AWS Sovereign Cloud vs. Regional European Cloud Providers: A Privacy and Compliance Guide for 2026

The AWS European Sovereign Cloud has been live since January 2026, and one question keeps coming up from small business owners, startup founders and IT consultants alike. Is it good enough for our data, or should we just move to a European provider and be done with it?

Fair question. And the honest answer is that it depends on who’s likely to knock on your door, and what they’re allowed to ask for.

This is the European Cloud Compliance Guide I wish someone had handed me a year ago. It covers what AWS actually built, where the legal gaps are, how OVHcloud, STACKIT, Scaleway and IONOS stack up, and how to pick without needing a law degree. The short version: AWS wins on features and familiarity, European providers win on legal distance from US law, and neither is the right answer for everyone.

First, what do these terms actually mean?

A hyperscaler is a giant cloud company with data centers all over the world. Amazon Web Services, Microsoft Azure and Google Cloud are the three big ones.

Data residency is simple. It’s about where your data physically sits. If your files live on servers in Germany, you have German data residency.

Data sovereignty is trickier. It’s about whose laws can reach your data, and who can be forced to hand it over. Here’s the catch. Data can sit in Frankfurt and still be reachable by a court in Virginia if the company running the servers is American. That’s the whole fight.

So, when people ask about data residency vs data sovereignty, here’s the plain version. Residency is the address. Sovereignty is who holds the keys to the building and who can order them to open the door.

And digital sovereignty cloud is the umbrella term for cloud setups built to keep control inside Europe: the location, the staff, the legal owner and the encryption keys. Different providers cover different parts of that list, which is why you can’t just trust the label.

What did AWS actually build?

According to AWS’s launch announcement, the AWS European Sovereign Cloud became generally available on January 15, 2026. The first region sits in Brandenburg, Germany. AWS says it’s physically and logically separate from every other AWS region. In practice that means it’s its own partition (the technical label is “aws-eusc”), with its own control systems, its own billing in euros and its own support team. It’s built the same way AWS GovCloud in the US and AWS China are, if you’ve seen those.

Some details worth knowing:

• AWS set up a new German parent company with three local subsidiaries, led by EU citizens, plus an advisory board that includes independent European members.
• Day-to-day operation is meant to be handled only by EU residents located in the EU. That’s the heart of EU operational autonomy and local staff access controls. AWS says it’s moving toward EU citizens only.
• It launched with more than 90 services, including EC2, S3, Lambda, Aurora, EKS, KMS and Bedrock. Services like IAM Identity Center and Network Firewall followed in March.
• It launched with a dedicated BSI C5 Attestation report, which matters a lot if you sell to German customers. More on that below.

Does the AWS European Sovereign Cloud exempt users from the US CLOUD Act?

No. Not fully. And anyone who says otherwise is selling something.

The US CLOUD Act is a 2018 law that lets US authorities demand data from US-headquartered companies, wherever that data is stored. AWS’s European entity is German and run by EU residents, but the ultimate parent is still Amazon.com, Inc. Analysts have pointed at exactly this. AWS chose to stay an Amazon-owned business rather than hand operations to an independent European partner, so the legal question stays open.

AWS’s answer is that it’ll challenge any request that conflicts with EU law, and that the technical setup keeps data out of reach from outside the EU. That’s a real promise. It’s also a promise, not a legal shield.

Now the other side of the argument, because it’s worth being fair. This is the heart of US CLOUD Act vs. GDPR cloud compliance. GDPR’s Article 48 says a court order from a non-EU country isn’t enough on its own to force a transfer of personal data out of the EU. It generally needs an international agreement behind it. So if a US agency sent a demand to AWS’s German subsidiary, that subsidiary would be caught between two legal systems. Nobody likes that spot, and the outcome depends on the details of each case.

Is it a deal breaker? Not automatically. The European Commission’s Cloud Sovereignty Framework scores providers on eight objectives, and legal exposure to foreign law is one weighted item, not an automatic disqualifier. In June 2026 the Commission proposed the Cloud and AI Development Act, which sorts cloud services into four assurance levels for sensitive public sector data. Reporting on it says the top tiers are hard to reach for any company under US jurisdiction. But it’s only a proposal. All 27 member states still have to agree before anything binds.

So, are US hyperscalers fully compliant with European digital sovereignty? Compliant with GDPR, usually yes, if you set things up right. Fully sovereign in the strictest sense, no. Pick the standard that matches your actual risk.

How do the regional European providers compare?

Here’s where AWS vs European Cloud Providers gets interesting. The European players are all owned and headquartered in Europe, so the CLOUD Act doesn’t reach them in the same way. But they’re not carbon copies of each other.

