EU Cloud Act and Data Act: Implications for Cloud Strategies
TL;DR The EU Cloud Act Data Act implications necessitate a consistent compliance-first approach. …

The demand for German hyperscalers is currently gaining popularity. In light of increasing geopolitical tensions, discussions about the Cloud Act, regulatory requirements like NIS-2, DORA, or the Data Act, and the obvious market power of American cloud providers, the conclusion seems obvious: Europe must build its own hyperscalers to regain digital sovereignty.
However, this is where a discussion often begins that is based on a questionable assumption.
Before we discuss whether Germany or Europe needs its own hyperscalers, we should first answer a much more fundamental question: Do most companies even need the type of infrastructure for which hyperscalers were originally developed?
The answer is much more sobering than the marketing departments of major cloud providers would have you believe.
The architecture of a hyperscaler is the result of very specific challenges. Companies like Amazon, Google, or Netflix had to develop platforms that operate globally, handle load spikes in the millions within seconds, and ensure availability that doesn’t noticeably degrade even with the failure of entire regions.
These requirements exist. They are real.
However, they exist for only a vanishingly small fraction of all companies.
The average European mid-sized company does not operate a global streaming platform. It does not process billions of transactions per day. It does not need to serve a hundred million users simultaneously. In many cases, we are talking about specialized applications, customer portals, ERP systems, collaboration platforms, or industry-specific software solutions with user numbers in the hundreds or thousands.
Of course, such systems also need to be highly available, secure, and scalable. However, the notion that this automatically requires the infrastructure class of a hyperscaler rarely holds up under technical scrutiny.
The real challenge usually lies not in scaling to millions of users but in professional operations, robust automation, traceable deployment processes, effective monitoring, and the ability to consistently meet regulatory requirements.
In other words: The challenge lies in engineering, not necessarily in the size of the infrastructure.
A remarkable phenomenon often emerges in conversations with companies discussing cloud strategies or digital sovereignty.
When asked about actual requirements, one often receives not a description of business or technical goals but a list of products.
They need Azure. They need Microsoft 365. They need Copilot. They need the services already within the existing Microsoft ecosystem.
From a technical perspective, this is remarkable because product names are not requirements.
A requirement describes a problem to be solved. A product describes a vendor claiming to solve that problem.
The difference may seem trivial at first glance, but it is crucial. Because once companies begin equating a vendor’s products with their actual requirements, a situation arises where every alternative automatically appears inadequate.
Anyone who formulates the requirement as needing Microsoft Teams will inevitably conclude that every alternative is worse than Microsoft Teams.
However, those who state that they need secure communication, document exchange, and digital collaboration open up a completely different solution space.
This is precisely where many discussions about digital sovereignty fail.
The debate becomes particularly interesting when European alternatives come into play.
Then the argument often arises that one must make compromises with European providers.
But what does that mean concretely?
Is a business-critical function truly missing? Is there a technical capability missing without which the company would be unable to operate? Or is it merely the identical user interface, the identical product name, and the identical marketing promise that are missing?
This question is astonishingly rarely asked.
Yet it determines the entire character of the discussion.
Anyone striving for digital sovereignty must first be willing to decouple their requirements from the products that have previously fulfilled those requirements. Between the statement “We need Microsoft Product X” and the statement “We need a revision-safe document repository with role-based access and GDPR-compliant data storage,” there are not only linguistic but also strategic worlds.
Only when requirements are described at this level can it be assessed which technologies are suitable and which are not.
As long as companies formulate their goals solely as product comparisons, the outcome remains inevitably predictable: The original provider wins.
There is another aspect that is often underestimated in public debates.
A significant portion of the technological foundations of modern cloud infrastructures has long come from the open-source environment. Kubernetes dominates the orchestration of containerized workloads. PostgreSQL is among the most powerful database systems in the world. Prometheus, Grafana, OpenSearch, Argo CD, Harbor, Keycloak, or HashiCorp Vault today form the foundation of countless productive platforms.
The notion that Europe lacks the technical capabilities to operate modern applications independently of American hyperscalers is therefore difficult to sustain.
In fact, most cloud-native applications can be operated on European infrastructure without any issues, whether in a data center of a European provider, on own hardware, or in hybrid operating models.
The real question is therefore not whether Europe would be technologically capable.
The real question is whether companies are willing to let go of the idea that modern IT must necessarily come from a single product catalog.
Particularly problematic is the assumption that digital sovereignty can be achieved solely by changing providers.
A German hyperscaler that creates the same lock-in mechanisms, establishes the same proprietary dependencies, and exerts the same control over data, interfaces, and operating models as its American counterparts does not solve the actual problem.
It merely shifts its geographical location.
Digital sovereignty does not arise from the nationality of a provider. It arises from control.
Control over data storage, operating processes, interfaces, identities, deployment mechanisms, and exit strategies.
Companies do not become sovereign because their infrastructure is located in Germany. They become sovereign when they can migrate, replicate, or independently develop their systems without fundamental architectural changes.
That is precisely why open standards, portable architectures, and cloud-native platform models are often more valuable in the long term than the mere existence of another hyperscaler.
Europe will not win the competition with American hyperscalers by copying their models. The economies of scale, capital resources, and market positions of existing providers have grown over decades and cannot simply be replicated.
Europe’s opportunity lies elsewhere.
It lies in open ecosystems, standardized platforms, regulatory transparency, and infrastructures that do not bind companies to individual providers but consciously give them the option to switch providers.
Anyone who takes digital sovereignty seriously should therefore discuss less how Europe can build its own hyperscalers and much more how dependencies can be reduced.
Because most companies do not need infrastructure like Netflix.
They need robust platforms, professional operations, traceable compliance processes, and the assurance that their technological future does not depend on the strategic decisions of a single corporation.
That is where digital sovereignty begins. Not with the size of a data center, but with the ability to decide on one’s own infrastructure.
And that is precisely why a German hyperscaler does not automatically solve the problem.
TL;DR The EU Cloud Act Data Act implications necessitate a consistent compliance-first approach. …
Europe likes to see itself as a global guardian of data protection and fundamental rights. GDPR, …
TL;DR A governance-first approach is the central lever for hybrid platforms in Europe. It reduces …