| Myth | Reality |
|---|---|
| “Sovereign cloud” means the same thing in every region and from every provider. | The EU, Gulf, and APAC have converged on three structurally different models: EU-native or EU-certified independent stacks, Gulf hyperscaler-national conglomerate joint ventures, and APAC telco- or government-operated local partnerships, each with a different risk profile. |
| Any hyperscaler region physically located inside a sovereign territory qualifies as that territory’s sovereign cloud. | The EU’s own Cloud Sovereignty Framework now grades providers on a tiered SEAL scale, and a standard regional data centre from a foreign-parented hyperscaler typically clears only the lowest tier. |
| Gulf sovereign cloud programmes are simply hyperscalers opening new regions. | Programmes such as Core42’s partnership with Microsoft and the multi-vendor Stargate UAE campus are structured as joint ventures or consortiums with majority local ownership and government-linked capital, not standard regional expansions. |
| APAC sovereignty is mostly about data residency law, with little difference in provider structure. | Several APAC markets require a locally incorporated partner to operate the hyperscaler’s stack under domestic governance, a materially different arrangement from a hyperscaler simply opening a compliant regional data centre. |
Why a Regional Comparison, Not Another Definition
Sovereign cloud as a concept, covering data residency, operational control, and legal jurisdiction, has already been defined in detail elsewhere on this site, including the technical tiers of encryption key custody and the contractual mechanisms that attempt to limit a foreign parent company’s legal exposure. That earlier piece, Sovereign Cloud: What It Means Technically and Contractually, is the right starting point if the goal is understanding what the term should mean in a contract. This article assumes that background and instead surveys what is actually on the market right now: which named providers and programmes exist in the EU, the Gulf, and APAC, how their ownership and technical structures differ, and which one a buyer in each region is realistically choosing between in late 2026.
The honest answer is that “sovereign cloud” has fractured into at least three distinct regional models rather than converging on one global standard. Each model reflects the industrial policy priorities and hyperscaler relationships specific to its region, and none of them is simply a rebadged version of another. Comparing them side by side is the only way to see what a procurement team is actually buying when a vendor uses the word “sovereign” in a regional context.
The EU Model: Certified Local Stacks, SEAL Tiers, and Licensed-Technology Joint Ventures
The European Union has moved furthest toward formalising sovereign cloud as a graded, auditable classification rather than a marketing term. In April 2026 the European Commission selected four provider groups for its sovereign cloud procurement programme, worth up to roughly €180 million over six years: a consortium of OVHcloud and Clever Cloud partnered with DEEP and POST Luxembourg, Scaleway, S3NS (a joint venture between Thales and Google Cloud, paired with Proximus), and StackIT. Under the EU’s new Cloud Sovereignty Framework, OVHcloud’s consortium, Scaleway, and StackIT reached SEAL-3, the highest available sovereignty rating, while the Proximus-S3NS consortium reached SEAL-2, one tier lower, largely because S3NS runs licensed Google Cloud technology rather than an entirely EU-native stack.
That SEAL-2 versus SEAL-3 distinction is the clearest illustration of how the EU market has split into two structurally different approaches. The first is the EU-native stack, exemplified by OVHcloud, Scaleway, and StackIT: companies incorporated in the EU, running software they own outright, with no US or other foreign parent company anywhere in the ownership chain. The second is the licensed-technology joint venture, exemplified by S3NS and by Bleu, the France-focused venture combining Microsoft technology with Orange and Capgemini as the local operating and governance partner. These joint ventures give customers a locally incorporated contracting entity and local operational control, but the underlying software stack is still licensed from a US hyperscaler, which is why EU regulators rate them a tier below fully independent providers on strategic resilience during a diplomatic or legal crisis with the licensor’s home government.
