An EU sovereign cloud keeps data, operations and the operating company under EU law alone. The eight EU-owned providers compared here meet the ownership test. AWS and Microsoft sell sovereign offers too, but their US parents keep them within reach of the US CLOUD Act.
Summary
- Ownership decides jurisdiction. The CLOUD Act reaches data in a US provider's "possession, custody, or control", wherever it is stored.1 An EU data centre moves the data. The owner's duties under US law stay.
- The EU institutions chose European operators. In April 2026 the Commission awarded its €180 million sovereign cloud tender to four groups: Post Telecom with OVHcloud and Clever Cloud, STACKIT, Scaleway, and Proximus with S3NS.3
- Sovereign GPUs cost less. OVHcloud rents an H100 for €2.80 an hour and Scaleway for €2.87, against €6.03 at AWS and €10.78 at Azure.
What is an EU sovereign cloud?
The term has no single legal definition, so vendors stretch it. The European Commission's Cloud Sovereignty Framework gives the most useful test. It scores providers on eight objectives, from strategic and legal sovereignty to supply chain and technology, and assigns a level from SEAL-0, "No Sovereignty", to SEAL-4, "Full Digital Sovereignty".5 Exposure to the US CLOUD Act is one of the legal criteria.
Four questions sort any offer quickly:
- Location. Are data and backups stored and processed in the EU?
- Operations. Do only EU-based staff administer the service and support customers?
- Ownership. Is the operator free of a non-EU parent that a foreign court can compel?
- Technology. Could the service keep running if a non-EU vendor withdrew its software or updates?
Most hyperscaler offers answer yes to the first two. Only EU-owned providers answer yes to the third. Very few answer yes to the fourth for every layer, from chips to software.
Which EU sovereign cloud providers are there?
Eight providers are headquartered in the EU, have no US parent and rent infrastructure suited to AI workloads. The table lists owner, main certification, GPU range and on-demand H100 price.
EU-owned cloud providers: ownership, certification and GPUs, October 2026
| Provider | HQ | Owner | Certification | GPUs | H100/hour |
|---|---|---|---|---|---|
| OVHcloud | France | Klaba family, 79% | SecNumCloud, C5, HDS | H100, H200, L40S | €2.80 |
| Scaleway | France | iliad Group | ISO 27001, HDS | H100, B300, L40S | €2.87 |
| STACKIT | Germany | Schwarz Group | C5 Type 2, TISAX | GPU VMs | Not listed |
| IONOS | Germany | United Internet, 64% | C5 Type 1, ISO 27001 | H200, RTX PRO | No H100 |
| Hetzner | Germany | Private | ISO 27001 | RTX PRO 6000 | No H100 |
| T Cloud Public | Germany | Deutsche Telekom | C5 Type 2, TISAX | B200, RTX PRO | Not listed |
| Verda | Finland | Private, VC-backed | ISO 27001, C5 | H100 to GB300 | €3.18 |
| Nebius | Netherlands | Volozh, 52% of votes | ISO 27001, SOC 2 | H100 to B300 | €3.95 |
EU-owned, no US parent
Sources: provider imprints, price and certificate pages; ANSSI catalogue of 15 September 2026; OVHcloud shareholder structure of 5 December 2025; IONOS 2025 financial statements; Nebius Form 20-F for 2025. On-demand list prices per GPU-hour excluding VAT; Verda and Nebius converted at the ECB reference rate of 25 September 2026. Accessed 1 October 2026.
