Data sovereignty 22 Oct 2026 · 4 min read

Resilience is not sovereignty – three questions to ask your cloud provider

This week, two of the largest cloud providers made new moves on European sovereignty. On 20 October, Microsoft presented, among other things, Data Guardian, in which a trusted European partner will oversee when Microsoft engineers remotely access customers' production systems, together with an access log that cannot be altered without detection. On Saturday 24 October, AWS plans to disconnect its European Sovereign Cloud from its global network for several hours, to show that the region can run on its own.

Meanwhile, the debate continues over the EU's proposed Cloud and AI Development Act (CADA). A study by the think tank ECIPE, commissioned by the industry association CCIA Europe, estimates that the proposal's sovereignty requirements could cost around EUR 115 billion over ten years, far more than the Commission's own estimate. It is a study commissioned by an interested party and should be read as such, but it also contains an observation worth taking seriously.

Good steps – but what is actually being tested?

The AWS exercise is first and foremost a test of resilience: does the region keep working when the connection to the rest of the group's network is cut? That is valuable, and more providers should demonstrate exercises like this. But as several critics pointed out in InfoQ's coverage, technical resilience is not the same thing as legal sovereignty. "You can't solve legal problems with technical solutions," as one of them put it. Another open question is how global services such as identity and DNS behave when the region is cut off.

The same reasoning applies to Microsoft's announcements. External oversight, tamper-evident logs and customer-held keys increase transparency and make it harder to access data unnoticed. That is good. But the parent company is still American and subject to US law, and that is the question many European organisations are fundamentally trying to address.

Nationality is not control either

This is where the ECIPE study gets interesting. According to The Register's coverage, ECIPE analysed just over 8,700 cloud procurements in nine EU countries between 2018 and 2025. Every procurement that used the term sovereignty went to a supplier in the same country – but many of the winners were resellers building on infrastructure from American hyperscalers.

In other words, a Swedish or European flag on the contract is not enough either. Sovereignty is about who actually controls data, keys, operations and the supply chain – and which jurisdiction can compel access. Ownership matters, but only if it is also reflected in how the platform is built and run.

Three questions we ask in architecture work

When we help organisations choose a platform, we usually start with three concrete questions rather than with the providers' marketing:

Which jurisdiction can demand access? This applies not only to the cloud provider but to the whole chain: the parent company, subcontractors for operations and support, and the providers of the SaaS services the platform depends on.
What happens to the control plane if the connection is cut? Identity, key management, DNS, container registries and monitoring are often the parts that quietly remain in a global service even when the workload itself runs in Europe.
How quickly can we move? An exit plan that has never been rehearsed is a hope. With Kubernetes, infrastructure as code and open standards, the platform can be built so that the same code can be deployed with another provider – and that can actually be tested.

Not everything needs the highest level

CADA's proposal is built on four levels, where the strictest, according to Computer Sweden's reporting, is intended for roughly one percent of the most sensitive workloads. That is a reasonable starting point for individual organisations too. Not everything needs to run with maximum sovereignty, but whatever is classified as sensitive – for example patient data in healthcare or business-critical systems in the public sector – should be placed deliberately, on a platform that can be moved and with an operating model that is understood.

Our view is that Swedish and European infrastructure providers are today a fully realistic choice for many of these workloads, especially when the platform is built to be portable from the start. Then the choice of provider becomes a decision that can be revisited, not a lock-in.

What we are following next

AWS has promised an update after the disconnection test on 24 October, Microsoft will show more at Ignite in mid-November, and negotiations on CADA continue. We will come back when there is more to say. In the meantime, the three questions above are a good start for anyone who wants to know where their own organisation stands.

Sources

Discuss this with us