Germany is moving from debating digital sovereignty to funding actual infrastructure and platforms. The federal government has awarded a roughly €250 million AI cloud infrastructure contract tied to the so-called Deutschland-Stack, split between T-Systems and SAP on one side and a second group made up of SVA, Schwarz Digits, and Codesphere. The move coincides with regional projects to replace proprietary software and with a different approach altogether: clouds run by European companies that keep US hyperscaler technology underneath.
German digital sovereignty in 30 seconds
- Germany has awarded roughly €250 million for a sovereign cloud platform for government AI services.
- T-Systems and SAP account for about 70% of the contract; SVA, Schwarz Digits, and Codesphere the remaining 30%.
- Schleswig-Holstein has already migrated nearly 44,000 mailboxes, and around 80% of its workstations now run LibreOffice.
- Thales is preparing a separate, independently operated sovereign cloud in Germany, built on Google Cloud technology.
- The projects show that “sovereign cloud” can describe architectures with very different degrees of technological dependency.
The comparison is especially interesting because Germany is testing several answers to the same question at once: what does digital sovereignty actually mean?
One interpretation seeks to control infrastructure, software, data, and operations through European companies. Another accepts technology from a US provider as long as operations, keys, access, and jurisdiction stay under European control.
Both can be presented as sovereign, but they don’t provide the same kind of independence — a distinction that also runs through Microsoft’s own attempt to sell European sovereignty through a capacity deal with Mistral.
Deutschland-Stack: €250 million to put sovereignty into production
The Deutschland-Stack is meant to provide a common technology architecture for building digital services and AI applications under German and European requirements.
The roughly €250 million award is a significant step because it turns those principles into operational infrastructure, echoing how other European players such as Nebul are betting on sovereign AI cloud capacity of their own.
The contract was split between two groups. T-Systems and SAP lead the main share, at around 70%, while a second consortium made up of SVA, Schwarz Digits (through STACKIT), and Codesphere handles roughly the remaining 30%.
The absence of the big US hyperscalers among the winning bidders is one of the most notable elements of the project.
The approach includes requirements such as Zero Trust architecture, key control through Bring Your Own Key (BYOK) models, open standards, and the use of technologies that reduce dependency on any single vendor.
But there’s another related piece that shouldn’t be conflated directly with this award.
Deutsche Telekom is building an Industrial AI Cloud in Munich together with NVIDIA and SAP. This infrastructure was presented as part of Germany’s strategy to provide local AI capacity and includes around 10,000 NVIDIA GPUs. T-Systems frames it within its broader Deutschland-Stack vision.
So those 10,000 accelerators shouldn’t simply be read as the hardware bought through the €250 million federal contract. They’re related initiatives within Germany’s sovereign infrastructure strategy, but not exactly the same project.
That distinction matters because the Deutschland-Stack isn’t just a data center full of GPUs. It aims to cover different infrastructure and platform layers needed to build and run digital services.
Schleswig-Holstein shows sovereignty can also start on the desktop
Germany’s strategy has another, much more everyday example.
The state of Schleswig-Holstein has spent time reducing its reliance on Microsoft through a migration to open technologies.
By late 2025, the regional government reported that around 80% of its workstations were already using LibreOffice as the standard office suite.
The process has also touched email.
Nearly 44,000 mailboxes had been moved to Open-Xchange, as part of a strategy to gradually replace different proprietary components. The regional government put the annual licensing savings from its open-source strategy at more than €15 million at the time.
This case helps widen the concept of sovereignty.
Having a data center located in Europe doesn’t count for much if much of an administration’s day-to-day operation still depends on formats, platforms, identities, and tools it has little say over.
Schleswig-Holstein is acting precisely on that layer.
The decision doesn’t mean all US software will disappear immediately, either. Migrating tens of thousands of employees requires document compatibility, training, adapting internal applications, and specific handling for departments that depend on integrations built around Microsoft Office.
The regional government itself acknowledges that the remaining 20% needs different adaptation paths.
In this case, sovereignty looks less like a political statement and more like years of fairly unglamorous migrations.
Thales offers another answer: Google technology under European control
Germany is simultaneously seeing a different model emerge.
Thales announced an agreement with Google Cloud in May to build a new sovereign German cloud offering aimed especially at the public sector and regulated industries.
The architecture is interesting because it separates platform ownership and operation from where the technology comes from.
The infrastructure will be managed by a new German company fully owned and controlled by Thales. The company says it will have local staff and will be legally and operationally independent from Google Cloud.
But the underlying cloud technology comes from Google.
The goal is to provide hyperscale platform capabilities while keeping sensitive data and operations under a European entity and shielding them from the reach of extraterritorial legislation.
