Cloud sovereignty has gone from being a geopolitical debate to an operational priority for European businesses and governments. Dependence on a small number of global providers, the advancement of artificial intelligence, and regulatory requirements have brought very specific questions into focus: where data is processed, who can access the systems, and under what jurisdiction they operate. Simply choosing a cloud region is no longer enough; what's at stake is effective control over critical infrastructure and services.
In Spain, the report "Digital Sovereignty: From Political Ambition to Executive Imperative ," by the Capgemini Research Institute, reflects the magnitude of the challenge. 92% of Spanish organizations have significant exposure in terms of digital sovereignty, a figure higher than the global average of 86%. For Sergio Torres, managing director of Cloud Infrastructure Services at Capgemini, the goal is not to eliminate dependence, but to manage it judiciously . In a hyperconnected ecosystem, he adds, sovereignty consists of building resilient interdependence, not isolating oneself. Three out of four Spanish companies share this pragmatic approach, and 58% understand digital sovereignty primarily as a way to mitigate risks and strengthen business continuity.
Technological dependence under scrutiny
The study places artificial intelligence and the cloud at the heart of these new dependencies. 75% of Spanish organizations consider AI a priority within their digital sovereignty strategies, while 65% cite cloud computing. At the same time, 69% acknowledge relying on international providers for their cloud services and 61% for artificial intelligence capabilities. Torres warns that the challenge lies not only in accessing these technologies, but also in integrating them in a governable way: a sovereign cloud allows AI to be transparent, auditable, and controllable , facilitating the transition from pilot projects to deployments with real value.
The ability to react to a potential disruption from a strategic supplier adds pressure. In critical areas such as data or artificial intelligence, 43% of Spanish organizations would take more than twelve months to replace their main supplier. In hardware, the percentage reaches 38%, and in cybersecurity, it stands at 36%. For Capgemini, these figures show that technological resilience cannot be considered a simple contingency plan, but must be designed from the outset with portability and clear exit strategies within the architecture.
Data is emerging as the most sensitive asset. More than half of Spanish organizations believe that data management and storage pose the greatest risk to business continuity, ahead of cybersecurity, connectivity, or hardware. Furthermore, 55% perceive a high concentration of providers in this area. The problem is exacerbated by a lack of visibility: only 14% have a complete, real-time mapping of their technology supply chain, 40% have only partial visibility of their direct suppliers, and one in four companies admits to lacking a formal understanding of their risks.
This concern is already translating into corporate governance decisions. 59% of Spanish companies consider digital sovereignty a top priority for their boards of directors , a proportion well above the global average. Virtually all large organizations address the issue in their governing bodies, and almost half have implemented a specific strategy. The idea gaining traction is that of a minimum viable digital sovereignty : identifying which assets are critical, mapping dependencies, and protecting what is essential to guarantee continuity. In fact, 76% see combining critical technologies with strategic alliances as more practical than attempting to achieve total ownership of all capabilities.
Brussels wants more capacity and its own rules.
At the European level, the European Commission aims to at least triple the capacity of the Union's data centers over the next five to seven years through the proposed Cloud and AI Development Act (CADA). The plan would increase installed capacity from approximately 12 GW currently to over 27 GW, an expansion that, according to estimates compiled by CryptoBriefing, would require nearly €200.000 billion in investment, mostly from the private sector. European data centers consumed 68 TWh of electricity in 2024, and the Commission projects 114 TWh by 2030, representing around 3,2% of the EU's electricity demand. The stated objective is not to isolate the issue, but rather to mitigate a vulnerability that affects chips, servers, and the cloud.
The picture of dependence is striking. According to data cited by Xataka from GEA and DECISION reports, only 6% of the value of semiconductors for data centers remains in the hands of EU-based companies; in server manufacturing and assembly, the percentage is 7%, and in cloud infrastructure, it is limited to 8%. In cloud services, the share of European providers fell from 29% in 2017 to 15% in 2022 and has remained stagnant. AWS, Microsoft Azure, and Google Cloud concentrate more than 70% of the European cloud market , while globally, the cloud infrastructure market was worth $143.000 billion in the second quarter of 2026, with AWS holding 28%, Microsoft 20%, and Google Cloud 15%.
Europe, however, maintains an exceptional position in the chip value chain. ASML, headquartered in Veldhoven, is the world's only manufacturer of EUV lithography systems, machines indispensable for producing the most advanced semiconductors. The company reported revenues of nearly $37.500 billion in its 2025 fiscal year, with a net margin of 29,4%, and its market capitalization is around $700.000 billion. Even so, the company confirmed that European chip manufacturers have not placed any orders for lithography systems in 2026, a sign of the lack of domestic demand that Brussels aims to reverse with the Chips Act 2.0.
The CADA proposal also introduces a four-tiered definition of cloud sovereignty . The first level requires that data be processed and stored on infrastructure located within the EU. The second demands independence from third countries and transparency across the software supply chain. The third goes further, requiring that the provider be owned and controlled from within the EU. The fourth demands full transparency across the software supply chain and the absence of interference from third countries. Sebastián Muriel, Telefónica's chief digital officer, summarized the debate with a phrase that has become a benchmark: "It doesn't matter if the server is in Madrid, Frankfurt, or Dublin if the parent company is in Redmond or Mountain View." He even spoke of " rented sovereignty" to describe the current situation.
Scrutiny of corporate transactions is also increasing. The European Commission used the case of Kyndryl, which attempted to acquire Solvinity, a Dutch infrastructure provider for the government serving 16,5 million citizens, as an example of transactions requiring scrutiny. The Dutch government blocked the acquisition in May 2026 on grounds of public interest, digital autonomy, and the protection of critical infrastructure . The decision demonstrates that sovereignty is not limited to the location of servers, but also extends to who controls the companies that support essential services.
