EU Cloud: can Europe manage to create an attractive alternative?

Sovereignty raises debate and there is a wide divergence in the way to deal with that topic. The current debate in Europe on the EU Cloud Services (EUCS) High+ criteria is an illustration of the diverse positions existing in that field.

Addressing sovereignty as an isolated concept does not make sense. Sovereignty should be addressed altogether with the resilience and data protection needs, since none of these requirements can be neither dissociated nor compromised on.

The foundation of cloud computing relies on the trust we place in them, encompassing sovereignty guaranties. The sovereignty concern has been amplified by government bodies through the enforcement of various laws[1], obliging cloud providers to provide client data to the relevant authorities in case requested. EUCS is only a reaction to something initiated years before!

The domination of US cloud hyperscalers is very clear. EU cloud providers are far behind and none of them can really compete at scale. Even though, there has been a lot of progress in 2024, and further developments expected in 2025. Alternatives exists and will continue to become better in the coming years, offering more protection and extending the service offering.

Here is a non-exhaustive list of EU cloud players

One promising and unexpected rise in that space is STACKIT, the German “Lidl’s cloud”. Like years before Amazon did with AWS, Schwarz Digits was created to provide IT solutions to its vast ecosystem of Schwarz Group companies. STACKIT is part of Schwarz Digits and provides Cloud solution. STACKIT benefits from the Schwartz Group captive business to scale while now opening its services to external customers.

The Polo Strategico Nazionale initiative in Italy, created with the aim of providing public administrations with a secure, efficient, and reliable cloud infrastructure, is another illustration that things move forward to offer strong alternatives with no compromise on sovereignty, resilience and data sovereignty.

While we can regret that a consensus does not seem possible at European level on the High + criteria, it seems therefore clear to everyone that a competitive European cloud alternative is needed, at least to maintain fair competition, regulate prices and avoid too high dependencies.

The fragmentation of regulations in Europe[4] is a big barrier to the rise of a competitive Pan-European cloud alternative at scale. Providers need to comply with various domestic regulations adding complexity (and costs) and pushing providers toward the design of domestic/national solutions. Similar constraints exist on the client slide if operating in various European countries. This is why EUCS is important to allow for simplification and standardisation at EU level, establishing a standard security certification scheme for cloud services.

The scaling of EU cloud providers progresses well but will require consolidation and protection to scale. The EUCS High+ would definitively help in that direction. Creating the right market conditions is necessary to address the long-term objective to carve out a competitive space in the market.

What’s next?

• Assess the opportunity to extend your company’s existing cloud strategy by integrating an EU Cloud Provider and identifying the main use cases e.g. protect your most sensitive data such as M&A or PLM data.
• Understand the existing EU Cloud offers and main differentiator to choose your best match.
• Have the right data policy and clarity on your workload placement policy. Different cloud solutions should be eligible to different platforms, depending on the criticality of the workload and required protection level.

Are you prepared to take the next step in your cloud journey?

If you have any questions about your cloud journey, our specialists are here to help. At Forvis Mazars, we offer independent advice without selling technology solutions or partnering with cloud providers, ensuring our guidance is always unbiased and in your best interests.

[1] e.g. the Foreign Corrupt Practices Act (FCPA) or the Foreign Intelligence Surveillance Act (FISA) and its 702 section); [2] Native Providers stand for domestic cloud providers; [3] Collaborations stand for hyperscalers partnering with a domestic partner; [4] E.g. SecNumCloud, C5, ENS.