Europe needs strong, independent, and at the same time globally competitive digital infrastructures. Yet the discussion about digital sovereignty is often emotional rather than fact-based. What Europe has missed over the past decades—the development of its own platforms and globally scalable technologies—cannot be fully made up for within just a few years.
That is precisely why a sober, fact-based view is essential: How can European organizations remain sovereign while still using the most powerful technological solutions?
In this article, we put into perspective what is actually available to companies today: Microsoft as a US hyperscaler with European commitments, European cloud offerings as a real alternative for selected workloads, and the architectural decisions that make the difference.
AI-native applications and cloud-native platforms on the one hand, European sovereignty on the other. For a long time, it seemed like an either-or. That time is over. Those who now focus on maximum isolation miss the point just as much as those who ignore sovereignty entirely. The right approach lies in between: leverage the full power of modern cloud platforms while meeting regulatory requirements such as the GDPR, NIS2, DORA, or KRITIS.
This is not a compromise. It is a differentiated strategy that becomes a real competitive advantage.
What does sovereignty mean for cloud-native applications and platforms?
Sovereignty is not a binary concept, but a spectrum. Organizations must take a risk-based approach and define different levels of sovereignty for different workloads. A public webshop requires different controls than a system processing health data. Sovereignty also does not mean isolation, but self-determined governance in a globally connected digital landscape.
The three pillars of cloud sovereignty
The concept of digital sovereignty can be divided into three interdependent pillars:
- Data sovereignty forms the foundation: Where is data stored, who can access it, and how is it protected? Mechanisms such as Confidential Computing, customer-controlled keys, and data residency controls provide answers—even in public cloud environments.
- Operational sovereignty: Who operates the platform? Transparency about operational processes, local legal enforcement, and clear business continuity processes are crucial, especially in regulated areas.
- Technological sovereignty: How dependent are you on a single vendor? Open standards, interoperability, and portable architectures create the flexibility to move workloads without having to rebuild teams or applications.
Regulatory drivers
GDPR, NIS2, DORA, KRITIS: Requirements for data storage, operations, and architecture have increased significantly over the past two years. Three dimensions are decisive today: who is liable in the event of security incidents, who may access which data, and how resilient the infrastructure must be. For German companies, additional industry-specific requirements apply, for example in the financial sector or critical infrastructures. Those who design cloud infrastructure to be sovereign today do not meet these requirements retroactively, but from the outset.
Sovereignty as a business advantage
A mid-sized software vendor that processes health data gains more than just regulatory assurance with a sovereign architecture. It can address end customers in regulated industries who will not even enter negotiations without proof of data sovereignty. In this way, sovereignty shifts from a cost factor to a sales argument.
Microsoft’s commitments for Europe
In 2025, Microsoft made comprehensive commitments to the European market. For your platform strategy, these commitments are decision-relevant:
EU Data Boundary – data stays in Europe
All customer data, including support and telemetry data, is stored and processed within the EU/EFTA. This applies to Azure, Microsoft 365, Dynamics 365, and Power Platform, including M365 Copilot.
Digital Resilience Commitment – legal safeguards
Microsoft has made a legally binding commitment to challenge in court any government order to suspend cloud services in Europe. In addition, critical code backups are maintained in Switzerland, with emergency access rights for European partners.
Microsoft offers sovereignty in three variants:
Microsoft Sovereign Solutions – Public, Private, Partner Cloud:
- 1. Sovereign Public Cloud: Enhanced controls on the existing Azure infrastructure. Data Guardian (European personnel for remote access), External Key Management (your own HSM integration), Regulated Environment Management (central compliance configuration). No migration required.
- 2. Sovereign Private Cloud: Azure Local and Microsoft 365 Local enable the full Microsoft stack in your own data center—ideal for air-gapped scenarios and maximum control.
- 3. National Partner Clouds: Independently operated sovereign clouds by local partners. In Germany: Delos Cloud.
GitHub Enterprise: EU hosting for the development process
An often overlooked aspect: sovereignty does not end at runtime—the development process also matters. Source code, CI/CD pipelines, secrets: everything is subject to regulatory requirements. GitHub Enterprise Cloud offers EU data residency and can be used via Azure CSP with metered billing. A toolchain that is sovereign end to end.
The technical capabilities are there. What matters is how companies use them. That is exactly where we support our customers.
Our view: fact-based, not ideological
At white duck, we are convinced: sovereignty is not an end in itself. It is a tool for building customer trust and meeting regulatory requirements. We are not all-or-nothing consultants. We neither recommend relying entirely on sovereign clouds, nor do we advise ignoring sovereignty. The right approach lies in between.
The PaaS building blocks are decisive
Successful cloud projects depend on selecting the right platform services. Databases, container orchestration, AI services, DevOps tooling: the PaaS building blocks determine how quickly teams can deliver and how much infrastructure they must operate themselves. Hyperscalers like Azure have more than a decade’s head start here.
European clouds and portable platform layers
Not every application needs maximum flexibility; some need maximum sovereignty. For selected workloads and data—when required for regulatory or geopolitical reasons—European cloud providers come into play. This creates a hybrid platform strategy that combines the best of both worlds.
The key lies in platform engineering: a portable platform layer that enables sovereignty without slowing down developer teams. Open-source technologies such as Kubernetes create an abstraction layer that enables the same engineering standards across different clouds. Internal developer platforms, CI/CD pipelines, observability: everything runs consistently, whether on Azure, in a sovereign cloud, or on-premises.
Workload placement becomes a strategic decision: which application runs where, depending on requirements for performance, cost, or sovereignty. The platform makes switching possible without teams having to learn new tools or applications needing to be reworked.
Conclusion: sovereignty and the best technology are not a contradiction
Our goal in Europe must be to create maximum value and innovation with the best available technology—aligned with data protection, resilience, and the protection of intellectual property. Modern sovereign-by-design approaches make exactly that possible. Competition from European clouds, such as Telekom T Cloud Public (formerly Open Telekom Cloud) or STACKIT (Schwarz Digits), strengthens the position of all European customers. At the same time, US hyperscalers like Microsoft have made major advances to meet European requirements. white duck supports companies in developing sovereign, cloud-native, and AI-native platforms—purpose-driven, fact-based, and with maximum technological quality.
