In July 2026, Airbus signed a multi-year contract to host its most critical applications with Scaleway, a French cloud provider. The applications include ERP, manufacturing execution, CRM and product lifecycle management. Airbus calls these its minimum viable company. The first 70 of 900 applications are already moving away from AWS, and when the migration completes, all of them will sit on European infrastructure, under European law, beyond the reach of the US CLOUD Act.
Airbus is not leaving American technology. Skywise, its aviation analytics platform will stay on AWS, and its Microsoft and Google productivity tools remain. What Airbus has done is draw a line around the systems it cannot afford to lose and decided that those systems cannot live on infrastructure subject to a foreign government’s legal authority. That is a risk decision, and most organisations have not made it, because most organisations have never asked the question.
In June 2025, Anton Carniaux, Microsoft France’s director of public and legal affairs, testified under oath before the French Senate. He was asked whether he could guarantee that French citizens’ data would never be transmitted to US authorities without explicit French authorisation. He said he could not, noting that while it had never happened, under the CLOUD Act, a US law that allows American authorities to compel US companies to produce data stored anywhere in the world, Microsoft would have no choice but to comply if it did.
Then it did happen, in May 2026, Microsoft shared unredacted names, emails, meeting minutes and calendar invitations from the Dutch Authority for Consumers and Markets and the Dutch Data Protection Authority, who were enforcing the EU’s Digital Services Act with the US House of Representatives. The Dutch cabinet described it as “extremely worrying” and noted that named officials could face travel bans or sanctions.
In the same month, details emerged that the Chief Prosecutor of the International Criminal Court had been locked out of his Microsoft 365 account the previous year, by sanctions compliance mechanisms. The ICC has since migrated 1,800 workstations away from Microsoft entirely. None of these incidents involved a breach or a failure. The infrastructure did what it was built to do and complied with its legal obligations.
Germany responded at every level of government. In March 2026, the IT-Planungsrat ruled that all public institutions must use the Open Document Format for editable documents and PDF for final documents, with Microsoft’s proprietary formats being excluded. The mandate covers every federal agency, state government and municipality, roughly 5.4 million public sector employees in total. Chancellor Friedrich Merz is shifting his chancellery from Microsoft 365 to openDesk, the sovereign suite developed by Germany’s Centre for Digital Sovereignty.
At state level, Schleswig-Holstein has completed its migration away from Microsoft, covering 30,000 public employees with 30,000 teachers to follow. Bavaria, the largest German state, has cancelled a nearly billion-euro Microsoft framework agreement. Mecklenburg-Vorpommern is migrating more than 50,000 employees to its own open-source collaboration platform. The German federal government spent €481 million on Microsoft licences in 2025, up 76 percent in two years.
The Netherlands blocked the proposed acquisition of Dutch cloud provider Solvinity by US-based Kyndryl, because Solvinity hosts DigiD, the national digital identity platform. Denmark’s two largest municipalities are ending their use of Microsoft systems. Switzerland’s Canton of Zurich has banned American cloud services for sensitive government data outright. In April 2026, the European Commission awarded a €180 million sovereign cloud framework contract to four European providers, including Scaleway. In June, it published the Cloud and AI Development Act, establishing a sovereignty assurance framework for cloud services used in public sector procurement.
EU-based cloud providers’ share of their own market had fallen from 29 percent in 2017 to around 15 percent in 2022. These governments are now trying to reverse a dependency that fifteen years of data protection law has not.
The Airbus decision matters beyond cloud migration because of what sits on top of the infrastructure.
In May 2026, Airbus signed a partnership with Mistral, the French AI company, to co-develop AI tools for aerospace and defence. Mistral’s models are already deployed on Scaleway’s infrastructure. Catherine Jestin, Airbus’s Chief Digital Officer, stated that this would allow Airbus to accelerate its AI approach. The implication is explicit. Rather than routing AI inference through OpenAI or Google, Airbus will use European models, running on European infrastructure, under European law.
Six months ago, the European sovereignty conversation was about infrastructure and productivity software, email, and file storage. That mattered, but it was only about the plumbing. The AI layer changes the nature of the dependency. When AI is embedded in aircraft design, manufacturing execution and defence applications, the question of who controls the models, who can access the training data and whose legal jurisdiction governs the inference becomes an operational sovereignty question, not a compliance exercise.
What is forming is a full sovereign stack, European cloud, European AI models, and most importantly, European legal jurisdiction. Airbus is the first major industrial company to assemble all three layers for its most sensitive workloads. It could do so because the demand side finally moved, the European Commission’s Cloud III procurement created a framework. Germany’s format mandate and state-level migrations created market signals. Airbus, as anchor customer, created commercial viability for a provider that would likely not have won a contract of this scale five years ago. Scaleway is backed by Iliad Group, a European telecoms operator with over €10 billion in revenue, which has committed €3 billion to AI infrastructure. Airbus evaluated ten candidates against more than 150 technical and legal requirements before selecting them.