The deployment of more data centers is not without its challenges. CryptoBriefing documents growing protests in Ireland, the Netherlands, and France regarding electricity consumption, water usage, and the visual impact of these facilities. In Germany, the UK, and France, securing a connection to the electricity grid can take years. In Ireland, the growth of data centers is already generating concerns about potential power outages for homes and businesses while the centers keep the operations of multinational technology companies running. The Commission responded on September 21, 2026, with an automatic sustainability labeling system for data centers exceeding 500 kW. Each facility will receive an energy efficiency rating (PUE from 1,15 to over 1,9) and a water efficiency rating (WUE from 0,1 to over 1,0), which will be updated annually from August 2027. Improving the PUE from 1,6 to 1,2 reduces electricity consumption by 25%, and recovering half of the waste heat from European centers could cover the heating demand of almost four million homes.
For startups and service providers, the European framework changes the rules for purchasing, hosting, and scaling infrastructure. In April 2026, the Commission awarded contracts worth up to €180 million for sovereign cloud services for EU institutions. Public sector clients and regulated sectors will require certificates of sovereignty and data provenance, and geographical residency will no longer suffice: it will be necessary to assess who controls the provider and its software supply chain. The bottleneck will not be solely technological, as 60% of EU companies report difficulties in recruiting professionals in AI, cybersecurity, and clean technologies. CADA and the Chips Act 2.0 remain legislative proposals, not laws, and must go through the European process. The public consultation on minimum performance rules for data centers closes on December 14, 2026, and the final proposal is expected in the second quarter of 2027.
Certifications and alternatives for administrations
Alongside regulation, the market is making moves with certifications and partnerships. Atos has obtained SAP Sovereign Cloud Partner certification to modernize and operate critical SAP environments while adhering to data control, governance, and regulatory compliance requirements. This certification expands the options available to government agencies and regulated companies that need to migrate workloads to the cloud or incorporate artificial intelligence without completely relinquishing operational, legal, and technical control of their systems. The certification initially covers Germany, France, the Netherlands, and the United Kingdom , and Atos is continuing the process to extend it to other locations.
The certification connects Atos' managed services and European infrastructure with SAP's strategy to expand its sovereign offering. The proposal is specifically aimed at the public sector and financial services, where data location, infrastructure access, and applicable jurisdiction influence modernization decisions. SAP structures its approach around four dimensions of control: data, operations, technology, and legal framework . Atos combines infrastructure, hosting, cybersecurity, and application operations. According to the company, this model enables the adoption of cloud computing and artificial intelligence while maintaining governance and operational control.
Martin Merz, president of SAP Sovereign Cloud, sees the addition of Atos as part of the expansion of this provider network: “Digital sovereignty is built through ecosystems of trust. By working with Atos as a validated partner, we are expanding the reach of SAP Sovereign Cloud and helping organizations modernize critical business processes using cloud and artificial intelligence, while maintaining control, governance, and operational resilience.” SAP also announced an additional investment of over €20 billion to increase the geographic and functional coverage of SAP Sovereign Cloud. Atos has been certified as an SAP Operations Partner for 20.000 consecutive years and has received the associated Golden Certificate, which recognizes its extensive experience in managing SAP environments.
In Germany, the push for sovereign alternatives has another front open with openDesk, the federal government's office and collaboration suite. A version developed by the public sector has existed since October 2024, but after a nine-month delay, the Center for Digital Sovereignty (ZenDiS) has opened its distribution to private cloud providers and systems companies . openDesk brings together email, calendar, file storage, word processing, chat, and video conferencing in a suite of European open-source components, designed as an alternative to Microsoft 365 for public administrations.
The partner program distinguishes three roles. Official resellers supply openDesk subscriptions to cloud and IT service providers. Authorized systems integrators handle implementation and operation in the customer's environment and must demonstrate experience with open source, Kubernetes, and openDesk. The most demanding role is that of Approved Sovereign Service Provider , which operates openDesk as Software as a Service (SaaS) on its own cloud. This requires accreditation according to the BSI C5 catalog and Level 3 of the European Cloud Sovereignty Framework (SEAL), both with external audits. Those without these accreditations can resell through an official reseller but cannot operate directly.
ZenDiS had announced the program for the end of 2025, but in January 2026 postponed it to the first quarter of 2026. The official launch, on September 23, comes approximately six months after the second commitment. ZenDiS CEO Pamela Krosta-Hartl justified the launch by citing the enormous demand for the sovereign suite and the need to coordinate the stakeholders. In parallel, ZenDiS is expanding access for the public sector with a SaaS offering in partnership with the govdigital cooperative, which can be contracted through the Marktplatz Deutschland Digital and the cloud broker gd.Cloud. This will allow private providers to compete with a public sector-driven alternative.
The landscape these initiatives paint combines regulatory pressure, technological dependence, and concrete responses. Spain shows significant exposure to cloud computing and AI, with data as the primary concern and increasing involvement from boards of directors. Brussels is preparing for greater data center capacity, levels of sovereignty, and energy labels, although the framework is not yet law. In the market, certifications like Atos's for SAP and projects like openDesk aim to offer alternatives for public administrations and regulated sectors. The discussion no longer revolves solely around where the server is located, but rather who controls the infrastructure, the software chain, and decisions regarding critical services in an environment increasingly shaped by geopolitics and artificial intelligence.