France: OVHcloud and Scaleway
OVHcloud is listed in Paris and controlled by the Klaba family, with 79.0 percent of the capital.10 It holds three SecNumCloud qualifications, the latest for its SNC Cloud Platform from 31 July 2026.911 It also lists a BSI C5 attestation and HDS for health data.12 An H100 costs €2.80 an hour; eight H200s cost €42 an hour.13
Scaleway belongs to the iliad Group.14 Its SecNumCloud qualification is "not yet granted".15 It rents H100 instances in Paris from €2.87 an hour and an eight-GPU B300 server for €60 an hour.16
Germany: STACKIT, IONOS, Hetzner and T Cloud Public
STACKIT is the cloud arm of the Schwarz Group, owner of Lidl and Kaufland.17 It holds a C5 Type 2 attestation and TISAX Level 3.18 It sells GPU virtual machines but publishes no H100 list price. IONOS is listed in Frankfurt; United Internet holds 63.8 percent.19 Its cloud received a C5 Type 1 attestation in May 2026.20 It offers H200 GPUs at €3 per GPU-hour, with no H100.21
Hetzner, based in Gunzenhausen, is ISO 27001 certified.23 It rents a dedicated server with one 96 GB RTX PRO 6000 for €1,199 a month plus a €599 setup fee.22 T Cloud Public, called Open Telekom Cloud until January 2026, is run by T-Systems. It holds a C5 Type 2 attestation.24 Its parent Deutsche Telekom opened an AI factory in Munich in February 2026, with nearly 10,000 NVIDIA Blackwell GPUs.25
GPU specialists: Verda and Nebius
Verda, called DataCrunch until November 2025, is a private company in Helsinki.26 It lists an H100 at $3.63 an hour, about €3.18.27 Nebius is the former Yandex N.V. It sold all its Russian businesses in July 2024 and has its registered office at Schiphol. Founder Arkady Volozh holds about 52 percent of the votes.28 From today its H100 costs $4.50 an hour, up from $3.85.29 It lists ISO 27001 and SOC 2 Type II.30
What does a GPU cost at an EU sovereign cloud?
Sovereignty does not carry a price premium for AI compute. The four EU-owned providers with a public H100 price all charge less than the US hyperscalers' list prices.
French clouds rent an H100 for less than half the AWS price
OVHcloud and Scaleway charge under €3 per GPU-hour. AWS charges about €6.03 and Azure about €10.78 for the same GPU.
Every EU-owned provider with a public H100 price undercuts AWS and Azure.
On-demand list price of one NVIDIA H100, € per GPU-hour
¹ H100 PCIe, one-GPU instance, zone PAR-2. ² Price from 1 October 2026; $3.85 until 30 September. ³ p5 instance, US East (N. Virginia). AWS publishes no separate price list for its European Sovereign Cloud here. ⁴ ND H100 v5, eight-GPU VM, East US. In West Europe the same VM costs $15.98 per GPU-hour.
Source: OVHcloud and Scaleway price pages (euro, excluding VAT); verda.com/pricing, nebius.com/prices, getdeploying.com (AWS) and the Azure Retail Prices API (US dollars), accessed 1 October 2026; dollar prices converted at the ECB reference rate of 25 September 2026
List prices are a starting point. Committed-use discounts, egress fees and storage change the bill. Nebius raised its prices by 17 to 21 percent today, so quotes need a date. The European cloud GPU price index tracks H100, H200, B200 and B300 prices monthly. Lindstead's AI infrastructure cost work sizes a specific workload.
What do AWS, Microsoft and Google offer as sovereign cloud?
The US providers answer the demand in two ways. AWS and Microsoft run sovereign services themselves. Google and Microsoft also license their technology to European companies that operate it.
Sovereign offers built by or on US cloud providers, October 2026
| Offer | Operator | US parent | Technology | Status |
|---|---|---|---|---|
| AWS European Sovereign Cloud | German GmbHs | Amazon | AWS | Live, Jan 2026 |
| Microsoft EU Data Boundary | Microsoft | Microsoft | Azure, Microsoft 365 | Done, Feb 2025 |
| S3NS | Thales-controlled | Google (JV) | Google Cloud | SecNumCloud, 2025 |
| Bleu | Orange, Capgemini | None | Azure, Microsoft 365 | SecNumCloud pending |
| Delos Cloud | SAP | None | Microsoft | Federal pilot |
US-owned operator EU operator, US technology
Sources: AWS, 14 January 2026; aws.eu FAQ; Microsoft, 26 February 2025 and 16 June 2025; ANSSI catalogue of 15 September 2026; S3NS; Bleu, 17 November 2025; Delos Cloud. Accessed 1 October 2026.
