Sovereign Cloud: Definition, Legal Requirements & Why EU Regions of US Clouds Don't Qualify

Key Takeaway: A sovereign cloud is a cloud deployment whose legal entity, infrastructure, support chain, and audit trail all remain inside a defined jurisdiction. "EU regions" of AWS, Azure, or GCP do not qualify — those data centers are operated by US legal entities subject to US law, including the CLOUD Act.

What is a Sovereign Cloud?

A sovereign cloud is a cloud computing environment that satisfies four conditions simultaneously: the legal entity owning and operating the infrastructure is incorporated in the target jurisdiction; the physical compute, storage, and networking infrastructure resides in that jurisdiction; the support and maintenance staff are employed under that jurisdiction's employment law; and the audit trail required by domestic regulators can be produced through domestic legal process, not through foreign-law compulsion.

The term is distinct from "data residency" or "in-region hosting," which only satisfies the physical location condition. A cloud can store data exclusively in Frankfurt data centers and still be operated by a US corporation subject to US law. The CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) gives US federal law enforcement the authority to compel US companies to produce data held anywhere in the world, regardless of where the data physically resides. An EU data center run by AWS is not sovereign; it is geographically local but legally US-exposed.

The Regulatory Pressure

Three converging EU regulatory frameworks make sovereign cloud a procurement requirement rather than an optional posture.

DORA (Digital Operational Resilience Act), effective January 2025, applies to financial entities and their ICT third-party providers. It requires contractual guarantees covering: access rights for competent authorities to audit the cloud provider; incident notification timelines under EU law; exit strategy obligations; and the right to conduct penetration testing. Non-EU providers can satisfy these requirements contractually, but the oversight mechanisms for doing so are significantly more complex when the provider is subject to foreign law.

NIS2 (Network and Information Security Directive), transposed across member states through 2025, extends cybersecurity obligations to critical infrastructure operators across energy, transport, health, and digital sectors. Supply chain risk management is a core requirement. A cloud provider operating under foreign law is supply chain risk that must be explicitly assessed and reported to national authorities.

The EU AI Act (2024) requires that high-risk AI systems maintain technical documentation and audit trails accessible to market surveillance authorities. If those trails are stored on infrastructure operated by a non-EU legal entity, regulatory access depends on international legal assistance, which is slow and often incomplete.

Beyond regulation, sector-specific requirements in defense, intelligence, and sensitive public administration applications often impose absolute data localization requirements that no contractual arrangement with a US cloud provider can fully satisfy.

Sovereign Cloud Vendors

GLBNXT (Netherlands) operates a sovereign cloud specifically designed for AI and data-intensive workloads, with Dutch legal entity ownership and EU-jurisdiction infrastructure. It targets financial services, public administration, and life sciences clients in the Netherlands and broader EU market.

Aleph Alpha (Germany) combines sovereign AI model serving with private deployment options on German infrastructure. Their "Sovereign AI" product line is designed for German and EU public sector clients with strict data protection requirements, offering on-premises and private cloud configurations under German law.

Domyn (Italy, formerly Colosseum project) is building sovereign AI and cloud infrastructure specifically for the Italian market — Italian legal entity, Italian data centers, Italian employment for support staff — targeting Italian public administration, financial institutions, and defense-adjacent industries under AGID and national security compliance frameworks.

OVHcloud (France) is the largest European-owned cloud provider. While not exclusively a sovereign cloud vendor, OVHcloud offers a Trusted Cloud product line under French legal entity ownership and French data sovereignty guarantees, with ANSSI-certified infrastructure options.

Deutsche Telekom / T-Systems operates sovereign cloud infrastructure for the German public sector and critical national infrastructure clients under German law, with full compliance with BSI (Bundesamt für Sicherheit in der Informationstechnik) certification requirements.

How It Differs from Hyperscaler EU Regions

The practical test is simple: if a French court issues a subpoena for logs stored in an AWS eu-west-3 (Paris) data center, those logs must be produced through US legal process, not French legal process — because AWS Inc. is a US company. AWS may challenge the subpoena, but French authorities cannot compel production directly. A sovereign cloud operated by a French legal entity is subject to French court orders directly.

Hyperscalers have introduced "sovereign cloud" product variants — Microsoft Operator, Google Distributed Cloud, AWS Local Zones — that introduce varying degrees of operational isolation. These products acknowledge the problem but do not fully resolve the legal entity condition: the infrastructure may be operated by a local partner or government entity in some configurations, but the underlying intellectual property, software, and contractual framework remain US-headquartered.

Implications for AI Workloads

AI workloads on sovereign cloud face specific constraints. Training large models requires access to large-scale GPU clusters, which sovereign cloud providers have historically lacked. The gap is narrowing: GLBNXT, Aleph Alpha, and German hyperscaler alternatives have invested in GPU infrastructure, but the selection is still narrower and often more expensive than AWS, Azure, or GCP GPU offerings.

Inference workloads are more tractable: serving a model that was trained elsewhere on sovereign infrastructure is a lighter requirement than training. Many regulated AI deployments use this split: train on hyperscaler infrastructure with appropriate data processing agreements, deploy inference on sovereign cloud with full jurisdictional compliance.

The agentic OS layer above the sovereign cloud must reflect these constraints in its jobs registry: which agents run on which infrastructure tier, with which compliance tags, producing which audit outputs. Governance metadata is not a documentation exercise; it is an operational primitive.

Related Concepts

Sovereign AI — the AI-specific layer above sovereign cloud; the model, training data, and audit trail must also satisfy jurisdiction requirements.
EU AI Act — the regulatory framework that makes sovereign cloud a compliance requirement for high-risk AI deployments.
Human Oversight AI — the governance pattern that sovereign cloud infrastructure must support: operator-accessible audit trails for every agent action.
Agentic Operating System — the runtime layer that must be configured to enforce sovereign cloud routing for regulated workloads.
EU AI Act Business Guide — operational implications of the EU regulatory framework for cloud and AI procurement.