AWS has taken a third path that does not fit neatly into either category: the AWS European Sovereign Cloud, an independent cloud physically and logically separate from AWS’s global infrastructure, with its own identity, billing, DNS, and certificate authority systems, launched in January 2026. It offers deeper technical isolation than either Bleu or S3NS, but AWS itself remains a US-incorporated parent company, so it does not clear the same strategic-independence bar as an EU-native provider under the Commission’s framework, regardless of how thorough its technical separation is.
| EU provider or programme | Ownership structure | EU SEAL tier (2026 framework) |
|---|---|---|
| OVHcloud / Clever Cloud (with DEEP, POST Luxembourg) | EU-native, no foreign parent, EU-owned stack | SEAL-3 (highest) |
| Scaleway | EU-native, French-owned, own stack | SEAL-3 |
| StackIT | EU-native, German-owned, own stack | SEAL-3 |
| S3NS (Thales + Google Cloud, with Proximus) | EU-incorporated joint venture on licensed US technology | SEAL-2 |
| Bleu (Microsoft + Orange + Capgemini) | French joint venture operating licensed Microsoft technology | Not yet SEAL-rated at highest tier; French trust cloud designation |
| AWS European Sovereign Cloud | US-parented, independent technical stack within the EU | Below top strategic-independence tier despite technical isolation |
Gartner’s forecast puts European sovereign cloud IaaS spending at roughly $12.6 billion in 2026, up 83 percent from $6.9 billion in 2025, which signals that this is no longer a niche public-sector procurement category but a fast-growing commercial segment. The practical trade-off for buyers is consistent across every EU option: EU-native providers offer the strongest jurisdictional independence but a narrower catalogue of managed AI and platform services, while the AWS, Microsoft, and Google joint ventures offer a far deeper service catalogue at the cost of a still-present, if reduced, dependency on a foreign licensor.
The Gulf Model: Hyperscaler-National Conglomerate Joint Ventures
Gulf sovereign cloud has taken a visibly different shape from the EU’s certified-stack model. Rather than grading independent local providers on a sovereignty scale, the UAE and Saudi Arabia have built their programmes around large joint ventures that pair a US hyperscaler’s technology with a state-linked national conglomerate that holds majority governance and infrastructure control.
The clearest example is Core42, the AI and cloud arm of G42, the Abu Dhabi-based technology group. Microsoft partnered with Core42 to deliver a sovereign cloud platform running on Khazna’s data centre infrastructure, itself a joint venture between G42 and telecom operator e&. Microsoft’s roughly $1.5 billion investment in G42 gave it a minority stake in the Emirati group rather than outright control, which is precisely the point of the model: the national partner remains the majority governance and infrastructure owner, while the hyperscaler supplies the software layer and cloud expertise under a licensing and operating arrangement. This is structurally closer to Bleu’s Microsoft-Orange-Capgemini model in the EU than to a standard hyperscaler region, but with a government-linked conglomerate playing the local partner role instead of a telecom-and-consulting pairing.
The UAE has since layered a second, even larger initiative on top of the Core42 relationship: Stargate UAE, a planned five-gigawatt AI data-centre campus in Abu Dhabi announced in 2025 as a multi-party alliance including G42, OpenAI, Oracle, Nvidia, Cisco, and SoftBank, with an initial 200-megawatt phase targeted for 2026. Stargate UAE is less a sovereign cloud product in the SEAL-framework sense and more a sovereign AI compute campus, but it follows the same governance logic: a UAE national entity anchors the project, and multiple foreign technology providers plug into locally controlled infrastructure rather than operating a fully independent regional footprint.
Saudi Arabia has pursued a parallel but separately structured path. Microsoft completed construction of its dedicated Saudi Arabia cloud region in December 2024, with the region going live through 2026, operating as a standard Microsoft-owned regional expansion rather than a joint venture. Alongside this, Oracle has partnered with Saudi telecom operator stc to deliver regulated, AI-ready cloud platforms under local jurisdiction, mirroring the joint-venture pattern seen with Core42 in the UAE but with a telecom operator rather than a diversified technology conglomerate as the anchor partner.
The distinguishing feature of the Gulf model, compared with both the EU and APAC, is the scale of state-linked capital involved and the explicit pairing of cloud sovereignty with sovereign AI compute ambitions. Where EU sovereign cloud procurement is largely driven by public-sector compliance and legal risk mitigation, Gulf programmes are just as often framed around building independent national AI infrastructure capacity, with cloud sovereignty as one component of a much larger industrial strategy.
Three regional sovereign cloud ownership models
The EU model splits into EU-native independent stacks (OVHcloud, Scaleway, StackIT) and licensed-technology joint ventures (Bleu, S3NS), rated on a formal SEAL tier scale. The Gulf model centres on hyperscaler partnerships with state-linked national conglomerates that retain majority governance, such as Microsoft with Core42 in the UAE and Oracle with stc in Saudi Arabia. The APAC model is the most fragmented, ranging from locally incorporated operating partners running a hyperscaler’s stack under domestic governance to standard hyperscaler regions built purely to satisfy data residency law.
