The hyperscalers are staying in Europe. The question is which of your workloads they will be trusted to run.

For a decade, European digital sovereignty was a policy conversation with little effect on procurement. In the last 18 months it has become a clause in cloud contracts, a question in regulator audits and a draft regulation with a vote date. The three US hyperscalers have answered with EU subsidiaries, EU-only staff and promises to fight government orders in court. Their European challengers have answered with a word: sovereignty-washing.

Both sides are arguing about the same thing, and it is not whether the hyperscalers have a future in Europe. They do. The argument is about where the line falls between the workloads a US-owned provider can run under European assurance and the ones it cannot, and who draws it. That line is being drafted now, in the Cloud and AI Development Act, and it will be set before most enterprises have finished mapping their own estates against it.

The verdict argued below: the hyperscalers keep the bulk of the European market, lose the top tier to European-owned and operated providers, and fight for the middle with subsidiaries whose claims hold for some workloads and not for others. CIOs who classify their estates before the law lands will make that choice themselves. The rest will have it made for them at a renewal.

Why is "will they leave" the wrong question?

Because the numbers do not support any other answer. The Commission's own CADA proposal states that three non-EU hyperscalers control over 70% of the European cloud market. The capital behind that position is the largest in the industry's history: AWS alone has put €7.8 billion behind its European Sovereign Cloud, Microsoft and Google have published multi-year European investment programmes, and the AI build-out has added gigawatts to the pipeline across the continent.

Forrester's call for 2026 is blunt: no European enterprise will shift entirely off AWS, Google Cloud or Azure, specific industries will migrate niche use cases, and the effect on the overall European market will be negligible in the short to medium term. Even Gaia-X, whose purpose is European alternatives, concedes the point. Its CEO Ulrich Ahle estimated at the Porto summit in November 2025 that around 90% of the market can be fully served by the hyperscalers. The remaining 10%, critical infrastructure, defence and similar, is where he says only EU-headquartered providers can deliver.

So the question is not survival. It is the shape of that 90/10 split: where the boundary sits, how it is enforced, and whether the hyperscalers' sovereign subsidiaries can move it in their favour.

What changed between 2025 and 2026?

Not GDPR. European enterprises have run on US clouds under GDPR for seven years, and in-region data residency became a standard contract term long ago. What changed is the risk category. Sovereignty moved from a compliance question with a paperwork answer to a geopolitical question with no paperwork answer.

Three events did most of the work. In June 2025 Microsoft France's legal director told a French Senate inquiry, under oath, that the company could not guarantee French data would never be handed to US authorities under a lawful order. Weeks earlier, the International Criminal Court's chief prosecutor had lost access to his Microsoft email after the US sanctioned him. Accounts differ on who pulled the plug, but the lesson European boards drew was the same: service, not just data, can be withdrawn by a decision taken outside Europe. And the transatlantic trade relationship turned adversarial, with tariffs and open threats aimed at the EU's digital rulebook, which made the dependency look like leverage.

The second-order effects followed quickly. The EU-US Data Privacy Framework survived its first court challenge in 2025 but remains one ruling away from a third Schrems moment. Public bodies in Germany, the Netherlands and Denmark opened formal programmes to reduce their dependence on US software and cloud. And boards began asking CIOs a question that did not exist in 2023: what happens to us if this provider is told, by its own government, to stop?

Can a US hyperscaler's sovereign cloud be sovereign?

For the middle of the market, yes. For the top, no, and the hyperscalers' own structures concede it.

AWS launched its European Sovereign Cloud in January 2026: an EU-incorporated subsidiary under German law, operated and staffed by EU residents, separated from AWS's global regions, backed by €7.8 billion. Microsoft's answer is layered: the EU Data Boundary, a public commitment to contest government orders for European data in court, and partner-operated clouds such as Bleu in France (Orange and Capgemini) and Delos Cloud in Germany (SAP), built on Microsoft technology but run by European companies. Google's French equivalent is S3NS, operated by Thales.

Apply a control test and the picture sorts itself. Three questions matter: who is the legal parent, who holds operational control, and who can switch the service off. On the first, every one of these offerings still has a US parent, and the CLOUD Act reaches data in a US company's possession, custody or control, which is precisely the argument over subsidiaries. On the second, the EU-staffed models are a real improvement: a US engineer cannot reach the environment without European approval. On the third, a determined US government has levers over a US parent that no subsidiary structure removes, and Microsoft said as much in the French Senate.

This is why CISPE, the association of European cloud providers, wrote to Executive Vice-President Virkkunen in March 2026 warning that CADA must not legitimise what it calls sovereignty-washing. It is why Gaia-X's CEO says services from US providers remain under American law even when operated in Europe with data stored in Europe. Both are right about the top tier. Both overreach when they apply the same verdict to every workload.

