Sovereign cloud

A sovereign cloud is a cloud service built so that its data, its operators and the company that controls it all sit in one jurisdiction, usually the EU, to limit access by foreign governments.

Data residency answers where data are stored. Sovereignty asks who can reach the data and under which law. A US provider storing data in Frankfurt still answers to US law, including the CLOUD Act, which lets US authorities require providers to hand over data they control wherever it is stored. Sovereign cloud offers try to close that gap with EU-based operating companies, EU-resident staff, keys held by the customer or a local party, and separation from the provider's global network.

The EU is turning these ideas into procurement rules. On 3 June 2026 the European Commission proposed a Cloud and AI Development Act. Public bodies would have to assess risk before using cloud services and pick services at one of four assurance levels. The higher levels cover protection against non-EU control, foreign legal risk and service disruption (European Commission proposal, 3 June 2026; Wilson Sonsini, 5 June 2026). As a proposal, it must pass the Parliament and the Council before it applies.

Example: AWS made its European Sovereign Cloud generally available on 15 January 2026. AWS says the cloud is located entirely in the EU, physically and logically separate from other AWS Regions, operated by EU residents, and governed by a new parent company with German subsidiaries. It plans to invest more than €7.8 billion in Germany. These are company claims (AWS, 15 January 2026).

Related terms: data sovereignty, data residency, data localization, CLOUD Act, SCC.

Authoritative source: European Commission, proposal for a Cloud and AI Development Act (3 June 2026), EUR-Lex.

Read the full guide: Sovereign cloud providers compared.