The service is currently in preview, and Thales expects to reach general availability before the end of 2026. It’s also designed to meet German requirements such as C5 and the new C3A framework.
An inevitable question comes up here.
Is this architecture as sovereign as a platform whose software, operations, and infrastructure depend exclusively on European vendors?
It depends on which sovereignty you’re measuring.
S3NS is not the same as PREMI3NS
The relationship between Thales and Google in France helps make sense of the German model, and it also clears up two names that often get confused: S3NS and PREMI3NS.
S3NS is the French company created within the Thales–Google Cloud alliance.
PREMI3NS is the product.
More specifically, PREMI3NS is the Cloud de Confiance offering operated by S3NS, built on Google Cloud technologies and qualified under SecNumCloud 3.2 by France’s national cybersecurity agency, ANSSI.
The new German cloud will follow an equivalent technology and operating model, but through a new German entity owned by Thales.
Thales also wants to connect both regions to offer disaster recovery between France and Germany while keeping the corresponding sovereignty controls in place.
So simply saying “Thales uses Google Cloud” doesn’t fully describe the architecture.
But claiming Google disappears from the equation entirely wouldn’t be accurate, either.
The US vendor still provides a core part of the technology the service runs on.
Sovereignty has several layers
Germany’s different projects show why it’s hard to answer with a simple yes or no when a company claims to have a sovereign cloud.
There are at least five different questions.
Who owns the physical infrastructure? Who operates the servers? Who controls the cryptographic keys? Who develops the software? And what would happen if one of the vendors disappeared tomorrow?
A service can keep its data exclusively in Germany while still depending technologically on US software.
Another can use open European software while running part of its infrastructure on components manufactured in the United States or Asia.
Even Germany’s AI infrastructure inevitably depends on NVIDIA for much of its acceleration capacity.
That’s why sovereignty doesn’t necessarily mean self-sufficiency.
The practical question is deciding which dependencies are acceptable and which ones could compromise an organization’s or a country’s ability to keep operating autonomously.
From that angle, the Deutschland-Stack model and the Thales-Google one answer different priorities.
The first tries to build more layers through European vendors and open standards. The second seeks to keep Google Cloud’s technological capabilities while putting legal, operational, and technical barriers between the hyperscaler and sensitive data.
There’s no need to call one sovereign and the other not.
It makes more sense to talk about degrees and dimensions of sovereignty.
Europe will have to decide how much control it actually wants
Germany’s debate foreshadows a discussion that will likely spread across Europe.
For years, cloud sovereignty has been associated mainly with where the data sits.
That’s no longer enough.
An application can store all of its data in Frankfurt and still depend entirely on a foreign vendor for identity, APIs, updates, orchestration, underlying software, and administration.
The opposite can also happen: using open European software on hardware designed and manufactured outside the continent.
The real question is what happens when one of those relationships breaks down.
Can you switch vendors? Can the service keep running? Are there open formats to get the data back? Who controls the keys? Can a foreign company technically access the infrastructure? Does extraterritorial legislation apply? Is there European staff capable of running the platform independently?
Those questions measure sovereignty far better than a data center’s mailing address does.
Germany is testing several answers at once.
The Deutschland-Stack tries to increase the weight of European vendors and technologies. Schleswig-Holstein is acting directly on desktop software dependency. Thales is trying to build a legal and operational boundary around Google Cloud technology.
All three models can increase autonomy compared with the previous situation.
But they do it in different ways.
The question now facing Germany, Spain, and the rest of Europe isn’t simply whether they need a sovereign cloud.
It’s more specific than that: which layers they consider strategic, and which dependencies they’re willing to keep accepting.
Frequently asked questions
What is the Deutschland-Stack?
It’s a German initiative meant to provide a sovereign digital architecture based on European standards for public and enterprise services. One of its pieces is the AI cloud infrastructure awarded for roughly €250 million.
Who is involved in Germany’s sovereign AI cloud?
The contract is split mainly between T-Systems and SAP, with around 70%, and a second group made up of SVA, Schwarz Digits, and Codesphere, with roughly 30%.
What’s the difference between S3NS and PREMI3NS?
S3NS is the French company tied to Thales and Google Cloud; PREMI3NS is its trusted cloud offering, built on Google Cloud technology. PREMI3NS received SecNumCloud 3.2 qualification from ANSSI in 2025.
Can a cloud built on Google Cloud be considered sovereign?
It can meet certain sovereignty criteria if there’s legal and operational separation, local control of data, keys and infrastructure, and protection against extraterritorial access. But there will still be a technological dependency on Google, so its degree of autonomy differs from a platform built entirely on technologies controlled in Europe.
