The EU has granted its €180 million sovereign cloud contract.

      Post Telecom (in collaboration with CleverCloud and OVHcloud), StackIT, Scaleway, and Proximus (teaming up with S3NS, a joint venture between Thales and Google Cloud, as well as Clarence and Mistral) have been awarded the European Commission's six-year sovereign cloud framework contract. The involvement of the Proximus consortium indicates that technology from outside Europe can be considered ‘sovereign’ under the Commission’s guidelines if it adheres to a sufficiently stringent governance framework.

      The European Commission has allocated its €180 million sovereign cloud tender to four European provider groups, concluding a procurement process initiated in October 2025, which will enable EU institutions, bodies, offices, and agencies to acquire sovereign cloud services for a duration of up to six years. The awarded groups include: Post Telecom, in partnership with CleverCloud and OVHcloud; StackIT (the cloud division of German retail giant Schwarz Group); Scaleway (the cloud subsidiary of France's Iliad Group); and Proximus, collaborating with S3NS—a joint venture between French defense and technology firm Thales and Google Cloud, along with Clarence and Mistral AI.

      The decision to grant four contracts simultaneously is intentional: the Commission stated it structured the outcome to promote diversification and resilience, preventing dependency on a single provider. Each recipient was evaluated based on the Commission’s Cloud Sovereignty Framework, which assesses sovereignty across eight objectives that include strategic, legal, operational, and environmental aspects, as well as supply chain transparency, technological openness, security, and compliance with EU laws.

      The most politically significant aspect of this award is the selection of the Proximus–S3NS consortium. S3NS is a venture where Thales holds the majority stake, and Google Cloud supplies the foundational infrastructure, implying that one of the awarded sovereign cloud contracts will utilize technology ultimately owned by an American firm. The Commission directly addressed this concern in its announcement, clarifying that “non-European technologies, when managed within a strict and appropriate framework, can achieve the minimum level of sovereignty required.” This represents an important policy declaration, distinguishing between sovereign ‘operation’ and sovereign ‘technology’, and asserting that strong governance can compensate for the latter.

      CISPE, the European cloud providers' trade association, had cautioned prior to the award that the scoring methodology of the Cloud Sovereignty Framework could lead to such an outcome. The other three winners are entirely European-owned. Post Telecom is Luxembourg’s state-owned telecom operator; its partners CleverCloud (a French platform-as-a-service provider) and OVHcloud (France’s largest cloud company) enhance the consortium’s technical capabilities. OVHcloud has also been selected as a subcontractor for the ECB’s digital euro initiative and previously held a contract with the Commission. StackIT is operated by Schwarz Digits, the technology division of the Schwarz Group, which owns Lidl and Kaufland, and has been developing enterprise cloud infrastructure in Germany. Scaleway, owned by the Iliad Group (also the parent of Free and Iliad Italia), has emerged as a leading European sovereign cloud provider, featuring GPU-intensive infrastructure for AI workloads and servicing a clientele that includes Mistral AI.

      The Commission framed the outcome as a validation of European cloud capabilities. “The achievement highlights the high quality of European providers, showcasing their competency to meet the Commission’s stringent standards,” states the press release. The tender is also promoted as a model: the Commission noted it “leads by example” and is finalizing an updated version of the Cloud Sovereignty Framework for member states and other Union entities to adopt for their procurement processes. Additionally, it is drafting a Tech Sovereignty package that will include the Cloud and AI Development Act (CADA), a new Open Source strategy, Chips Act 2, and a Strategic Roadmap for Digitalization and AI in Energy.

      CADA, which is expected to standardize the definition of ‘sovereign cloud’ across the single market, has sparked significant industry discussion, particularly regarding whether it will establish sovereignty in a manner that effectively excludes US hyperscalers from public procurement or permit compliant-operation models like that of Proximus–S3NS to qualify.

      The context surrounding the award is critical. US hyperscalers such as AWS, Microsoft Azure, and Google Cloud collectively represent about 70% of cloud infrastructure revenues in Europe, while European providers account for roughly 15%, according to Synergy Research. The US CLOUD Act introduces an ongoing legal conflict: American law can compel US-based firms to disclose data stored by their European branches, irrespective of physical location. The Commission’s framework seeks to operationalize a solution to this conflict, although critics, including CISPE, argued beforehand that the sovereignty score’s factors, where legal jurisdiction comprises only 10% of the total score, might enable well-resourced non-EU entities to achieve sufficient scores despite not meeting the most fundamental sovereignty requirements.