Digital Sovereignty

Your data is in Frankfurt. The US government can still access it.

Picture this: your company has carefully chosen a cloud provider that stores data exclusively in Frankfurt. GDPR-compliant, ISO 27001-certified, data center on German soil. Everything done right — at least on paper. Then a National Security Letter arrives from Washington. The US CLOUD Act of 2018 compels US companies to hand over data — regardless of where it is physically stored. Your Frankfurt data center? Irrelevant, as long as the operator is a US company. AWS, Azure, Google Cloud — they all fall under this law.

This isn't a theoretical concern. The EU-US Data Privacy Framework of 2023 provides a legal basis for transatlantic data transfers, but it's politically fragile — its predecessor Privacy Shield was struck down by the CJEU in 2020 (Schrems II). Microsoft completed Phase 3 of the EU Data Boundary in February 2025, promising to keep European data in Europe. But the fine print reveals: exceptions apply for certain operations such as security analytics and support access. And the fundamental contradiction remains — GDPR says data stays in the EU; the CLOUD Act says the US can access it. No framework in the world has resolved this conflict.

For DACH companies, this isn't an abstract regulatory topic. It's a concrete business risk. Anyone processing sensitive customer, health, or financial data needs clarity on jurisdiction — not hope for diplomatic stability. Digital sovereignty starts with the question: who has access to my data in a crisis? And the answer is more uncomfortable than most vendors will admit.

72% dependency: Europe's cloud reality in numbers

The scale of European dependency is sobering. AWS, Microsoft Azure, and Google Cloud together control approximately 72% of the European cloud market. European providers — OVHcloud, Hetzner, IONOS, T-Systems, and others — collectively hold approximately 15% (steady since 2022, but down from 29% in 2017, Synergy Research Group). Europe's cloud spending exceeded the $100 billion mark in 2025. The money is flowing — but it's flowing predominantly to Seattle, Redmond, and Mountain View.

McKinsey and the World Economic Forum published a finding that sums up the situation: only 4 of the 50 largest technology companies worldwide are European. Four out of fifty. Europe is left behind in consumer internet, dependent in cloud infrastructure, and reliant on Taiwan and South Korea for semiconductors. This isn't a weakness in one area — it's a systemic deficit. European sovereign cloud infrastructure spending grows 83% in 2026 — from $6.9B to $12.6B (Gartner). Global sovereign cloud spending reaches $80B in 2026.

This dependency has concrete consequences. Price increases at AWS or Azure hit European companies with no alternative. Geopolitical tensions between the US and EU could restrict data access — or compel it. Regulatory changes in Washington have direct impact on Frankfurt server rooms. When 72% of your digital infrastructure is in the hands of three US corporations, you don't have a vendor management problem. You have a sovereignty problem.

Gaia-X and European data spaces: What's working — and what isn't

Gaia-X launched in 2019 as Europe's answer to cloud dominance — an ambitious project for a sovereign, federated data infrastructure. The reality in 2026: over 180 data spaces are in development, but only a handful are actually operational. The first multi-provider catalogue encompasses 600 services from 15 providers across four sovereignty levels — progress, but far from the original vision of a European cloud ecosystem.

The sharpest criticism of Gaia-X: the inclusion of Microsoft, Google, and AWS diluted the original purpose. A sovereignty project that includes the very companies you're trying to become independent from — that's a conceptual contradiction that even the best governance can't resolve.

But there are bright spots. Catena-X in the automotive sector is operational with over 1,000 members and delivering real results for supply chain data exchange — from OEMs to Tier 3 suppliers. Manufacturing-X is advancing with EUR 140M in funding, alongside Health-X and the Mobility Data Space. The EU mobilized EUR 200B for AI infrastructure through InvestAI — including EUR 20B for five AI gigafactories. The pattern: where concrete industry requirements drive the architecture, data spaces work. Where political vision meets technical complexity, bureaucracy emerges.

European champions: From AI to cloud to robotics

The narrative that Europe can only regulate and not build is wrong. A new generation of European tech champions is proving the opposite — not just in AI, but across the entire stack.

Aleph Alpha from Heidelberg has made a remarkable strategic pivot: away from building its own large language model, toward the sovereign AI platform PhariaAI. With $642.8 million in funding and a model-agnostic approach, Aleph Alpha offers enterprises and government agencies a platform where various AI models run under full data control — hosted on STACKIT, the cloud of the Schwarz Group (Lidl/Kaufland) — backed by a total investment of EUR 11B in STACKIT. This is European infrastructure from hardware to application.

