European organizations have to reckon with how to keep up with the modern world without sacrificing sovereignty. Geopolitical instability, tightening regulatory expectations and the rapid adoption of artificial intelligence (AI) mean that, for many organizations, sovereignty now sits alongside resilience and business continuity in board-level risk discussions. The question they can no longer defer is how to harness the opportunities of the modern cloud without surrendering control over their own data. Answering it requires honesty about what sovereignty means, and about where it can actually be found.
A definition Europe can trust
The European Commission’s forthcoming Cloud and AI Development Act (CADA) is the right vehicle for that honesty: giving Europe a shared, enforceable definition of what “sovereign” actually means. Without such a definition, the market is filled with commercial offerings that claim the sovereignty label without delivering the substance, a practice described as “sovereignty washing.” This gap has led some organizations to treat open source as the answer. But open source software is a licensing model, not an operating model, and it doesn’t settle questions about infrastructure or jurisdiction or even reliability and access. It’s not a route out of dependency, it’s a different dependency on project sponsors and code maintainers. A definition gives policymakers a way to properly assess claims of sovereignty against a consistent standard rather than taking marketing at face value.
Europe should not wait for CADA to take effect before acting, though. European cloud service providers (CSPs) have been partnering with established technology providers to deliver real sovereign capability, without rebuilding the entire technology stack from scratch.
The best time to plant the sovereign tree was 10 years ago
If Europe wants to grow its industrial base, it has to support the ecosystem as it is now, not as it may in 10 years’ time. CADA’s own roadmap assumes roughly five to seven years to triple the EU’s data-center capacity. Providers who have already built capacity by blending EU capabilities with proven non-EU technologies would have to spend the intervening years relinquishing their growth. It is scale, not a shortage of skills or innovation, that is the biggest practical obstacle facing a stronger European cloud market. This is precisely why partnership with proven technology sources deserves a central place in the sovereignty debate rather than being treated as a second-best option.
Partnership shortens that timeline considerably, letting European CSPs deliver sovereign, scaled services now instead of waiting for domestic capacity to catch up organically. In Italy, IPZS, owned by the Italian Ministry of Economy and Finance, is using this model to build a modern Digital Application Platform for the Italian EUDI wallet, a foundational EU digital identity initiative. It provides a live example of that model working in Europe today, at the scale and speed the policy window demands.
It is through scale that the local industrial base can deliver sovereign capabilities, compete, capture market share, and invest in developing and integrating home-grown technologies. Hoping for the alternative to happen, that is for a European technological stack to fully emerge and be adopted, is the equivalent of putting the cart before the horse.
The rules need to allow for a model that’s already working
Providers, such as evoila, are now operating well beyond Europe’s borders, alongside Uniserver. This shows the model working at a broader scale, combining local operational and jurisdictional control with proven technology. Sovereignty spans jurisdictional, technological, operational and supply-chain dimensions, and a partnership model can address all four while drawing on technology already proven at scale, rather than asking every layer to be rebuilt from first principles by a single European provider.
Alongside its cloud platform, developed in-house and operated from data centers in Europe under EU jurisdiction, IONOS also offers customers a dedicated VMware-based private cloud. It is also operated within the EU and designed to provide European data sovereignty and operational control.
Broadcom’s role in that model is deliberately narrow. It supplies the VMware cloud software layer to the CSP, while the CSP itself runs the infrastructure and holds the customer relationship, so that no European customer data passes through Broadcom or is subject to its access. Trust, in this model, follows the architecture rather than the brand. If CADA’s tiers implicitly assume that sovereignty can only be delivered by a fully European-built stack, CADA would shut out precisely the route that is already allowing Europe to scale fastest: partnership between local operators and proven technology providers.
The path forward
Europe does not have to choose between moving quickly and building sovereignty. The two are compatible, provided the legislation is calibrated to recognize it. As the European Parliament and European Council work on CADA, the priority should be for it to recognize and reward the partnership models already delivering sovereign capability across Europe today.
The above column is sponsor-generated content.
Disclaimer
POLITICAL ADVERTISEMENT
- The sponsor is Broadcom Inc.
- The political advertisement is linked to Broadcom’s software business and advocacy around the Cloud and AI Development Act (CADA).
More information here.