A strategic guide for CTOs, CFOs, and compliance leaders navigating EU cloud regulations, hidden infrastructure costs, and sovereign AI in 2026.
Around 40% of companies do not need a full sovereignty migration. But almost every company needs to know their actual position — legally, financially, and operationally. Before spending a single euro on cloud infrastructure changes, this article gives you the framework to find out where you stand and what, if anything, you should do about it.
Understanding the Regulatory Reality
The cloud landscape has shifted dramatically. The era of “grow fast and worry about costs later” is over. In 2026, companies face a dual reckoning: cloud infrastructure that is both financially unpredictable and legally exposed in ways that many leadership teams haven’t fully mapped.
What used to be dismissed as a “compliance tax” has become strategic asset insurance. Companies that treated sovereignty seriously two years ago are now winning regulated government contracts. Companies that ignored it are scrambling.
NIS2 — Personal Liability, Not Just IT Policy
NIS2 applies to organisations in critical sectors including energy, transport, healthcare, digital infrastructure, and public administration. The headline change from its predecessor: senior management can be held personally responsible for cybersecurity failures. Fines reach up to 2% of global annual turnover. Cybersecurity is no longer an IT department issue — it sits squarely in the boardroom.
DORA — Mandated Operational Resilience for Financial Entities
The Digital Operational Resilience Act targets financial services organisations specifically. Requirements include mandatory incident reporting within four hours, threat-led penetration testing, and rigorous third-party risk management. For any financial services company relying on cloud infrastructure, DORA is not optional — it is a legal mandate with direct operational implications for every cloud contract you hold.
The US CLOUD Act — The Jurisdiction Problem Most Teams Miss
This is the issue most legal teams don’t catch, and it fundamentally changes the calculation. The US CLOUD Act allows US authorities to compel US-headquartered cloud providers to hand over data — regardless of where the physical servers are located. Storing your data in an AWS data centre in Frankfurt does not place that data outside US legal jurisdiction if AWS is a US-incorporated company.
Data residency (where your data physically sits) is not the same as data sovereignty (which country’s laws govern your data and who can compel access to it). Many organisations are paying for residency while believing they have sovereignty. This single confusion leads either to massive overspending or to genuine, unacknowledged legal risk.
The GDPR Myth That Costs Companies Millions
One of the most expensive misconceptions in enterprise cloud strategy: “We must use EU-only providers to be GDPR compliant.” This is simply not true. GDPR is a data protection regulation — not a data location regulation. US hyperscalers can be fully GDPR compliant when Standard Contractual Clauses (SCCs) are properly implemented.
The inverse myth is equally dangerous: “Storing data in the EU means we’re compliant.” This conflation of residency and sovereignty leads companies to either over-invest in unnecessary migrations or under-protect against genuine legal risks that have nothing to do with server geography.
The right starting point for any compliance review is a precise mapping of which regulations actually apply to your organisation — and what those regulations literally require, not what a vendor’s sales deck says they require.
The Hidden Economics of “Easy” Cloud
Your monthly compute and storage invoice is just the visible tip of your cloud cost structure. For many organisations, the most significant costs are below the waterline — and they compound quietly for years before anyone looks closely.
The Egress Fee: Cloud’s Built-In Exit Tax
Every time data leaves hyperscaler platforms — to end users, partners, analytics tools, or other systems — you pay. Egress fees are deliberately structured to make multi-cloud setups more expensive and to penalise organisations for moving data out of the ecosystem. For high-traffic workloads, geospatial platforms, or any business regularly transferring large data volumes to clients, egress fees can represent a substantial hidden cost that never appears on a simple compute price comparison.
The Proprietary Service Lock-In Trap
Hyperscalers offer genuinely powerful managed services — DynamoDB, SageMaker, AWS Lambda — that solve real problems. The trade-off is deep ecosystem dependency. Teams begin with one managed service, which requires another, until the application is tightly integrated into a proprietary stack. The cost of untangling this lock-in becomes a migration liability that M&A buyers now routinely flag and discount for in due diligence.
