Contents7
The question of digital sovereignty comes up often when we talk about AI in business, and in a binary form: either you accept entrusting everything to the big American providers, or you refuse AI. Both options are bad. We think full sovereignty is out of reach for Europe, and even more so for an SME. Selective sovereignty, on the other hand, is within reach: knowing what must stay in-house, what can go elsewhere, and how you would take back control if conditions changed. The sovereign cloud is one of its tools, useful for the data that justifies it, not for everything.
In short
European providers now hold only about 15% of the European cloud market; Amazon, Microsoft and Google hold 70% of it, according to a July 2025 measurement.
In AI, US private investment in 2024 was nearly twelve times China’s, and Europe produced 3 of the models judged notable that year, against 40 in the United States.
US law can require a provider to hand over data stored outside the United States; European law will abolish cloud provider switching fees on 12 January 2027.
A sovereign cloud is judged by the law that applies to its provider, not just by where its servers are: in France, the reference is the SecNumCloud qualification from ANSSI (France’s national cybersecurity agency), which, according to the agency itself, only addresses certain threats.
Our position: selective sovereignty, which classifies its data, prefers what can be exported and plans the exit from the start.
Before setting out our view, let us look at the figures and the two camps.
What the figures say
On the cloud, the analyst firm Synergy Research Group published on 24 July 2025 a measurement of European providers’ market share in Europe. European providers more than tripled their revenue between 2017 and 2024; but the market itself grew sixfold, to €61 billion in 2024, and it is mainly Amazon, Microsoft and Google that benefited from this growth.
of the European cloud market for European providers, against 29% in 2017: their share has held steady since 2022
for Amazon, Microsoft and Google combined
each for the two leading European providers, SAP and Deutsche Telekom
On AI, the gap is even sharper. Stanford University’s AI Index 2025 report measures private investment in AI country by country: US investment is nearly twelve times China’s, and twenty-four times the UK’s.
Private investment in AI in 2024, in billions of dollars
In the same year, again according to this report, American institutions produced 40 notable AI models, against 15 in China and 3 in Europe.
These two findings set the frame: dependence is not a hypothesis, it is the state of the market as these two sources measure it.
Position 1: dependence is a strategic risk
The first camp puts forward three arguments.
The law. A provider subject to another country’s law can be compelled by that law, including for data stored in Europe. In the United States, this is the meaning of the CLOUD Act of March 2018.
Definition
The CLOUD Act
A provider of electronic communications or cloud services subject to US law must, when required by the US authorities, hand over the data in its possession, custody or control, whether it is stored in the United States or elsewhere.
For a company that handles health data, financial data or trade secrets, the physical location of the server is therefore not enough to settle the question.
The price. When three players hold most of a market, they set the rules of the game: prices, exit terms, fees for getting your own data back. The more a company relies on services specific to one provider, the more it costs to leave. The EU Data Act tackles part of the problem: according to the European Commission, it will remove entirely the fees for switching cloud provider, data egress fees included, from 12 January 2027. Until then, providers can still charge these costs, and the migration work itself will not disappear with them.
Continuity. A service can change its terms, disappear or be restricted for commercial or political reasons. A company whose business rests on a single AI provider has no leverage if that provider changes its model or its prices overnight.
Position 2: catching up is an illusion, and the best tool remains the best tool
The second camp answers with realism.
The investment gap cannot be closed by decree. With gaps like these between the sums invested, claiming to match the big American labs in the short term is wishful thinking.
Companies want what works. An SME manager does not choose a tool for geopolitical reasons: they want it to be reliable, documented, integrated with their other software. Imposing a worse tool in the name of sovereignty means penalising your own teams.
Sovereignty has a cost. Hosting yourself takes skills, maintenance, backups. An SME without these resources can be less secure on its own server than with a big provider.
These arguments are solid. They have only one flaw: they reason in terms of all or nothing.
