In this article, we put into perspective what is actually available to companies today: Microsoft as a US hyperscaler with European commitments, European cloud offerings as a real alternative for selected workloads, and the architectural decisions that make the difference.<\/p>\n
AI-native applications and cloud-native platforms on the one hand, European sovereignty on the other. For a long time, it seemed like an either-or. That time is over. Those who now focus on maximum isolation miss the point just as much as those who ignore sovereignty entirely. The right approach lies in between: leverage the full power of modern cloud platforms while meeting regulatory requirements such as the GDPR, NIS2, DORA, or KRITIS. <\/p>\n
This is not a compromise. It is a differentiated strategy that becomes a real competitive advantage. <\/strong><\/p>\n Sovereignty is not a binary concept, but a spectrum. Organizations must take a risk-based approach and define different levels of sovereignty for different workloads. A public webshop requires different controls than a system processing health data. Sovereignty also does not mean isolation, but self-determined governance in a globally connected digital landscape. <\/p>\n The concept of digital sovereignty can be divided into three interdependent pillars:<\/p>\n GDPR, NIS2, DORA, KRITIS: Requirements for data storage, operations, and architecture have increased significantly over the past two years. Three dimensions are decisive today: who is liable in the event of security incidents, who may access which data, and how resilient the infrastructure must be. For German companies, additional industry-specific requirements apply, for example in the financial sector or critical infrastructures. Those who design cloud infrastructure to be sovereign today do not meet these requirements retroactively, but from the outset. <\/p>\n A mid-sized software vendor that processes health data gains more than just regulatory assurance with a sovereign architecture. It can address end customers in regulated industries who will not even enter negotiations without proof of data sovereignty. In this way, sovereignty shifts from a cost factor to a sales argument. <\/p>\n In 2025, Microsoft made comprehensive commitments<\/a> to the European market. For your platform strategy, these commitments are decision-relevant: <\/p>\n All customer data, including support and telemetry data, is stored and processed within the EU\/EFTA. This applies to Azure, Microsoft 365, Dynamics 365, and Power Platform, including M365 Copilot. <\/p>\n Microsoft has made a legally binding commitment to challenge in court any government order to suspend cloud services in Europe. In addition, critical code backups are maintained in Switzerland, with emergency access rights for European partners. <\/p>\n Microsoft offers sovereignty<\/a> in three variants:<\/p>\n Microsoft Sovereign Solutions \u2013 Public, Private, Partner Cloud:<\/p>\n An often overlooked aspect: sovereignty does not end at runtime\u2014the development process also matters. Source code, CI\/CD pipelines, secrets: everything is subject to regulatory requirements. GitHub Enterprise Cloud<\/a> offers EU data residency and can be used via Azure CSP with metered billing<\/a>. A toolchain that is sovereign end to end. <\/p>\n The technical capabilities are there. What matters is how companies use them. That is exactly where we support our customers. <\/p>\n At white duck, we are convinced: sovereignty is not an end in itself. It is a tool for building customer trust and meeting regulatory requirements. We are not all-or-nothing consultants. We neither recommend relying entirely on sovereign clouds, nor do we advise ignoring sovereignty. The right approach lies in between. <\/p>\n Successful cloud projects depend on selecting the right platform services. Databases, container orchestration, AI services, DevOps tooling: the PaaS building blocks determine how quickly teams can deliver and how much infrastructure they must operate themselves. Hyperscalers like Azure have more than a decade\u2019s head start here. <\/p>\n Not every application needs maximum flexibility; some need maximum sovereignty. For selected workloads and data\u2014when required for regulatory or geopolitical reasons\u2014European cloud providers come into play. This creates a hybrid platform strategy that combines the best of both worlds. <\/p>\n The key lies in platform engineering: a portable platform layer that enables sovereignty without slowing down developer teams. Open-source technologies such as Kubernetes create an abstraction layer that enables the same engineering standards across different clouds. Internal developer platforms, CI\/CD pipelines, observability: everything runs consistently, whether on Azure, in a sovereign cloud, or on-premises. <\/p>\n Workload placement becomes a strategic decision: which application runs where, depending on requirements for performance, cost, or sovereignty. The platform makes switching possible without teams having to learn new tools or applications needing to be reworked. <\/p>\n Our goal in Europe must be to create maximum value and innovation with the best available technology\u2014aligned with data protection, resilience, and the protection of intellectual property. Modern sovereign-by-design approaches make exactly that possible. Competition from European clouds, such as Telekom T Cloud Public (formerly Open Telekom Cloud) or STACKIT (Schwarz Digits), strengthens the position of all European customers. At the same time, US hyperscalers like Microsoft have made major advances to meet European requirements. white duck supports companies in developing sovereign, cloud-native, and AI-native platforms\u2014purpose-driven, fact-based, and with maximum technological quality. <\/p>\n","protected":false},"excerpt":{"rendered":" Europe needs strong, independent, and at the same time globally […]<\/p>\n","protected":false},"author":4,"featured_media":29477,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[597],"tags":[630,610,716,702,643,611,622],"class_list":["post-29469","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-sovereignty-2","tag-critical-infrastructures","tag-digital-sovereignty","tag-dora-2","tag-eu-data-boundary","tag-gdpr","tag-nis2-2","tag-sovereignty-2"],"acf":[],"_links":{"self":[{"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/posts\/29469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/comments?post=29469"}],"version-history":[{"count":0,"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/posts\/29469\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/media\/29477"}],"wp:attachment":[{"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/media?parent=29469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/categories?post=29469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/whiteduck.de\/en\/wp-json\/wp\/v2\/tags?post=29469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What does sovereignty mean for cloud-native applications and platforms?<\/h2>\n
The three pillars of cloud sovereignty<\/h3>\n
\n
Regulatory drivers<\/h3>\n
Sovereignty as a business advantage<\/h3>\n
Microsoft\u2019s commitments for Europe<\/h2>\n
![\"\"](\"https:\/\/whiteduck.de\/wp-content\/uploads\/2026\/01\/EU-Commitments_Blog-Content_Static_V5_16x9-1920x1080-2.png\" "\\"\\"")
EU Data Boundary \u2013 data stays in Europe<\/h3>\n
Digital Resilience Commitment \u2013 legal safeguards<\/h3>\n
![\"\"](\"https:\/\/whiteduck.de\/wp-content\/uploads\/2026\/01\/Sovereign-Art-1-Final-6_14_25-1024x576-1.png\" "\\"\\"")
\n
GitHub Enterprise: EU hosting for the development process<\/h3>\n
Our view: fact-based, not ideological<\/h2>\n
The PaaS building blocks are decisive<\/h3>\n
European clouds and portable platform layers<\/h3>\n
Conclusion: sovereignty and the best technology are not a contradiction<\/h2>\n