The Utilisation Gap
A consistent finding across client assessments: organisations pay for significantly more than they use. Services activated for evaluation and never deactivated. Reserved instances that don’t match actual workload patterns. A rigorous audit of actual utilisation versus invoiced services typically reveals 20–30% of cloud spend delivering no active business value.
The important caveat: this comparison applies to standard compute and storage. Organisations that genuinely rely on advanced managed services — ML pipelines, global CDN, sophisticated database services — will see the cost differential narrow. But for the majority of enterprise workloads, the economics are material.
Building the Business Case: The Sovereign ROI Formula
Sovereignty is not just a compliance discussion. For the right organisations, it is a financial and strategic one. The business case rests on three components — and understanding which ones apply to your situation determines whether migration creates or destroys value.
Component 1: Direct Cost Savings
The most straightforward calculation. Compare your current all-in cloud spend — compute, storage, egress fees, and proprietary service costs — against equivalent EU provider pricing. For standard workloads, our client data consistently shows 20–40% operating cost reductions. For workloads with high egress or GPU compute, savings of 60–75% are achievable.
Component 2: Avoided Risk (Regulatory and Revenue)
This is where the business case often becomes most compelling. GDPR fines can reach up to 4% of global annual revenue. NIS2 carries penalties up to 2% of global turnover. Beyond penalties, many public sector and regulated industry contracts now require sovereign infrastructure as a prerequisite. If sovereignty unlocks a €2M government tender, the migration cost becomes marketing spend with a very fast payback period.
Component 3: Valuation and Exit Multiple
For companies anticipating investment rounds or acquisition, this is increasingly relevant. Deep proprietary cloud dependencies are flagged in due diligence as re-platforming liabilities. Buyers discount for them. Moving to open, portable infrastructure before a transaction can genuinely improve exit multiples — a benefit that rarely appears in standard ROI calculations, but can dwarf the operational cost savings.
For companies with genuine economic drivers — high egress, GPU workloads, regulated contracts — typical break-even on a sovereignty migration is 6–12 months. Not years. Months. The key phrase is “genuine economic drivers.” The ROI calculation looks very different for a company that doesn’t actually have them.
Who Actually Needs Data Sovereignty?
Let’s be direct about which organisations have genuine migration reasons — and which don’t. One of the most expensive mistakes in this space is applying a one-size-fits-all answer to a question that depends entirely on your specific sector, contracts, and cost structure.
Category 1: Regulated Financial Services and Healthcare
For organisations in these sectors, sovereignty is not a strategic choice — it is a legal mandate. DORA requires operational resilience for financial entities. NIS2 covers healthcare and critical infrastructure with personal liability provisions. If your organisation falls into these categories, the question is not whether to address sovereignty, but how to do it most effectively and at what pace.
Category 2: Government and Public Sector Contracts
Public sector tenders across most EU member states increasingly require that sensitive data never leaves EU legal control — not merely EU geography. The CLOUD Act issue means that having servers in Frankfurt is insufficient if the provider is a US-incorporated company. Organisations competing for government contracts, defence work, or regulated public sector engagements must address this gap or accept disqualification.
Category 3: High-Egress or GPU-Intensive Workloads
For companies with infrastructure costs dominated by egress or GPU compute — geospatial platforms, gaming, AI model training — the economic case is independent of regulation. H100 GPU compute costs $7–11 per hour on US hyperscalers versus approximately $2–3 per hour on European sovereign providers. For serious AI training workloads, this arithmetic becomes rapidly decisive.
Who Doesn’t Need a Full Migration
Approximately 40% of companies we assess have no genuine migration requirement. B2B SaaS, e-commerce, MarTech, and most commercial applications can achieve full regulatory compliance with SCCs and proper data governance — without a six-figure infrastructure overhaul. For these organisations, spending on a full sovereignty migration would destroy value, not create it.