The UK is absent from this story, while Germany mandates open formats and France builds sovereign cloud infrastructure, the UK is handing its most sensitive health data to Palantir Technologies, a US company founded by Peter Thiel with deep ties to US intelligence, defence agencies, and immigration enforcement. The British Medical Association voted to lobby against Palantir’s involvement in the NHS, citing a lack of transparency, discriminatory policing software and close links to a US government that shows little regard for international law.
The NHS Federated Data Platform creates detailed profiles of individual patients through what it calls the Person Ontology, described in NHS documentation as the single source of truth for pseudonymised patient-level datasets. In August 2026, the National Infrastructure and Service Transformation Authority revised the programme’s whole-life cost upward to £1.1 billion, and forecast the benefits would fall to £808 million. So the costs of the platform now exceed its projected value. The Office for Statistics Regulation instructed NHS England to strengthen caveats around its benefit claims after concerns that some conflated correlation with causation. A break clause review is set for spring 2027.
The Ministry of Defence awarded Palantir a separate £240 million contract without competitive tender, following a strategic partnership announced during President Trump’s visit to the UK. MPs have called for a staged exit and a retender for British companies to build a replacement. The question of digital sovereignty was raised explicitly in a Commons select committee hearing in June 2026. The UK has no equivalent of Germany’s Deutschland-Stack, no sovereign cloud procurement framework, no format mandate. Its most sensitive health and defence data sits on infrastructure built by a company whose other US government contracts include immigration enforcement and deportation targeting systems.
That is not a criticism of Palantir’s engineering. It is a question about where sovereign data should live, and the UK has not yet asked it.
Most organisations, when they think about cloud, consider three options. Azure, AWS and Google Cloud. For most workloads, that is fine. These are world-class platforms with capabilities that no European provider can match across the board. Airbus knows this, which is why Skywise stays on AWS and productivity tools stay where they are.
But for the systems that constitute your minimum viable business, the question is different. Where does the data live that you cannot afford to lose control of? Whose legal jurisdiction governs the infrastructure? What happens when a compliance mechanism, operating as designed, encompasses your systems along with everything else it was required to reach?
The gap between European ambition and European capacity is real. The EU’s sovereign cloud contract is €180 million over six years. Germany’s format mandate uses “strive” language with no enforcement mechanism. European cloud providers hold a shrinking share of their own market. But the question does not go away because the answer is difficult.
Every organisation has a minimum viable business and most have never asked where it lives.
I write about AI, cybersecurity, and technology every Friday. Subscribe to get it in your inbox.
Sources & Further Reading
Scaleway. (2026, July 16). Scaleway secures European “Trusted Cloud” services contract with Airbus. https://www.scaleway.com/en/news/scaleway-secures-european-trusted-cloud-services-contract-with-airbus/
Reuters. (2026, July 16). Airbus picks Iliad’s Scaleway for AI, defence work in sovereignty push.
The Register. (2026, July 16). Airbus migrating 70 critical apps from AWS to France’s Scaleway amid digital sovereignty push.
The Register. (2025, July 25). Microsoft admits it “cannot guarantee” data sovereignty.
DutchNews.nl. (2026, May 22). US tech firms share Dutch regulator officials’ names with senate.
Jones Day. (2026, June 23). Dutch government blocks US acquisition of cloud provider Solvinity.
European Commission. (2026, June 3). Strengthening Europe’s tech sovereignty. https://commission.europa.eu/news-and-media/news/strengthening-europes-tech-sovereignty-2026-06-03_en
European Commission. (2026, April 17). Commission advances cloud sovereignty through strategic procurement.
The Document Foundation. (2026, March 20). Germany has just made ODF mandatory.
Irish Times. (2026, February 14). A small German state’s quiet revolt against Microsoft.
Cybernews. (2026, June 4). German state Bavaria cancels billion euro contract with Microsoft.
heise online. (2026, February). Microsoft dependency: Federal government pays near 500 million euros in one year.
Computing. (2026, August 10). NHS Palantir platform’s business case under pressure as costs rise and benefits fall.
Hansard. (2026, April 16). NHS Federated Data Platform debate.
Medact. (2026, May). Briefing: Concerns regarding Palantir Technologies and NHS data systems.
Digital Health. (2026, July). Pressure mounts from MPs on Palantir’s role in the NHS.
TechPolicy.Press. (2026, June 12). Why Palantir’s UK health data system matters beyond surveillance fears.
Data Centre Magazine. (2025, February). How the Iliad Group plans to invest €3 billion in AI.