The APAC Model: Local Operating Partners and Fragmented Regulatory Drivers
APAC sovereign cloud is the least standardised of the three regions, largely because the underlying regulatory drivers differ sharply from market to market. Australia, Singapore, Japan, and South Korea have each introduced or tightened data residency and critical-infrastructure rules that push cloud sovereignty up the procurement agenda, while India’s Digital Personal Data Protection Act adds a distinct compliance layer that is reshaping how global providers structure their local operations.
The dominant structural pattern replicated across several APAC markets is the local operating partner model, the same underlying idea as Bleu in the EU or Core42 in the UAE: a locally incorporated entity operates a hyperscaler’s technology stack, typically Azure, under domestic ownership and governance, rather than the hyperscaler running the region directly. This gives regulators and public-sector customers a local point of legal and operational accountability without requiring the hyperscaler to build an entirely independent regional stack from scratch, which is a heavier lift than most APAC markets’ compliance regimes currently demand.
Telecom operators have positioned themselves as natural sovereign infrastructure partners across the region, extending the edge and mobile-core investments they had already made into a broader sovereign cloud and AI narrative. SK Telecom in South Korea, NTT DOCOMO in Japan, Singtel in Singapore, and Reliance Jio in India have all built out local edge and multi-access compute platforms that increasingly get positioned alongside sovereign cloud and sovereign AI messaging, even where the underlying commercial arrangement is closer to a distribution or infrastructure partnership than a full joint-venture operating model. This telco-anchored pattern is distinct from both the EU’s certified-provider approach and the Gulf’s conglomerate-anchored joint ventures, reflecting how deeply embedded national telecom incumbents already are in APAC digital infrastructure policy.
Market growth projections back up how quickly this is moving: APAC is forecast to be the fastest-growing sovereign cloud region globally, with a compound annual growth rate of roughly 24.7 percent from 2026 through 2033, driven primarily by the wave of new data sovereignty legislation working through legislatures across the region rather than by a single dominant commercial model. Buyers evaluating APAC options should expect considerably more country-by-country variation than in the EU or Gulf, and should verify the specific operating structure, standard regional data centre, locally operated partner stack, or telco-anchored offering, on a market-by-market basis rather than assuming consistency across the region.
| Region | Primary structural model | Key named examples |
|---|---|---|
| EU | Certified independent stacks and licensed-technology joint ventures, graded on a formal SEAL tier scale | OVHcloud, Scaleway, StackIT, S3NS, Bleu, AWS European Sovereign Cloud |
| Gulf (UAE, Saudi Arabia) | Hyperscaler partnerships with state-linked national conglomerates retaining majority governance | Core42 with Microsoft, Stargate UAE, Oracle with stc |
| APAC | Locally incorporated operating partners and telco-anchored infrastructure, varying by country’s data residency law | Local Azure operating partners, Microsoft Saudi-style direct regions, telco edge-to-sovereign narratives from SK Telecom, NTT DOCOMO, Singtel |
Reading the Assurance Gap Between Regions
A recurring pattern across all three regions is that the depth of technical isolation and the strength of legal independence do not always move together, and a buyer optimising for one can inadvertently under-deliver on the other. AWS’s European Sovereign Cloud demonstrates this clearly: it has arguably the deepest technical stack separation of any offering surveyed here, yet it sits below EU-native providers on strategic independence purely because of its US parent company. Conversely, a locally incorporated APAC operating partner may satisfy every data residency and governance requirement on paper while still running on infrastructure and code that is, underneath the local operating layer, identical to the hyperscaler’s global stack elsewhere.
This gap matters most for workloads with genuinely high jurisdictional sensitivity, such as government records, defence-adjacent data, or critical infrastructure telemetry, where the question is not “does this satisfy my region’s current data residency law” but “what happens if my region’s relationship with the technology licensor’s home government deteriorates.” For most commercial workloads, the local operating partner or joint-venture model is a proportionate answer. For the smaller set of genuinely high-stakes workloads, the EU-native stack, the fully separated AWS stack, or the equivalent in a given region is the more defensible choice, even at the cost of a narrower service catalogue.