Mistral from Paris has established itself as a serious alternative to OpenAI and Anthropic. Valuation: EUR 11.7 billion with EUR 300 million in annual recurring revenue (ARR). Mistral Large 3 (675 billion parameters) is licensed under Apache 2.0 — fully open. France and Germany have signed framework agreements for use in public administration. DeepL from Cologne, with over 10 million monthly users, outperforms Google Translate in many language pairs and has a partnership with NVIDIA's DGX SuperPOD for training infrastructure.

Beyond AI, European strength shows in other domains: SAP is integrating Joule AI across its entire product suite and remains the dominant enterprise software provider. Neura Robotics from Metzingen raised EUR 1 billion at a EUR 4 billion valuation and is building humanoid robots with Bosch as a technology partner. OVHcloud (surpassing EUR 1.08B in annual revenue for the first time in 2025) and Hetzner offer performant, GDPR-compliant cloud alternatives to US hyperscalers — without CLOUD Act risk.

Open source as a sovereignty strategy

Open source is the most effective instrument of digital sovereignty — and Europe is beginning to use it systematically. Linux Foundation Europe was established to coordinate European open source development. The Open Source Business Alliance (OSB Alliance) in Germany advocates for the use of open software in enterprises and public administration. The German public administration is increasingly pursuing an open-source-first strategy.

The EU Cyber Resilience Act nearly trapped open source in a regulatory dead end — through security requirements designed for commercial software that would have also applied to open source projects. After massive pushback from the community, non-commercial projects are now exempt. The lesson: regulation must foster open source, not endanger it.

The strategic logic is clear: deploying open source software eliminates vendor lock-in, maintains full control over the code, and enables independent security audits. Local AI models like Mistral (Apache 2.0) or Llama run on your own infrastructure — without data flowing to US providers. Nextcloud replaces Microsoft 365 for collaboration, Element/Matrix replaces Slack and Teams for communication. These aren't compromise solutions — they're mature alternatives that offer full control with comparable functionality.

The CLOUD Act and the solution: Architecture over hope

The CLOUD Act of 2018 isn't a niche issue — it's the central tension point of European data sovereignty. The law authorizes US authorities to compel US companies to hand over data stored on servers anywhere in the world. GDPR prohibits exactly that. This contradiction hasn't been resolved — it's merely bridged diplomatically.

The EU-US Data Privacy Framework of 2023 provides a political solution, not a technical one. It's based on an Executive Order by President Biden that can be revoked without Congressional approval. The CJEU has already invalidated two predecessor agreements (Safe Harbor, Privacy Shield). BSI C5 attestation is increasingly required for public contracts and critical infrastructure — but only a few US hyperscalers have obtained it, and even then with conditions.

The solution lies not in politics, but in architecture. Hybrid approaches are the pragmatic path: non-critical workloads on US hyperscalers (which lead in scale and services), sensitive data on European infrastructure (Hetzner, OVHcloud, STACKIT, Deutsche Telekom/T-Systems), highly critical systems on-premise or in sovereign government clouds. Data classification becomes mandatory: not everything needs to be sovereign — but you need to know what does.

Our approach at Radical Innovators

Digital sovereignty isn't a political slogan — it's an architectural problem. And architectural problems are solved with expertise, not ideology. At Radical Innovators, we help DACH companies design sovereign digital architectures that neither naively bet on "everything European" nor uncritically accept US hyperscalers.

Our work begins with a sovereignty analysis: Where does your data reside? Which jurisdictions do your vendors fall under? Where is vendor lock-in a risk? Building on this, we develop hybrid architectures that balance scalability, cost, and data sovereignty. We evaluate European alternatives, plan migrations, and implement open source stacks — pragmatically, not dogmatically. Whether Hetzner instead of AWS, Nextcloud instead of SharePoint, or Mistral instead of GPT-4: we find the solution that fits your business.

Digital sovereignty isn't a compliance exercise — it's a strategic necessity. Anyone who places their entire digital infrastructure in the hands of three US corporations today isn't making a technology decision. They're placing a geopolitical bet. And the odds aren't as good as the sales decks promise.

— Martin Kocijaz, CEO Radical Innovators