The AWS European Sovereign Cloud opened on 14 January 2026 in Brandenburg, Germany. It is run by German legal entities, "operated exclusively by EU residents located in the EU", and backed by a €7.8 billion investment.31 Its managing directors and advisory board are EU citizens.32 Microsoft completed its EU Data Boundary in February 2025, so EU customers' data for its cloud services is stored and processed in the EU.33 In June 2025 it added a Sovereign Public Cloud with access "controlled by European personnel".34
The partner model goes further. S3NS, a joint venture of Thales and Google Cloud, received SecNumCloud qualification on 17 December 2025.935 S3NS calls itself "a French entity fully controlled by Thales".4 Bleu, owned by Orange and Capgemini, runs Microsoft Azure and Microsoft 365 and is still in the SecNumCloud process.36 Delos Cloud, an SAP subsidiary, runs Microsoft technology for German public administration and is in a pilot with the federal government.37
Why does a US-owned sovereign region still sit under the CLOUD Act?
The CLOUD Act of 23 March 2018 obliges US providers to disclose data within their "possession, custody, or control", regardless of whether it is "located within or outside of the United States".1 The test is control by the company. Server location does not enter into it.
A sovereign region moves the servers and the staff to Europe. The ownership chain still ends in Seattle or Redmond. AWS and Microsoft have built their structures to argue that the US parent cannot reach the data. No US court has ruled on that argument. Until one does, the risk sits with the customer.
Microsoft France was asked about this under oath. On 10 June 2025 the French Senate asked whether it could guarantee under oath that French public data would never be handed to US authorities. The answer: "Non, je ne peux pas le garantir", meaning no, it could not guarantee it.2
The partner model narrows the gap. S3NS and Bleu contract directly with customers, and SecNumCloud requires protection from non-EU laws. A dependency remains: the software and its updates come from Google or Microsoft. In the Commission's tender, The Register reported that S3NS reached SEAL-2 while the three other winners reached SEAL-3.4 Customer-held encryption keys reduce the risk for any US-linked offer. An EU-owned provider removes the legal question.
Which certifications prove a cloud is sovereign?
No EU-wide sovereignty certificate exists yet. Buyers rely on national schemes and on the Commission's own procurement test.
Sovereignty and security labels for cloud services in the EU
| Label | Issued by | Type | Tests foreign law | Status |
|---|---|---|---|---|
| SecNumCloud 3.2 | ANSSI, France | Qualification | Yes | In force |
| C5 | BSI, Germany | Audit attestation | Disclosure only | In force |
| EUCS | ENISA, EU | Scheme | Not settled | Not adopted |
| SEAL 0 to 4 | European Commission | Procurement score | Yes | Used since 2025 |
| CADA levels 1 to 4 | European Commission | Proposed regulation | Yes, at level 4 | Proposed June 2026 |
Sources: ANSSI; BSI; European Commission, Cloud Sovereignty Framework v1.2.1 (October 2025), CADA proposal (3 June 2026) and certification framework page (9 September 2026). Accessed 1 October 2026.
SecNumCloud is the strictest label in force. ANSSI's September 2026 catalogue lists qualified services from OVHcloud, S3NS, Outscale, Cloud Temple, Orange, Numspot and others.9 C5 is an audit attestation against BSI criteria. It reports where data sits and which laws may apply, but sets no ownership rule. EUCS, the planned EU scheme, is still a candidate scheme without an implementing act.8
The Cloud and AI Development Act, proposed on 3 June 2026, would create one EU-wide sovereignty assessment.6 According to an analysis by the law firm Hogan Lovells Cadwalader, it defines four assurance levels; at the highest, the provider must not be "controlled by a third country".7 Parliament and Council still have to agree the text. Public bodies can follow the debate on the public sector page.
How to choose an EU sovereign cloud for AI
Five steps take a team from requirement to shortlist.
- Classify the data. Health records, classified files and client secrets usually need an EU-owned operator. Public marketing content does not.