Common mistake
Treating “sovereign cloud is available in my region” as a single fact rather than checking which of the three structural models the specific offering follows. A locally operated joint venture running licensed foreign technology, a state-backed national conglomerate partnership, and a fully independent EU-native stack all get marketed under the same “sovereign cloud” label in their respective regions, but they carry meaningfully different jurisdictional risk profiles, and assuming regional availability alone satisfies a compliance requirement has led some procurement teams to select an offering that does not match the assurance tier their workload actually needs.
What worked
Organisations that ran a structured comparison across all three regional models, rather than defaulting to whichever provider already had a regional presence, matched each workload to the specific ownership structure it required: EU-native SEAL-3 providers for the smallest set of maximum-sensitivity EU workloads, joint-venture models like Bleu, Core42, or a local APAC operating partner for the much larger set of workloads needing local governance without full technical independence, and standard hyperscaler regions for workloads where data residency alone was the actual legal requirement. This avoided both overpaying for unnecessary independence and underdelivering on genuine jurisdictional risk.
Choosing Between Regional Offerings in Practice
A practical evaluation should start by identifying which of the three structural models a specific candidate offering actually follows, since the label “sovereign cloud” is applied to all three without distinction in vendor marketing. For EU workloads, this means checking a provider’s SEAL tier and asking directly whether the underlying technology stack is EU-owned or licensed from a foreign parent. For Gulf workloads, it means understanding exactly how governance and majority ownership are split between the national conglomerate and the hyperscaler partner in the joint venture. For APAC workloads, it means confirming whether the “sovereign” offering in a given country is a locally incorporated operating partner, a standard regional data centre marketed with sovereignty language, or a telco-anchored infrastructure partnership, since all three exist simultaneously across different APAC markets.
Service catalogue breadth is the most common trade-off buyers underestimate. EU-native providers and Gulf national-conglomerate joint ventures typically offer a narrower set of managed AI and platform services than a hyperscaler’s global regions, because building out an equivalent catalogue independently takes years. Workloads that depend heavily on a specific hyperscaler-exclusive managed service, such as a particular foundation model API, may simply not have a sovereign-tier equivalent available yet in every region, forcing the same deliberate trade-off between capability and assurance tier that applies to sovereign cloud procurement generally.
- SEAL tier
- The European Union’s Cloud Sovereignty Framework rating scale, used to grade providers on independence from foreign legal and technical dependency, with SEAL-3 as the highest tier reached by OVHcloud, Scaleway, and StackIT in 2026.
- Joint venture sovereign cloud
- A structural model in which a hyperscaler licenses its cloud technology to a locally incorporated or state-linked partner, which retains governance and operational control, exemplified by Bleu in France and Core42 in the UAE.
- Local operating partner
- An APAC-common structure where a domestically owned entity operates a hyperscaler’s technology stack under local governance, giving regulators a local point of accountability without requiring an independent technical stack.
- Sovereign AI compute campus
- Large-scale, state-anchored data centre and AI infrastructure projects, such as Stargate UAE, that combine sovereign cloud principles with national AI capacity-building ambitions.
- Strategic independence
- A provider’s degree of insulation from a foreign government’s legal or diplomatic leverage over its parent company, distinct from and often lower than its technical isolation score.
Key Takeaways
- Sovereign cloud has fractured into three distinct regional models: EU certified independent or licensed-joint-venture stacks, Gulf hyperscaler-national conglomerate joint ventures, and APAC local operating partnerships.
- The EU’s 2026 Cloud Sovereignty Framework grades providers on a SEAL tier scale, with OVHcloud, Scaleway, and StackIT reaching the top SEAL-3 tier and joint ventures like S3NS rated one tier lower.
- AWS’s European Sovereign Cloud offers the deepest technical stack separation of any surveyed offering but still ranks below EU-native providers on strategic independence due to its US parent company.
- Gulf sovereign cloud, led by Core42’s partnership with Microsoft and the multi-party Stargate UAE campus, pairs hyperscaler technology with majority-owned national conglomerate governance.
- Saudi Arabia has pursued both a direct Microsoft regional build and an Oracle-stc joint venture, showing that even within one Gulf country, multiple sovereign models can coexist.
- APAC is the least standardised region, ranging from locally incorporated Azure operating partners to standard hyperscaler regions marketed with sovereignty language, and is forecast to grow fastest at roughly 24.7 percent CAGR through 2033.
