Digital sovereignty has arrived in boardrooms, but not yet in budgets and architecture decisions. And the situation is clear: with NIS2, the EU Data Act, and a geopolitically fragile global dependence on IT, companies no longer have a choice about whether to engage with the topic. The only question is whether they do so reactively or strategically.

This article shows what digital sovereignty will concretely mean in 2026, where the biggest misunderstandings lie, and how IT decision-makers can develop a strategy that is neither too risky nor too expensive.

What is digital sovereignty, and why data residency alone isn’t enough?

Digital sovereignty describes a company’s ability to independently control its IT infrastructure, data, and processes—regardless of external influences from vendors, authorities, or geopolitical developments.

The key misunderstanding: sovereignty is not the same as data residency. The fact that a server is physically located in Frankfurt does not protect against access if the cloud provider is subject to US law. The US CLOUD Act obliges US companies to hand over data on official request—regardless of which country the servers are located in.

That this is not a theoretical risk was confirmed by Microsoft itself in June 2025: Microsoft France’s Chief Legal Officer stated under oath before the French Senate that Microsoft cannot guarantee that data of European customers—even if stored in EU data centers—will not be passed on to US authorities. It’s hard to imagine a clearer statement of the situation.

For IT decision-makers, this means: the provider’s jurisdiction is what matters, not the data center’s ZIP code.
That’s why several dimensions of digital sovereignty are distinguished (defined in the EU Cloud Sovereignty Framework), all of which must be taken into account:

Only when all dimensions are addressed can we speak of true digital sovereignty.

Why 2026 is a turning point: the regulatory drivers

The pressure on companies to design their cloud strategy in a sovereign way doesn’t come from abstract IT considerations. It comes from regulation—and it has increased significantly over the past 18 months.

NIS2 (in force since December 2025): The NIS2 implementation act obliges around 30,000 companies in Germany to demonstrably implement cybersecurity measures, including requirements for cryptography, data protection, and supply chain security. Anyone running critical workloads with a provider without European jurisdiction has a structural compliance problem. More on NIS2: NIS2 in practice: Personal liability, obligation to provide evidence, and what managing directors need to do now – Manage Now

EU Cloud Sovereignty Framework (since October 29, 2025)

The Cloud Sovereignty Framework serves as a standardized assessment framework for cloud sovereignty. The framework defines eight sovereignty objectives (SOV-1 to SOV-8) covering strategic, legal, operational, technological, data and AI sovereignty, as well as sustainability and supply chain resilience. For assessment, a five-level system called Sovereignty Effective Assurance Levels (SEAL 0-4) is used. Cloud providers must meet defined minimum levels to be considered in tenders
In addition, a Sovereignty Score is calculated that evaluates the provider’s quality and integration into the EU ecosystem, including ownership structure, governance, investments, and legal exposure to third countries such as the US CLOUD Act

EU Data Act (since September 12, 2025): The EU Data Act regulates who may access data under which conditions and strengthens the right to data portability. For companies storing data in proprietary cloud environments, new obligations to provide evidence and potential switching barriers arise.

DORA (since January 2025): For the financial sector, the Digital Operational Resilience Act also applies, setting explicit requirements for the resilience of IT service providers and cloud providers, including exit strategies and rights of control.

Geopolitical fragmentation: Beyond regulation, the geopolitical risk landscape has changed. IT decision-makers who have concentrated their entire critical infrastructure with a single hyperscaler from a third country face a risk that was still theoretical three years ago.

Hyperscaler, Sovereign Cloud, or hybrid: what’s the right architecture?

There is no universally correct answer. But there is a correct methodology. The decision depends on which workloads are how sensitive and which regulatory requirements apply in concrete terms.

Not all data requires the same level of protection. A pragmatic classification provides the foundation for a differentiated architecture:

This approach—known in practice as workload classification—is the first step of any viable sovereignty strategy. It avoids two typical mistakes: complete hyperscaler dependence without risk assessment on the one hand, and an unrealistic total exit on the other.

Crypto agility and vendor lock-in: regardless of the model chosen, companies should prefer architectures based on open standards that enable switching providers without a complete rebuild. Proprietary services create dependencies that accumulate over years and become expensive in an emergency

A 4-step path to a Sovereign Cloud strategy: what IT decision-makers need to do now

A sovereignty strategy doesn’t emerge in a workshop. It requires a structured approach:

Step 1: Create a workload and data inventory

Which systems run where? Which data is particularly sensitive? Which regulatory requirements (NIS2, DORA, GDPR, industry-specific) apply in concrete terms? Without this inventory, all further decisions are speculative.

Step 2: Evaluate providers across the eight sovereignty dimensions

Review infrastructure, operations, software—check all dimensions per provider. The result is typically sobering: in most companies, the actual dependence on non-European structures is greater than assumed.

Step 3: Develop a migration strategy—prioritized, not radical

An abrupt, complete exit from hyperscaler environments is neither technically nor economically sensible. What makes sense is a risk-based migration path: set up new projects sovereign from the start, migrate existing critical workloads by priority, and leave non-critical systems in place with conscious risk acceptance.

Step 4: Plan for crypto agility and an exit strategy

Regardless of the provider chosen: design architectures so that switching remains possible. That means open standards, documented dependencies, and a defined exit strategy—an obligation DORA already mandates for the financial sector and one that makes sense for all companies.

Conclusion: Digital sovereignty is not a project, but an architectural principle

Digital sovereignty is not a one-off measure. It is an architectural principle that must feed into every cloud decision—from selecting new SaaS tools to designing critical infrastructure.

The good news: in 2026, the European market for sovereign cloud infrastructure is mature enough to offer viable alternatives. The bad news: in most companies, the gap between regulatory pressure and actual implementation is still large.

Those who start today have the chance of an orderly transition. Those who wait will migrate under pressure.

The first step is always the same: an honest picture of your own dependencies. Manage Now supports IT decision-makers in analyzing existing cloud infrastructures and developing a viable Sovereign Cloud strategy.

Talk to our experts →