- Set the jurisdiction rule. Decide whether a US parent is acceptable with customer-held keys, or excluded. French public bodies may need SecNumCloud; German bodies usually ask for C5.
- Match the GPU to the model. Many open-weight models fit on one 80 to 96 GB GPU. The hardware guide sizes them.
- Compare total cost. Add storage, egress and support to the GPU-hour price, and ask about committed-use discounts.
- Plan the exit. Prefer open standards such as Kubernetes and S3-compatible storage. DORA requires financial entities to document exit plans for ICT providers.
Renting is one option. On-premise or private cloud AI weighs owning hardware against renting it. Lindstead's AI deployment service puts a first use case into production on an EU-owned cloud. Its AI governance and compliance work documents the jurisdiction choice for auditors.
Frequently asked questions
-
A cloud service whose data, operations and operating company answer only to EU law. Data residency in the EU is the minimum. Full sovereignty also requires an operator that no non-EU parent or government can compel to hand over data.
-
The risk remains. The CLOUD Act reaches data in a US provider's possession, custody or control, wherever it is stored. The AWS European Sovereign Cloud runs through German companies within the Amazon group, and whether a US court would treat that data as under Amazon's control has not been tested.
-
OVHcloud and Scaleway in France; STACKIT, IONOS, Hetzner and T Cloud Public in Germany; Verda in Finland; Nebius in the Netherlands. Each is headquartered in the EU with no US parent company.
-
A security qualification issued by ANSSI, the French national cybersecurity agency. Version 3.2 adds requirements meant to protect data from non-EU laws. In September 2026 ANSSI listed qualified services from OVHcloud, S3NS, Outscale, Cloud Temple, Orange and others.
-
OVHcloud rents an H100 from €2.80 an hour and Scaleway from €2.87. Verda and Nebius offer H100 to B300 GPUs. IONOS offers H200, Hetzner RTX PRO 6000 servers, and Deutsche Telekom sells Blackwell capacity from its Munich AI factory.
Sources
- 18 U.S.C. 2713, Required preservation and disclosure of communications and records (CLOUD Act), Cornell Legal Information Institute. www.law.cornell.edu/uscode/text/18/2713
- French Senate, commission of inquiry on public procurement, hearing of Microsoft France, 10 June 2025. www.senat.fr/compte-rendu-commissions/20250609/ce_commande_publique.html
- European Commission, Commission awards €180 million tender for sovereign cloud to four European providers, IP/26/833, 17 April 2026. ec.europa.eu/commission/presscorner/detail/en/ip_26_833
- The Register, Europe picks four sovereign cloud providers, but one has Google, 20 April 2026. www.theregister.com/off-prem/2026/04/20/europe-picks-4-sovereign-cloud-providers-but-one-has-google/5228600
- European Commission, Cloud Sovereignty Framework, version 1.2.1, October 2025. commission.europa.eu/document/download/09579818-64a6-4dd5-9577-446ab6219113_en
- European Commission, Proposal for the Cloud and AI Development Act (CADA), 3 June 2026. digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
- Hogan Lovells Cadwalader, The EU's Cloud and AI Development Act (CADA): towards a sovereignty-focused framework, 19 June 2026 (law firm analysis). www.hlc.com/en/publications/the-eus-cloud-and-ai-development-act-cada-towards-a-sovereigntyfocused-framework-for-cloud
- European Commission, The EU cybersecurity certification framework (status of EUCS), updated 9 September 2026. digital-strategy.ec.europa.eu/en/policies/cybersecurity-certification-framework
- ANSSI, catalogue of certified and qualified products and services, updated 15 September 2026, section 3.3 SecNumCloud. messervices.cyber.gouv.fr/visas/catalogue-produits-services-profils-de-protection-sites-certifies-qualifies-agrees-anssi.pdf