- Buyers should identify a candidate offering’s actual structural model, EU-native, joint venture, or local operating partner, rather than assuming regional availability alone satisfies a specific jurisdictional requirement.
FAQs
What is the main difference between EU and Gulf sovereign cloud models?
EU sovereign cloud is increasingly graded on a formal SEAL tier framework distinguishing EU-native independent stacks from licensed-technology joint ventures, while Gulf sovereign cloud centres on joint ventures between hyperscalers and state-linked national conglomerates like G42’s Core42, which retain majority governance over shared infrastructure.
Is OVHcloud considered more sovereign than AWS’s European Sovereign Cloud?
Under the EU’s Cloud Sovereignty Framework, yes, on strategic independence: OVHcloud reached the top SEAL-3 tier as an EU-native, EU-owned provider, while AWS’s European Sovereign Cloud, despite deep technical stack separation, remains below that tier because AWS’s parent company is US-incorporated.
What is Core42 and how does it relate to Microsoft’s Gulf sovereign cloud strategy?
Core42 is the AI and cloud arm of G42, the Abu Dhabi technology group, and it partners with Microsoft to deliver a sovereign cloud platform on Khazna’s infrastructure. Microsoft holds a minority investment stake, while Core42 and its parent G42 retain majority governance and operational control.
Is Stargate UAE a sovereign cloud provider?
Stargate UAE is better described as a sovereign AI compute campus than a sovereign cloud provider in the strict SEAL-framework sense. It is a multi-party, UAE-anchored data centre initiative involving G42, OpenAI, Oracle, Nvidia, Cisco, and SoftBank, combining sovereign infrastructure principles with national AI capacity-building.
How does APAC sovereign cloud differ from country to country?
APAC has no single dominant model. Some markets rely on locally incorporated partners operating a hyperscaler’s stack under domestic governance, others use standard hyperscaler regions built primarily to satisfy data residency law, and several lean on telecom operators positioning their existing edge infrastructure as sovereign-adjacent.
Why did S3NS receive a lower SEAL tier than OVHcloud under the EU framework?
S3NS is a joint venture between Thales and Google Cloud running licensed Google technology, which the EU’s framework rates as less strategically independent than an EU-native provider like OVHcloud that owns its stack outright with no foreign parent company in its ownership chain.
Do sovereign cloud joint ventures fully remove foreign legal exposure?
No. Joint ventures such as Bleu, S3NS, or Core42 reduce exposure by interposing a locally incorporated or state-linked operating entity, but the underlying technology is still licensed from a foreign parent company, which is why these models are typically rated below fully independent, foreign-parent-free providers on strategic independence.
Which region is growing fastest in sovereign cloud spending?
APAC is forecast to be the fastest-growing sovereign cloud region globally, with a projected compound annual growth rate of roughly 24.7 percent from 2026 through 2033, driven by a wave of new data sovereignty legislation across multiple APAC markets rather than by one dominant commercial model.
References
- LeMagIT, “Cloud souverain : Bruxelles sélectionne OVHcloud, Scaleway, et S3NS,” lemagit.fr
- Julien Simon, “Two Sovereign Clouds, One Legal Wall,” medium.com
- CloudNews, “OVHcloud leads the new European cloud sovereignty ranking by comparison.cloud,” cloudnews.tech
- Data Center Dynamics, “Microsoft and Core42 to build sovereign cloud and AI infrastructure for Abu Dhabi,” datacenterdynamics.com
- G42, “Global Tech Alliance Launches Stargate UAE,” g42.ai
- Telecom Review Asia, “APAC Telcos Are Shaping the Future of National Cloud and AI Sovereignty,” telecomreviewasia.com
- Grand View Research, “Sovereign Cloud Market Size, Share | Industry Report,” grandviewresearch.com
Regional sovereignty decisions increasingly sit alongside broader platform strategy questions covered in Cloud-Based Software in 2025: Growth and Adoption by the Numbers and The Future of Cloud Computing: Predictions for 2025 and Beyond. Regulatory comparisons across regions follow a similar structure to Global AI Ethics Standards: Comparing EU, US, and Asia-Pacific Approaches, and organisations running sovereign infrastructure across multiple regions should also review Mastering Orchestration: The Competitive Edge in 2026 for coordinating workloads across these differing regional models.
