Sovereign clouds roll in to Europe

New cloud tech formations are taking shape in Europe in response to regulatory requirements for data sovereignty as well as growing demand from enterprises for security solutions. 

With sovereign cloud offerings coming from Amazon Web Services, Google, Microsoft, and Oracle, along with solutions from a host of local cloud providers, activity is picking up in Europe. But it is still early days.

Rahiel Nasir, lead analyst for Worldwide Digital Sovereignty and associate research director for European Cloud, at IDC, describes the market as “in its infancy.”

“Over the last few years, a lot of the major cloud providers have been setting out their stalls, talking about how they define the market and how they will meet demand and provide solutions for it…2024 is all about delivery of those solutions,” he says.

IDC considers data sovereignty and sovereign cloud to be subsets of “digital sovereignty,” which essentially means “giving data owners total control over how and where their data is managed, stored, and processed by service providers,” including all the infrastructure and the support staff that can access the data and infrastructure, according to Nasir. 

The research firm expects spending on sovereign cloud worldwide to grow 27% on average from 2022 to 2027, reaching $258.5 billion by the end of the forecast period. An indication of how new the market is, IDC said it believes its study is the first to explore and measure enterprise spending on sovereign services.

Most of the new services are focused on the European market, where a growing list of regulations are setting parameters for data usage and oversight for enterprises and public sector organizations. Although Nasir noted that there is interest in Asia-Pacific and that North America is “getting wiser on the issue.”

But it is not just regulatory compliance that is driving growth. Nasir said that the bigger drivers for sovereign cloud solutions currently are increasing use of the cloud to support remote workers and the need for enhanced cybersecurity.  

Hyperscale providers adapt to sovereign mandates

Oracle was early to commit to sovereignty among the big cloud providers when it announced in July 2022 that it would build a dedicated offering for Europe. Oracle launched its EU Sovereign Cloud in June 2023, which is physically separate from the service provider’s commercial and government cloud and initially has two cloud regions located in Frankfurt, Germany (hosted by local partner Equinix), and Madrid, Spain (hosted by Digital Realty). 

The solution is described as providing the capabilities of Oracle Cloud Infrastructure public cloud regions, with the same pricing, support and service level agreements, while complying with European data regulatory requirements. 

AWS followed in October last year with plans to offer European Sovereign Cloud, marking a shift in strategy as it had previously positioned its cloud offerings as having sovereign features already built in. Germany will be the first location for its dedicated solution, although commercial availability date was not specified. 

Meanwhile, Microsoft announced in December that its Cloud for Sovereignty solution, which is designed for government customers, is generally available across all Azure regions. 

Role for telcos in sovereign cloud? 

Some telcos, such as Deutsche Telekom and Orange, have carved out a role by teaming with cloud providers to offer sovereign solutions. 

“You can’t go alone in the sovereign market, you have to partner with local partners …[and] can also leverage the local knowledge and expertise and trust that these brands have in Europe,” explains Nasir.

In France, Orange has entered the sovereign cloud services arena through a joint venture with Capgemini, called Bleu, in partnership with and based on Microsoft Azure technology. First announced in 2021, the JV finally received regulatory approval from the European Commission last year and this week it kicked off commercial operations to prepare “cloud de confiance” (“trusted cloud”) services. Bleu said it has started work with “select” private and public organizations to test migration and onboarding the new platform. 

Microsoft 365 and Azure are among the first services that will be supported by Bleu, which are targeted to go live by the end of this year. But these and other services will need to be approved by the French National Agency for Information Systems Security (ANSSI) as well as other requirements for “trusted cloud” operators. Bleu said it expects to receive the necessary SecNumCloud 3.2 qualification in 2025. 

Bleu is one of multiple trusted cloud players targeting the sovereign cloud space in France, including local provider OVHCloud and S3NS, the partnership between Thales and Google Cloud. 

Nassima Auvray, Chief Trust Officer at Orange Business, claims telcos have a “key role” to play in the sovereign cloud market given their network reach and their own experience with data protection and regulatory compliance. 

“Orange has essential infrastructure all over the world...Underlying these infrastructures are issues that are directly linked to sovereignty, such as resilience, security, and regulatory compliance. Added to this are managed services – from infrastructure management to data backup – which represent an additional building block contributing to the challenges of trusted cloud,” she explains.

“Secondly, telcos are well placed as they are themselves confronted with the challenges of the sovereign cloud for their own needs...Due to the mission-critical nature of telecoms services and the sensitive data they handle, security is a major concern in the Telco Cloud. Advanced security measures are put in place to protect data and ensure service continuity,” she added.

Furthermore, she notes that telcos “face a constant challenge of modernization” and that they need to “develop smarter networks to respond to the growing use of connected objects [IoT], for example, by leveraging innovative 5G and edge computing services, which combine modern connectivity with intensive data processing, all in a distributed and localized environment.”

In Germany, Deutsche Telekom’s IT services arm T-Systems has partnered with Google Cloud to provide sovereign cloud services. The offering has been available to customers since April 2022. In this partnership, T-System’s role is responsibility for “operational measures and control mechanisms to maintain sovereignty,” while Google provides and operates the native cloud infrastructure, according to a DT spokesperson.

DT said the platform is aimed at any firm that wants “to remain sovereign over their valuable data but wish to benefit from the scale and innovation of Google Cloud infrastructure.”

The spokesperson notes that in the last few months, the operator has seen “a large uptick in interest” from the healthcare sector, which handles sensitive patient data, and hinted that new customers would be announced soon, such as the recent deal with University Hospital Schleswig-Holstein. 

In a similar partnership, Belgian operator Proximus has also teamed with Google Cloud to offer sovereign cloud services in Belgium and Luxembourg. In the latter market, Proximus and data centre hosting provider LuxConnect unveiled a JV called Clarence in October 2023 to deliver the sovereign cloud services.

While this year will see more sovereign cloud solutions being delivered, Nasir said the focus will shift to deployments and then onto operations. As the market develops, organizations will also gain a clearer idea of what they require from such solutions. “As we move to a more sophisticated and mature sovereign cloud market, it will be more of customers calling the shots,” he says.