OVHcloud (France). The biggest homegrown name, with 30+ data centers across Europe. It holds ANSSI’s SecNumCloud qualification on specific scopes, which is the French government’s tough security badge. Strong on compute, storage and managed Kubernetes. Weaker on advanced managed services and AI tooling compared with AWS.

Scaleway (France, part of the Iliad Group). Developer-friendly, cheap, and good for GPUs and AI work. It’s also SecNumCloud qualified. Free egress (the fee for moving data out) on most services is a real money saver.

STACKIT (Germany, owned by the Schwarz Group, the people behind Lidl). Ambitious and growing fast. It offers C5 attestation and managed Kubernetes, object storage and databases. SAP announced in 2025 that it would offer STACKIT as a sovereign option for its customers. The catalog is narrower than AWS, and some features are still catching up.

IONOS Cloud (Germany, part of United Internet). The price pragmatist. It has held a BSI C5 attestation since 2023, runs ISO 27001, and tends to appeal to German mid-sized companies. Fewer fancy services, but solid basics.

AWS Sovereign Cloud vs. OVHcloud / STACKIT / Scaleway: the side-by-side

	AWS European Sovereign Cloud	OVHcloud	STACKIT	Scaleway	IONOS Cloud
Home base	Germany (US parent)	France	Germany	France	Germany
Legal exposure to US law	Open question, because of the US parent	Low	Low	Low	Low
Service breadth	90+ services at launch, still growing	Broad basics, thinner advanced	Narrower, growing	Broad for developers, strong AI/GPU	Core basics
Key certifications	BSI C5 report, ISO 27001 family	SecNumCloud (specific scopes), ISO 27001, HDS	C5, ISO 27001	SecNumCloud, ISO 27001	C5, ISO 27001
Staff and operations	EU residents, moving to EU citizens	EU	EU	EU	EU
Pricing style	Published calculator, about 15% above Frankfurt	Published list prices	Published list prices	Published list prices, free egress on most services	Published list prices, aggressive on cost
Best for	AWS-heavy teams with strict control needs	Cost-aware teams, French public sector	German regulated sector, SAP shops	Startups, SaaS, AI workloads	German SMEs on a budget

What does cloud cost?

AWS publishes sovereign pricing through its own calculator, billed in euros. Hands-on testing by the AWS consultancy tecRacer found an average premium of roughly 15 percent over the Frankfurt region for equivalent services. And Frankfurt already runs somewhat above AWS’s US pricing. So you’re stacking premiums. AWS calls this “cost following” pricing, meaning prices track the cost of running in each place.

Here’s the part people miss. The server price is often the smallest line on the bill. Egress fees, support plans, managed database costs and, big one, the engineering time to move everything can swamp the difference. AWS charges around 9 cents per GB to move data out in North America, while Scaleway includes free egress on most services. If you move a lot of data, that adds up fast.

Always check current prices on each provider’s own page before you decide. They change.

Which compliance rules should you care about?

This is the practical bit. Not every rule applies to you, so find yours.

C5 Attestation (Germany). C5 is a security catalog from Germany’s federal cybersecurity agency, the BSI. If you sell to German government or large German companies, expect to be asked about it. AWS, Microsoft, Google, STACKIT, OVHcloud and IONOS all have some form of C5 attestation, and AWS says the Sovereign Cloud got its own report. Check which services are in scope, though. A badge on the provider doesn’t automatically cover every service you use.

SecNumCloud (France). This is France’s top-tier qualification from ANSSI, and it’s the one French public tenders ask for. OVHcloud and Scaleway hold it for specific offerings. The AWS European Sovereign Cloud doesn’t, as far as I could verify. If you’re chasing French government work, that’s a big deal.

DORA alignment. The Digital Operational Resilience Act has applied to EU financial firms since January 2025. It cares about how you manage your ICT suppliers, exit plans and concentration risk. Notice what it asks for. Not “use a European cloud,” but “prove you can survive losing your provider.” Both AWS and the European players can support DORA alignment, but you still need contracts, tested exit plans and clear records. A smaller European provider may make the concentration-risk conversation easier or harder depending on your setup.

GDPR and Article 48. Covered above. If you handle personal data of EU residents, this is the legal backbone for why foreign orders get complicated.

Where does encryption fit in? (XKS and CloudHSM)

If the CLOUD Act worries you, encryption keys are your best friend. If AWS can’t read your data, it can’t hand it over in readable form.