- OVHcloud, shareholder structure at 5 December 2025. corporate.ovhcloud.com/en/investor-relations/shareholders-and-governance/
- OVHcloud, SecNumCloud qualification for SNC Cloud Platform, 1 September 2026. corporate.ovhcloud.com/en/newsroom/news/ovhcloud-obtains-secnumcloud-qualification-snc-cloud-platform/
- OVHcloud, compliance and certifications (C5, HDS, ISO 27001). www.ovhcloud.com/en/compliance/
- OVHcloud, Public Cloud prices (euro, excluding VAT). www.ovhcloud.com/en-ie/public-cloud/prices/
- Scaleway, about us (subsidiary of the iliad Group). www.scaleway.com/en/about-us/
- Scaleway, SecNumCloud qualification status. www.scaleway.com/en/security-and-compliance/secnumcloud/
- Scaleway, GPU Instances pricing. www.scaleway.com/en/pricing/gpu/
- STACKIT, imprint (Schwarz Digits Cloud GmbH & Co. KG). stackit.com/en/imprint
- STACKIT, certificates. stackit.com/en/why-stackit/benefits/certificates
- IONOS Group SE, financial statements 2025 (shareholder structure at 31 December 2025). www.ionos-group.com/fileadmin/Publications/Berichte/FY_2025/IONOS_Group_SE_Financial_Statements_2025.pdf
- IONOS Cloud, certificates (C5 Type 1, May 2026). cloud.ionos.de/zertifikate
- IONOS Cloud, Cloud GPU VM pricing. cloud.ionos.de/cloud-gpu-vm
- Hetzner, GEX131 dedicated GPU server. www.hetzner.com/dedicated-rootserver/gex131/
- Hetzner, data protection certificates (ISO 27001). www.hetzner.com/unternehmen/zertifizierung/
- T Cloud Public (formerly Open Telekom Cloud), certifications and attestations. www.t-cloud-public.com/en/products-services/core-services/certifications
- Deutsche Telekom, Germany's first AI factory for industry goes into operation in Munich, 4 February 2026. www.telekom.com/en/newsroom/latest-updates/media-information/2026/2/germany-s-first-ai-factory-for-industry
- Verda, DataCrunch is changing its name to Verda, November 2025. verda.com/blog/datacrunch-is-changing-its-name-to-verda
- Verda, GPU pricing. verda.com/pricing
- Nebius Group N.V., annual report on Form 20-F for 2025, filed 30 April 2026. www.sec.gov/Archives/edgar/data/1513845/000110465926052948/nbis-20251231x20f.htm
- Nebius, prices, including changes from 1 October 2026. nebius.com/prices
- Nebius, trust center. nebius.com/trust-center
- AWS, Opening the AWS European Sovereign Cloud, 14 January 2026. aws.amazon.com/blogs/aws/opening-the-aws-european-sovereign-cloud
- AWS European Sovereign Cloud, FAQ (legal entities and governance). www.aws.eu/faq/
- Microsoft, Microsoft completes landmark EU Data Boundary, 26 February 2025. blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency/
- Microsoft, Announcing comprehensive sovereign solutions for European organisations, 16 June 2025. blogs.microsoft.com/blog/2025/06/16/announcing-comprehensive-sovereign-solutions-empowering-european-organizations/
- S3NS, PREMI3NS obtains SecNumCloud qualification, December 2025. www.s3ns.io/en/news/premi3ns-secnumcloud-qualification
- Bleu, Bleu validates J1 of its SecNumCloud 3.2 qualification process, 17 November 2025. www.bleucloud.fr/bleu-valide-le-j1-de-son-processus-de-qualification-secnumcloud3-2/
- Delos Cloud, about us. www.deloscloud.de/about-us.html
- getdeploying.com, NVIDIA H100 rental price comparison (AWS p5). getdeploying.com/gpus/nvidia-h100
- Microsoft, Azure Retail Prices API, Standard_ND96isr_H100_v5. prices.azure.com/api/retail/prices
Method: desk research of public primary sources, all accessed 1 October 2026. Prices are published on-demand list prices excluding VAT, not Lindstead measurements. Dollar prices converted at the ECB reference rate of 25 September 2026. Corrections: contact@lindstead.com.