, the Netherlands and Portugal, with no dates published.
- How many sovereign cloud offers in Europe are run on US technology?
- 12 of the 24 offers we track, including joint ventures where a European firm operates US hyperscaler technology under licence (for example Bleu, Delos and S3NS). 12 are European-built.
- What does the EU Cloud and AI Development Act say about sovereignty?
- The Commission's proposal of 2026-06-03 sets four assurance levels for cloud services: Level 1, data is processed and stored on infrastructure located in the eu; Level 2, provider shows independence from non-eu countries and transparency over its software supply chain; Level 3, provider is owned and controlled from the eu and meets extra criteria such as staff citizenship; Level 4, full transparency and control over the software supply chain and no interference from a non-eu country. Public buyers would have to use at least Level 1, and higher levels where public order is at stake. It is still a proposal: Parliament and Council must agree it.
- What is EUCS and has it been adopted?
- EUCS is the EU cybersecurity certification scheme for cloud services, drafted by ENISA. It has not been adopted. It stalled over a proposed sovereignty requirement for its highest level (EU headquarters and majority EU ownership), backed by France, Italy, Spain and Germany and opposed by a group of states including Ireland and the Netherlands; the March 2024 draft dropped it. The CADA proposal moves sovereignty into its own four levels.