AWS has two main tools here. External Key Store (XKS) lets you keep your master keys in a hardware box outside AWS, in your own data center or with a European partner. AWS KMS then asks that outside system for permission each time. In March 2026, Eviden announced its European key management system for the AWS European Sovereign Cloud, so that route exists today.

CloudHSM is AWS’s dedicated hardware key service. Here’s a gotcha. According to AWS’s own documentation, the CloudHSM key store feature inside KMS isn’t available in the Sovereign Cloud region. So, if your plan assumed it, check before you commit. XKS with a European partner is the path to look at.

Regional providers handle this differently. Many support customer-managed keys and let you bring your own, but features vary. Ask for specifics in writing.

Where is each option weak?

AWS European Sovereign Cloud:

• The CLOUD Act question isn’t fully closed. Some European officials and analysts see “sovereign-ish” rather than sovereign.
• Two availability zones at launch, when many enterprises expect three for critical workloads.
• Fewer services than regular regions. Early hands-on reviews flagged Bedrock limited to Amazon’s own Nova models, no CloudFront until late 2026, and developer tools like the CodeBuild family not arriving soon.
• Roughly 15 percent more expensive than Frankfurt.
• No SecNumCloud.

Regional European providers: smaller service menus, fewer regions, thinner partner ecosystems, and uneven maturity. Some managed services are excellent and others are basic, so test the exact ones you need.

Neither side is perfect. You’re trading one set of problems for another.

Can government and healthcare workloads run on the AWS Sovereign Cloud?

Yes, in many cases. AWS explicitly targets government, healthcare, financial services, defense, energy and telecoms. University Hospital Essen has said it’s exploring sovereign AI for healthcare on the platform.

But “can” isn’t “should.” For sensitive national government data, your tender might demand SecNumCloud or a national equivalent, and AWS doesn’t have that. For health data in France, you’ll want a provider with HDS certification (several European providers have it). In Germany, C5 is the usual ask and AWS can meet it. Read your tender or your regulator’s guidance first, then pick.

Who should choose what?

Pick the AWS European Sovereign Cloud if:

Your team already builds on AWS and loves the tools.

You need advanced services such as machine learning, big databases or deep security tooling.

Your risk is mainly about EU residency and EU-based operations, not shielding data from US law at all costs.

You’re a bank, insurer or large enterprise with a mature cloud team and a budget to match.

Pick a regional European provider if:

Your customers or tenders require a European-owned provider or a national badge like SecNumCloud.

Your workload is mostly standard: servers, storage, databases, Kubernetes.

Cost matters, especially data transfer costs.

You want the cleanest possible answer on foreign legal access.

Skip both and go hybrid if:

You’ve got a mix. Plenty of smart teams keep ordinary workloads on a regular cloud and move only the sensitive stuff to a sovereign setup. It’s cheaper and less painful.

For IT consultants: build for portability. Stick to Kubernetes, S3-compatible storage, PostgreSQL and Terraform or OpenTofu, so a client can switch later without a rewrite.

How do you decide? A step-by-step approach

List your data. Customer records, payments, health data, employee files, plain marketing files. Not all of it needs the same protection.

Find your rules. Do you fall under DORA, NIS2, German public sector rules, French health rules? Check your contracts and ask your regulator or lawyer.

Match the badge to the need. Look up C5, SecNumCloud and ISO 27001 scopes for the exact services you’d use. Don’t settle for a logo.

Check the missing pieces. List the cloud services you depend on and confirm each exists on your shortlist. This is where AWS gaps and European gaps both bite.

Price the whole bill. Include data transfer, support, backups and migration work.

Plan your exit. Write down how you’d leave in 90 days. DORA wants this for finance, and it’s smart for everyone.

Hold your keys. Wherever you land, use customer-managed encryption for the most sensitive data.

The bottom line

So, who wins? Honestly, it depends on what you’re protecting and who you’re protecting it from.

If you want AWS’s depth and can live with an Amazon-owned operator under European management, the AWS European Sovereign Cloud is a serious, well-built option. If you need the strongest legal distance from US law, or a national badge your customers demand, a European provider is the safer pick. Most small and mid-sized businesses will land somewhere in the middle: sensitive data on a sovereign setup, everything else wherever it’s cheapest.

Whichever way you go, get your encryption keys under your own control, write down your exit plan, and test before you commit. Rules in this space are moving fast, and the EU’s proposed Cloud and AI Development Act could reshape the picture again. Check the current facts before you sign anything, and talk to a lawyer for anything high stakes. This guide isn’t legal advice.

Prices, certifications and service lists change often. Verify details on each provider’s official pages before you buy.