What we think
We run a server ourselves that hosts a dozen services: the CRM (Twenty, which we have used since early 2025), automation (n8n), audience measurement (Matomo), electronic signature, invoicing and local AI models (Ollama). We do not do it out of ideology: these tools, whose code is public, fit on a single machine, and we keep control of their data, their updates and their backups. On the other hand, we entrust to American providers what is not sensitive at all. The translation pipeline of Palmora Property, a real estate listings portal in Thailand that we operate, thus moved from DeepL, a German service, to Gemini, from Google: its cost fell by a factor of 60. For sensitive data (HR, legal, health), our routing table provides for the opposite: a model that runs on our own server with Ollama, already in production with us.
The two are not contradictory. Our position comes down to three rules:
- Classify your data before choosing your tools. Our own grid has three levels. What is public (product sheets, articles, property descriptions) can go through any good provider, at the best price. Internal non-personal material (procedures, knowledge bases) goes to a provider that commits not to retain the data or use it to train its models, a commitment to check at the time of choosing. Personal or regulated data (HR, health, legal, named customer data) stays on a server you administer, or with a European provider bound by contract.
- Prefer what can be exported. Open software, a standard format, a database you can copy: these are exits. A closed service you cannot extract anything from is a dependency, even if it is excellent.
- Plan the exit from the start. The question “how do we leave if prices double?” must be asked the day you sign, not the day prices double.
Watch out
Self-hosting is not a miracle solution
It requires tested backups, updates and someone watching. Without that, you swap a dependence risk for a risk of outage or leak. We lived through it in July 2026: a clean-up command deleted the containers of ten services on our server in one go. The data, stored in separate volumes, was saved, and our operating rules were born from it; we tell what really breaks when you back up a server of your own.
What would change our mind: the arrival of European cloud offers and AI models of equivalent level, at a comparable price, with the same ecosystem of integrations. On that day, selective sovereignty could become broader. In October 2026, we are not there.
Sovereign cloud: what SecNumCloud really guarantees
Behind the expression “sovereign cloud”, the question is first of all legal. A server installed in France is not enough: if its provider falls under US law, the CLOUD Act presented above applies to it. In France, the reference is the SecNumCloud qualification from ANSSI, the French national agency for the security of information systems. According to its page on the cloud, it makes it possible to recognise “trusted” cloud offers, whose use is recommended to protect sensitive data, against the cybercriminal threat as well as the application of extraterritorial laws.
What sets it apart from simple hosting in Europe is its criteria of immunity from non-European laws. Drawn up in 2016, the framework was updated following a circular of 5 July 2021: that update added technical and legal criteria of immunity from extra-European laws. It covers online software as well as infrastructure, and the qualification is valid for three years, with surveillance audits every year.
ANSSI’s FAQ on SecNumCloud details what the qualification requires of the provider. The agency also sets out its limits, and they matter as much as the guarantees.
What SecNumCloud requires
A head office in a Member State of the European Union
Entities located outside the Union in a minority in the capital
Customer data stored and processed in the Union, as well as the directories of administration accounts and the technical logs
Its limits, according to ANSSI
The qualification recognises a specific offer, not a provider or an infrastructure: an offer hosted on a qualified offer is not automatically qualified itself
It does not prejudge the level of security of the services the customer installs on it, a website for example
SecNumCloud “only addresses certain threats”, and using it does not exempt you from carrying out your own risk analysis before migrating
For its own digital services, the French state has made its choice. Its doctrine “Cloud au centre” (“Cloud at the centre”) requires, for each digital product that handles data of particular sensitivity, a commercial offer qualified under SecNumCloud, or holding a European qualification of at least equivalent level, and “immunised against any unauthorised access by public authorities of third states”. The data concerned is data whose breach could harm public order, public security, people’s health and lives or the protection of intellectual property.
At European level, the cybersecurity certification scheme for cloud services, called EUCS, “is not finalised to date”, according to ANSSI’s FAQ consulted in October 2026. On 17 November 2025, ANSSI and its German counterpart, the BSI, published a joint statement on cloud digital sovereignty criteria: it stresses the need for the European Union to strengthen its digital sovereignty in the face of non-European technological dependencies.
