I’ve heard variants of the same line from probably a dozen people in the last six months. A consultant I know has done more US-to-EU migrations this calendar year than in his entire career before. A founder on LinkedIn wrote the other day: Trump effectively has a kill-switch to our highly digitalised society, and the thought of that is frightening. None of those people would have used the word “sovereignty” in 2023. All of them now use it without explanation.
Schleswig-Holstein, a German state of 2.9 million residents, is roughly 80% done shifting ~30,000 state workstations off Microsoft Office onto LibreOffice as of late 2025 (The Register, 15 Oct 2025), with Linux pilots running and full migration targeted for 2026. Airbus opened a tender in December 2025 for a sovereign EU cloud to host ERP, MES, CRM and PLM (over €50M, up to 10 years), and the EVP Digital told Les Echos she gave herself only an “80/20” chance of finding a qualifying provider (heise online, 19 Dec 2025). The ICC migrated off Microsoft Office onto openDesk, the open-source suite developed by Germany’s ZenDiS, in October 2025 (The Register, 31 Oct 2025), roughly six months after the US government effectively cut its chief prosecutor’s Microsoft email account under EO 14203 (see Just Security analysis; Microsoft asked UK Parliament to “correct the record” in Feb 2026). The Dutch parliament passed five separate motions in March 2025 to (i) remove DigiD from Kyndryl after its planned Solvinity acquisition, (ii) re-evaluate AWS hosting of the .nl domain, (iii) prioritise EU providers in procurement, (iv) mandate exit plans for all US-hosted systems, and (v) tender a national Dutch-controlled cloud (Computer Weekly; Euronews, 20 Mar 2025). Microsoft itself responded with a €40B+ EU datacenter expansion (40% capacity growth across 16 countries) and a contractually binding “court-fight clause”: Brad Smith publicly pledged that Microsoft will sue the US government rather than comply with an order to suspend EU operations (Microsoft “European Digital Commitments” blog, one-year-on update, 29 Apr 2026). And the European Commission is reportedly preparing to unveil a Tech Sovereignty Package on 27 May 2026 (the Cloud and AI Development Act, or CADA, plus a Chips Act 2.0) that would restrict EU member-state governments from using US cloud providers for sensitive public-sector data in healthcare, finance and judicial systems (CNBC, 7 May 2026).
I also see it in my day-to-day work. Every data or AI project we’ve run with banking clients in DACH in the last 12 months has had digital sovereignty on the agenda. Sometimes it is the agenda. On 18 November 2025 the European Supervisory Authorities published the first official list of Critical ICT Third-Party Providers under DORA: 19 designations, including AWS, Microsoft, Google Cloud, IBM, Bloomberg, LSEG, TCS and Orange (EBA press release). Every named provider now sits under direct EU-level oversight, with fines up to 1% of average daily global turnover applied per day for up to six months. Sovereignty in 2026 has therefore become a regulatory deliverable with a last-test date. The cause stack runs in two layers, worth separating: four converging legal pressures, plus a parallel opinion shift in how decision-makers price political risk.
Policy shift
The sovereignty conversation in 2026 is not really about GDPR (that battle is six years old). It is about the collision of four legal vectors that until 2024 the market was prepared to ignore.
First, extraterritorial US instruments are no longer abstract. The CLOUD Act (18 U.S.C. § 2713) compels US-headquartered providers to disclose data “regardless of whether such communication, record, or other information is located within or outside of the United States.” Microsoft’s H2 2024 transparency report shows 5,587 US law-enforcement demands for consumer data, 115 of which were warrants for content stored outside the US (Microsoft CSR Government Requests). In late 2024, Microsoft France told the French Senate that it cannot guarantee data on its EU infrastructure won’t be transferred to US authorities under a CLOUD Act order. That was the moment the legal abstraction became a quotable admission from the provider itself. Then Executive Order 14203 (Federal Register, 12 Feb 2025; analysis, Winston & Strawn) sanctioned ICC officials, including Chief Prosecutor Karim Khan, and Khan promptly lost access to his Microsoft email (Computer Weekly). Microsoft denied actively cutting him off; the ICC migrated to openDesk anyway. Whatever the correct narrative, the empirical proof point landed.
FISA §702, reauthorised in April 2024 under RISAA (sunsets 20 April 2026, CRS R48592; Brennan Center §702 resource), continues to allow warrantless collection from US “electronic communication service providers”. That’s the same defect that invalidated Privacy Shield in Schrems II (CJEU C-311/18, 16 Jul 2020). NOYB’s announced intent to bring a broader CJEU challenge to the EU-US Data Privacy Framework rests squarely on the argument that the transatlantic data architecture is held up by a Biden executive order (EO 14086) that any subsequent administration can rescind. The General Court upheld the DPF in Latombe (T-553/23, 3 Sept 2025, Hogan Lovells); the appeal was lodged 31 October 2025 and is now pending.
Second, the EU has built statutory counter-pressure. The Data Act (Regulation (EU) 2023/2854) applies from 12 September 2025. Article 32(1) requires data-processing providers to take “all adequate technical, organisational and legal measures… to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law.” Article 32(2) recognises a third-country court order only where it is based on an international agreement in force with the EU. There is no EU–US CLOUD Act executive agreement. So a US warrant served on Frankfurt-hosted, non-personal banking-transaction metadata is now, on paper, a statutory conflict the provider has to resist. The switching-charge ban kicks in January 2027, removing one of the structural lock-ins.
The EU AI Act (Regulation 2024/1689) entered into force 1 Aug 2024; GPAI obligations applied from 2 August 2025 with a 10²⁵-FLOPs threshold for systemic-risk designation, and Commission enforcement begins 2 August 2026. Fines up to 7% of global turnover. Meta declined to sign the GPAI Code of Practice; OpenAI, Anthropic and Google signed. Compliance for the next frontier-model generation is unsettled and ultimately determined by Brussels.