A practical point gets lost in the politics. Sovereign variants launch with a subset of the parent cloud's catalogue, lag the main regions on new services and cost more. A CIO moving a workload into one is trading features and price for a stronger legal story, and that trade only makes sense where the legal story is the point.

How will CADA sort the market into tiers, and when does it reach you?

CADA proposes to write the tiers into law. The Commission published the Cloud and AI Development Act on 3 June 2026 as the centrepiece of its Technological Sovereignty Package. Beside its capacity measures (data centre acceleration zones, strategic project status, a target of tripling EU data centre capacity by 2030) sits the part that matters here: a cloud computing sovereignty framework built on four Union Assurance Levels, set out in Article 16 and Annex II.

The levels are cumulative. Level 1 requires EU establishment, data processing inside the Union, transparency over subcontractors and baseline cybersecurity, and can be met by self-assessment. Levels 2 to 4 require independent audit, overseen by national competent authorities with a central Commission repository, and add progressively stricter conditions on where operations run, who controls them and exposure to non-EU law. Every provider wanting public sector business must hold at least Level 1. Member states and EU bodies then run risk assessments to decide which activities need higher levels, and a "Union added value" criterion enters procurement scoring.

Enterprises are not contracting authorities, so none of this binds them directly. It reaches them by inheritance. A supplier to a hospital, a ministry or a utility will be asked for proof of a level. An essential entity under NIS2 will fold the levels into its vendor risk process because its regulator will expect it to. A bank's supervisor under DORA will ask why its sovereignty tiering differs from the public sector's. Within two renewal cycles the levels become the common language for sovereignty across regulated Europe, whether the regulation names enterprises or not.

The timing is tight. The European Parliament's lead committee is due to table its draft report on 1 December 2026, with a vote planned for mid-March 2027, followed by negotiation with the Council. The framework is expected to be the main battleground, and the fight will concentrate on Levels 1 and 2, because that is where most public procurement sits and where the hyperscalers' sovereign subsidiaries need to qualify. Where the Parliament sets those two thresholds decides how much of the market the subsidiaries can serve.

Which workloads will actually move?

Fewer than the headlines suggest, and more than the hyperscalers would like. Gartner forecasts that businesses will move 20% of existing workloads off hyperscaler clouds to local providers by 2029 for sovereignty reasons, slightly more in Europe, and expects European spending on sovereign cloud IaaS to nearly double in 2026. Both are forecasts, and the growth rate comes off a small base. Anyone writing "workloads are leaving" as a present-tense fact is selling something.

The useful exercise is to map workloads to tiers, because the tier decides the provider, not the other way round.

The pattern: the sovereign tier is small by workload count and large by consequence. It is mostly data at rest, identity, recovery and sensitive inference. The compute-heavy, feature-hungry work stays where the catalogue is deepest. That is a hybrid architecture by design, and it is the architecture the hyperscalers themselves now sell, with one difference: under CADA the European layer has to be auditable, not just marketed.

Does AI make the hyperscalers more entrenched?

For training and frontier models, yes, and for several years. The GPU capacity, the model partnerships and the tooling are concentrated with the three US providers. Europe's AI gigafactories are a 2027-plus story and will serve research and selected industries before they serve the enterprise mainstream. A CIO who needs frontier models at scale in 2026 is choosing between Azure, AWS and Google Cloud, with European options for specific models and smaller workloads.

Inference is different, and it is where sovereignty bites. The data that matters in enterprise AI is not the model weights but what the enterprise feeds the model: prompts, documents, embeddings, the retrieval corpus. Running inference on regulated data inside a US-controlled environment reintroduces every exposure the sovereign tier was created to remove.

The pattern now emerging is to train and experiment where the capacity is, and to run production inference on sensitive data in European-operated facilities, increasingly inside confidential computing enclaves that keep the data encrypted while in use. CADA's capacity measures are aimed at exactly this gap, which is why the Act bundles data centre permitting with sovereignty assurance rather than treating them as separate problems.

What should a CIO do before March 2027?

Act before the text is final. The shape of the framework is already clear, and contract renewals will not wait for the Official Journal.

The verdict

The hyperscalers will run most of Europe's cloud in 2030 as they do today. They will not run its most sensitive tier, which Europe is reserving for providers it can audit and, at the top, providers it can own. Between the two sits a contested middle where the AWS and Microsoft sovereign subsidiaries are a legitimate answer for some workloads and a marketing answer for others, and where the European Parliament will set the line in 2027. The CIO's job is to know which of their workloads sits on which side of that line before someone else decides.