Our reading: SecNumCloud addresses the legal risk posed by the CLOUD Act, which simple hosting in Europe does not; it does not settle everything else. It replaces neither tested backups nor the exit we talked about earlier. It has its place at the third level of our grid: when personal or regulated data cannot stay on a server you administer, it is the reference for checking that a European provider is European in law too, and the first option to look at when a contract or a regulation requires it. Before choosing, check that the specific offer you have in mind appears, with its validity dates, in the catalogue of solutions qualified by ANSSI, updated at least once a month: it is the offer that is qualified, not the provider.
What it changes in practice for a company
For a company of 20 to 500 people, sovereignty does not start with a big project. It starts with an inventory:
- Where is my data? List the tools that store customer or employee data, and with whom. It is also the first criterion for deciding where to put your cloud infrastructure.
- What happens if a provider disappears tomorrow? For each critical tool, check that a full export exists and that it has already been tested.
- Which AI tasks touch sensitive data? Those are the ones that deserve an open model hosted in Europe or in-house, as detailed in the four levels of private AI in business. For some of them, a smaller model is enough and costs less: that is the subject of our Business AI: private and at the right cost section.
- Which tools could be replaced by an open version? A CRM, an automation tool or audience measurement fit on a single server, like ours, provided you handle the operation. Where to start: the tools to move off SaaS first; the other choices are in our infrastructure and cloud section.
The same logic applies to the website: a static site can be served from any host, because it is made only of files. It is a simple form of exit.
And if you want to know which of your tools would gain from coming back in-house, the audit in our Leaving SaaS offer compares what you pay today with what you will pay over three years; if the migration is not worth it, we tell you.
Frequently asked questions
Is a sovereign cloud just a server in France?
Not only. The server’s location does not protect against another country’s laws if the provider is subject to them: that is the whole point of the US CLOUD Act. ANSSI’s SecNumCloud qualification therefore also requires a head office in the European Union, non-European entities in a minority in the capital, and data stored and processed in the Union. It applies to a specific offer: it is that offer you need to check, not the provider’s name.
Is self-hosting safer than a big cloud provider?
Not automatically. It gives more control over the data: you know where it is, who accesses it and how to get out. But this control only protects you if you provide tested backups, regular updates and monitoring. Without these three things, a big provider will often be better protected than a server left to itself.
Should you give up American AI models?
No. You need to know what data you send them. For public or low-sensitivity content, the best tool available is often the right choice, and that is what we do for our translations. For personal or regulated data, an open model hosted in Europe or on your own server is a realistic option: it is the one we choose for our own sensitive data.
Can an SME really afford to be sovereign?
Completely, no. Selectively, yes: a few well-chosen open tools, on a server rented in Europe, can cost less than the subscriptions they replace, depending on the number of users and the tools involved. The real cost is in skills and maintenance: it has to be counted before deciding, as we show with the real cost of leaving SaaS over three years.
Sources
- Measurement of European providers’ market share in Europe (new tab)srgresearch.com
- AI Index 2025 report (new tab)hai.stanford.edu
- CLOUD Act of March 2018 (new tab)law.cornell.edu
- The European Commission (new tab)digital-strategy.ec.europa.eu
- Its page on the cloud (new tab)cyber.gouv.fr
- ANSSI’s FAQ on SecNumCloud (new tab)cyber.gouv.fr
- Doctrine “Cloud au centre” (new tab)numerique.gouv.fr
- A joint statement on cloud digital sovereignty criteria (new tab)cyber.gouv.fr
- The catalogue of solutions qualified by ANSSI (new tab)cyber.gouv.fr
Jim · founder of Brain Plus AI
Also in infrastructure and cloud
Choose and price8 min
Leaving SaaS: the real three-year cost for an SME
Before you drop a single subscription, you need to compare two full costs over three years, human hours included. Here is the method, line by line, and what the calculation does not see.
Choose and price9 min
Private AI in business: the four levels of control
A "private" AI is not a product, it is a degree of control over your data. We distinguish four levels, from an API used as is to a model installed on your premises, and a simple way to choose task by task.
Understand8 min The topic guide
Static site with Astro: why migrate, without losing your SEO
A static site generated by Astro replaces an ageing WordPress or Drupal without changing a single address: pages in plain HTML served by a CDN, no plugin to patch, and a publishing chain with rollback. What it changes, how the migration goes, and when not to do it.