EU awards its €180 million sovereign cloud contract to four European providers

Post Telecom (with CleverCloud and OVHcloud), StackIT, Scaleway, and Proximus (with S3NS, a Thales – Google Cloud joint venture, plus Clarence and Mistral) have won the European Commission’s six-year sovereign cloud framework contract.

The Proximus consortium’s inclusion signals that non-European technology can qualify as ‘sovereign’ under the Commission’s framework if operated within a sufficiently strict governance structure.

The European Commission has awarded its €180 million sovereign cloud tender to four European provider groups, closing a procurement process launched in October 2025 that will allow EU institutions, bodies, offices and agencies to purchase sovereign cloud services for up to six years.

The four winners are: Post Telecom, partnering with CleverCloud and OVHcloud; StackIT (the cloud brand of German retail giant Schwarz Group); Scaleway (the French cloud subsidiary of Iliad Group); and Proximus, partnering with S3NS – a joint venture between French defence and technology group Thales and Google Cloud, alongside Clarence and Mistral AI.

The decision to award four contracts in parallel is deliberate: the Commission said it structured the outcome to ensure diversification and resilience, avoiding over-reliance on a single provider.

Each winner was assessed against the Commission’s Cloud Sovereignty Framework, which measures sovereignty across eight objectives covering strategic, legal, operational, and environmental considerations, as well as supply chain transparency, technological openness, security, and compliance with EU law.

The most politically significant element of the award is the inclusion of the Proximus–S3NS consortium. S3NS is a joint venture in which Thales holds a controlling stake and Google Cloud provides the underlying infrastructure, meaning one of the four awarded sovereign cloud contracts will run on technology ultimately owned by an American company.

The Commission addressed this directly in its announcement, stating that “non-European technologies, when operated within a strict and appropriate framework, can meet the minimum level of sovereignty required.” 

This is a significant policy statement: it draws a line between sovereign ‘operation’ and sovereign ‘technology’, and concludes that the former can compensate for the latter if the governance controls are sufficient.

CISPE, the European cloud providers’ trade association, had warned before the award that the Cloud Sovereignty Framework’s scoring methodology could produce precisely this outcome.

The remaining three winners are fully European-owned. Post Telecom is Luxembourg’s state-owned telecoms operator; its partners CleverCloud (a French platform-as-a-service provider) and OVHcloud (France’s largest cloud company) bring technical depth to the consortium.

OVHcloud has separately been chosen as a subcontractor on the ECB’s digital euro project and already held a prior Commission contract.

StackIT is operated by Schwarz Digits, the technology arm of Schwarz Group, which owns Lidl and Kaufland, and has been building enterprise cloud infrastructure in Germany.

Scaleway, owned by the Iliad Group (also the parent of Free and Iliad Italia), has become one of the leading European sovereign cloud providers with GPU-heavy infrastructure serving AI workloads and a customer list that includes Mistral AI.

The Commission framed the result as validation of European cloud capability. “The success highlights the high quality of European providers, demonstrating their ability to meet the Commission’s strict criteria,” the press release states.

The tender is also positioned as a template: the Commission said it “leads by example” and is finalising an updated version of the Cloud Sovereignty Framework that member states and other Union entities can reuse for their own procurement.

In parallel, it is preparing a Tech Sovereignty package that will include the Cloud and AI Development Act (CADA), a new Open Source strategy, Chips Act 2, and a Strategic Roadmap for Digitalisation and AI in Energy.

The CADA, expected to harmonise what ‘sovereign cloud’ means across the single market, has been the subject of significant industry debate, particularly over whether it will define sovereignty in a way that effectively excludes US hyperscalers from public procurement, or allow compliant-operation models like the Proximus–S3NS structure to qualify.

The backdrop for the award is acute. US hyperscalers, AWS, Microsoft Azure, and Google Cloud, collectively account for around 70% of cloud infrastructure revenues in Europe, while European providers hold roughly 15%, according to Synergy Research.

The US CLOUD Act creates an ongoing legal tension: American law can compel US-headquartered companies to disclose data stored by their European subsidiaries, regardless of physical location.

The Commission’s framework attempts to operationalise an answer to that tension, though critics including CISPE argued before the award that the sovereignty score’s weighting, where legal jurisdiction accounts for only 10% of the total, could allow well-resourced non-EU players to score highly enough to qualify despite falling short on the most fundamental sovereignty criterion.