The Four-Step Evaluation Framework
When clients ask us “Should we migrate to EU sovereign cloud?”, this is the framework we apply. Each step gates the next — you don’t invest in Step 2 until Step 1 confirms it’s warranted. This sequencing is critical: it prevents expensive decisions based on assumptions.
The first step is not to talk to a cloud provider. It is to conduct an independent legal and technical review. The worst outcome is a million-euro infrastructure decision made from a vendor sales deck.
Step 2: Calculate the True Migration Cost
If Step 1 confirms a migration requirement, you need a realistic total cost — not just infrastructure pricing. Based on projects we’ve delivered:
The most common source of cost overruns: proprietary dependencies. Systems relying heavily on DynamoDB, SageMaker, or Lambda-specific features face significantly more complex refactoring. Identify these dependencies before committing to timelines — otherwise you’re guessing.
Step 3: Assess Operational Impact
Four operational questions must be answered before committing to migration:
Step 4: Quantify the Ongoing Cost Delta
Compare total current spend (compute + storage + egress + proprietary service fees) against EU provider equivalents. Critically, this step also often reveals that organisations are paying for services they’re not actively using — the audit component of Step 4 frequently returns its own cost in discovered waste.
The EU Provider Landscape
Many organisations know AWS and Azure intimately but have limited visibility into European alternatives. Here is a practical overview of the major providers and where each makes sense:
Gaia-X and EuroStack deserve a mention for future planning — truly European, open-standard, and sovereign by design. They’re still developing, but organisations building 2027 infrastructure strategies should keep them on the roadmap.
Sovereign AI: The Next Frontier
The data sovereignty conversation is accelerating rapidly in the context of AI, and it deserves direct attention. If your organisation is training proprietary models on sensitive business data, the infrastructure question becomes critical in ways that don’t apply to standard workloads.
The Cost Arithmetic Is Decisive
US hyperscalers charge approximately $7–11 per hour for H100 GPU compute. European sovereign cloud providers offer equivalent hardware for roughly $2–3 per hour. For organisations running serious AI training workloads — fine-tuning foundation models, training domain-specific models, large-scale inference — this differential creates a compelling economic case entirely independent of any regulatory consideration.
The IP Protection Case
The more strategically significant issue is control. If you train models on a US hyperscaler, your model weights, training data, and proprietary IP fall under US jurisdiction. For regulated industries, that’s not a technical footnote — it’s a real strategic and legal risk. The companies building the most defensible AI positions in the coming years will be those that trained proprietary models on sovereign infrastructure with full control of their data pipeline from the start.
Sovereign AI infrastructure isn’t primarily about cost. It’s about ensuring that the intellectual property generated through AI training — model weights, fine-tuned capabilities, proprietary data pipelines — remains under your legal jurisdiction. In 2026, this is becoming a genuine competitive moat for regulated-sector AI deployments.
A Practical Migration Approach: The Three Phases
“Move to EU cloud” sounds simple. In practice, successful migrations follow a phased approach that delivers value at each stage rather than requiring a six-month investment before any return appears. The three-phase model below reflects what we’ve learned from delivered projects:
You do not need to complete Phase 3 to capture most of the business value. Many organisations run Phases 1 and 2 and maintain a light Phase 3 roadmap as an ongoing architectural principle rather than a finite project.
The Migration Decision Checklist
Two or more “yes” answers indicates a strong case for sovereignty migration. One or fewer means focus on compliance hygiene first — a full migration is likely to destroy value rather than create it.
Key Takeaways
The question isn’t “should we go sovereign?” The question is “do we understand our current position?” Once you have that answer — whether it’s “you’re fully compliant as you are” or “here’s a clear financial and regulatory case to move” — everything else follows. The worst outcome is doing nothing because the topic feels complicated.
Authors
Cloud Solutions Architect with extensive experience leading cloud migrations across Europe. Works directly with CTOs and CFOs on cloud strategy, cost optimisation, and regulatory compliance.
Cloud Architect leading the engineering side of Gart’s infrastructure and migration projects. Specialises in sovereign cloud architectures and operational resilience frameworks.
See how we can help to overcome your challenges
