Infrastructure and governance for European digital sovereignty

No longer just an ideological issue, nor a defensive response to geopolitical tensions: digital sovereignty has become a central economic variable, closely linked to the structured use of new technologies as an engine of growth. This is the basic thesis that emerges from the report 'Digital Innovation with Control: Clearing the Cloud' (carried out by Implement Consulting Group on behalf of Google Cloud), a study that quantifies at EUR 1,200 billion the potential increase in European GDP linked to the adoption of the cloud and artificial intelligence and that attributes to the AI value chain a contribution of around EUR 200 billion by 2034, with three quarters of this figure coming from applications and services.

For this forecast to materialise, however, there is an infrastructure condition to be met. To support the demand for computing, data analysis and the distribution of advanced digital services, Europe would have to triple the capacity of its data centres over the next five to seven years, mobilising investments estimated at EUR 400 billion. A goal that is difficult to achieve, the report goes on to say, without a more harmonised regulatory environment that stimulates spending, reduces regulatory fragmentation between member states and, not least, attracts capital. The key message that the experts send out to companies and governments is therefore very explicit: digital sovereignty does not coincide with technological autarky, but rather stems from the balance between access to the most advanced AI solutions and security, between cyber resilience and the sustainability of large hyperscale data centres, all under the umbrella of autonomy based on clear rules. In other words, in an open market, the conditions must be created to create an ecosystem in which innovation, control, responsibility and governance converge.

In Italia, the sovereign cloud has now entered the strategic plans of enterprises and this is also confirmed by the latest data processed by the Politecnico di Milano, which reflect a phase marked by a more selective approach of companies and more conscious choices on where to place critical workloads, based on risk level, data value and compliance requirements. It is against this backdrop that the strong growth of the private cloud (compared to a market that in 2025 as a whole grew by 20% to exceed EUR 8.1 billion) fuelled by the demand for greater control over data and the emergence of hybrid (adopted by 87% of large companies) and multi-cloud architectures are finding ground. Moreover, the phenomenon of 'cloud repatriation' (although still limited in numbers) should not go unnoticed, given that one third of organisations are considering selective repatriation of workloads, especially the most sensitive ones. Digital sovereignty, and the opinions of various players converge on this concept, is increasingly a determining factor in the technological strategies of companies, and although there is no single approach to be adopted, the gradual rise of the 'sovereign-by-design' model, according to which regulatory compliance (Nis2, Dora, AI Act) is transformed into an architectural principle and not an ex post constraint, is evident.

The pressure on digital sovereignty, however, has produced tangible effects on the strategies of the Big Techs, united by the need to adapt the global cloud to European demands. Let us quickly review their moves: Amazon Web Services recently opened the European Sovereign Cloud in Germany, an independent cloud, physically and logically separate from the other Aws regions, with a planned investment of more than EUR 7.8 billion by 2040. The new infrastructure will manage data, metadata, and access to services without depending on non-EU systems and is expected to bring in more than EUR 17 billion to the German GDP. Google Cloud, in turn, inaugurated last November in Munich its first European Sovereign Cloud Hub, designed as an experimentation space for EU customers and partners also on the subject of sovereign AI solutions. Microsoft, for its part, has also expanded its sovereign cloud offering by guaranteeing the processing of AI applications entirely in Europe and a 'Digital Sovereignty' specialisation for its partners. The direction is thus marked out even if there remains an unresolved knot, which goes beyond architectural choices, namely the US Cloud Act: even when data reside and are 'processed' in Europe, the large American providers remain subject to non-EU jurisdiction, leaving open the issue of a necessarily imperfect sovereignty. The real game of sovereign cloud, however, this is now clear, cannot pass through the exclusion of Big Tech but through the construction of an ecosystem in which innovation and governance of data and architectures must coexist.