Third, the EUCS sovereignty fight is the bellwether. ENISA’s draft European Cybersecurity Certification Scheme for Cloud Services removed the “high+” sovereignty requirements (EU HQ, EU staff, EU jurisdiction) under industry pressure in March 2024 and has not formally adopted a successor (ITIF analysis, May 2025; Hogan Lovells). France, Italy and Spain are reportedly pushing reinsertion. France’s national SecNumCloud standard already requires immunity from extraterritorial laws, and S3NS (Thales+Google JV) received SecNumCloud 3.2 qualification on 17 December 2025, the first such qualification for a US-tech-backed sovereign cloud.
Fourth, and most operationally consequential for anyone in financial services: DORA The Digital Operational Resilience Act (Regulation 2022/2554) applied from 17 January 2025. The 19-name CTPP list referenced above is the operational tip of it. Article 28 mandates contractual exit strategies; Article 30 specifies critical-function contracts; Articles 31–44 hand direct EU-level oversight to Lead Overseers with fines up to 1% of average daily global turnover applied per day for up to six months. The ECB Guide on Outsourcing Cloud Services (16 July 2025) clarifies SSM expectations: concentration risk, exit testing, audit rights as a continuous obligation rather than a contractual boilerplate. BaFin’s BAIT and MaRisk AT 9 (9th amendment, June 2024) align German national supervision to DORA; FINMA Circular 2018/3 has been in force since 2018 and is technology-neutral but conditions outsourcing abroad on enforceable inspection rights in the host jurisdiction. BaFin’s March 2024 cloud guidance update operationalises the same expectations at the German national level. The triangulation (DORA + ECB Guide + BAIT/MaRisk + FINMA 2018/3) now converges on three requirements for every DACH bank: a documented and tested exit strategy, contractually enforceable audit access in the actual jurisdiction, and a measurable concentration metric for ICT third-party providers. That’s why this is on every CIO’s agenda.
Roughly: that’s the policy shift. Four statutes, plus a CJEU pipeline that could collapse the DPF mid-decade, plus sector regulators operationalising those obligations into board-level requirements.
Opinion shift
The second reason is harder to quantify but I think also harder to undo. The consultant I mentioned earlier framed it directly: the migrations he is being paid to do are not about anyone trusting Brussels more than Washington, they are about a US administration that demonstrated, repeatedly and on the record, that it will weaponise commercial dependencies against allies.
The political catalysts cluster tightly around two events. The Microsoft / Karim Khan episode put the precedent in the record. The threats to Greenland’s sovereignty (and the January 2026 Denmark tariff escalation, House of Commons Library CBP-10472) moved the conversation from precedent to plausible scenario. CSIS framed the Greenland crisis as “the catalyst for European digital awakening” (CSIS, 2025). Trump’s August 2025 threat to impose substantial tariffs and export restrictions against any country with digital services taxes, the DMA, or the DSA, followed by the December 2025 Bloomberg report naming Accenture, Siemens and Spotify as potential Section 301 retaliation targets, removed the remaining ambiguity about whether the lever would actually be pulled.
This is also why the well-meaning “Europe isn’t a sanctuary” pushback misses the structure of the decision. It is correct, on its own terms: the EU has its own surveillance creep (the EPRS VPN study, the recurring Chat Control proposals, German Impressum overhead, French ID rules, the UK’s age-verification regime). Stripe was founded by Irish brothers but is structurally a US company. ASML is technically Dutch but its supply chain and IP exposure put it inside the US Foreign Direct Product Rule. The September 2024 Dutch government move to take over licensing of NXT:1970i and 1980i DUV systems is the template for how that exposure plays out in practice. Proton, the most flagship “trust-based” Swiss company, has publicly threatened to leave Switzerland over the revised VÜPF surveillance ordinance and has begun relocating physical infrastructure to Germany and Norway. Two facts coexist: Europe is not clean, and the marginal exposure is still lower than running on a US-controlled stack.
Europe in 2026 is trying to distance more than it is trying to grow. The risk is real that the sovereignty conversation produces fragmented, slightly worse versions of every layer of the stack without producing a competitive EU tech ecosystem. The Airbus-A380 jibe (“database in France, frontend in Belgium, ops in Spain”) gets thrown around for a reason. The counter is structural: Airbus is doing fine, Schwarz Digits (Lidl/Kaufland’s IT arm) just won the Dutch Central Bank’s cloud away from AWS, OVHcloud crossed €1B in FY2025 revenue (+9.3% LFL), and Mistral closed a €1.7B Series C led by ASML in September 2025 with plans for a >$1B Sweden datacenter. The fragmentation critique tracks a real risk, but it isn’t a reason to stop.
What I’d hold
Two extreme facts coexisting. (1) Sovereignty is not a values play; it is the rational response to a US legal apparatus that demonstrated in 2025 it will weaponise commercial dependencies, and to an EU statutory stack that makes the non-action increasingly non-compliant. The policy shift forces the conversation; the opinion shift makes it stick. (2) The supply side is two orders of magnitude under-funded relative to the hyperscaler base it is meant to substitute for, and the EU’s own EUCS process can’t agree on what “sovereign” means. So the migration in 2026 will look like what Gartner is measuring: mostly partition-by-partition, with the first contested CLOUD Act warrant against an EU-resident hyperscaler subsidiary as the next inflection point.
The migrations are not about whether the EU is a sanctuary, they are about lowering the conditional probability of being unplugged by someone whose only obligation is to a different electorate. That’s not a directional call. It’s a structural one, and it’s why the topic is, quietly, the #1 agenda item of 2026.