Gart Solutions’ Two-Year Journey and Future in the Swedish Tech Ecosystem

A strategic guide for CTOs, CFOs, and compliance leaders navigating EU cloud regulations, hidden infrastructure costs, and sovereign AI in 2026. Executive Summary Around 40% of companies do not need a full sovereignty migration. But almost every company needs to know their actual position — legally, financially, and operationally. Before spending a single euro on cloud infrastructure changes, this article gives you the framework to find out where you stand and what, if anything, you should do about it. Understanding the Regulatory Reality The cloud landscape has shifted dramatically. The era of "grow fast and worry about costs later" is over. In 2026, companies face a dual reckoning: cloud infrastructure that is both financially unpredictable and legally exposed in ways that many leadership teams haven't fully mapped. What used to be dismissed as a "compliance tax" has become strategic asset insurance. Companies that treated sovereignty seriously two years ago are now winning regulated government contracts. Companies that ignored it are scrambling. NIS2 — Personal Liability, Not Just IT Policy NIS2 applies to organisations in critical sectors including energy, transport, healthcare, digital infrastructure, and public administration. The headline change from its predecessor: senior management can be held personally responsible for cybersecurity failures. Fines reach up to 2% of global annual turnover. Cybersecurity is no longer an IT department issue — it sits squarely in the boardroom. DORA — Mandated Operational Resilience for Financial Entities The Digital Operational Resilience Act targets financial services organisations specifically. Requirements include mandatory incident reporting within four hours, threat-led penetration testing, and rigorous third-party risk management. For any financial services company relying on cloud infrastructure, DORA is not optional — it is a legal mandate with direct operational implications for every cloud contract you hold. The US CLOUD Act — The Jurisdiction Problem Most Teams Miss This is the issue most legal teams don't catch, and it fundamentally changes the calculation. The US CLOUD Act allows US authorities to compel US-headquartered cloud providers to hand over data — regardless of where the physical servers are located. Storing your data in an AWS data centre in Frankfurt does not place that data outside US legal jurisdiction if AWS is a US-incorporated company. ⚠ Critical Distinction Data residency (where your data physically sits) is not the same as data sovereignty (which country's laws govern your data and who can compel access to it). Many organisations are paying for residency while believing they have sovereignty. This single confusion leads either to massive overspending or to genuine, unacknowledged legal risk. The GDPR Myth That Costs Companies Millions One of the most expensive misconceptions in enterprise cloud strategy: "We must use EU-only providers to be GDPR compliant." This is simply not true. GDPR is a data protection regulation — not a data location regulation. US hyperscalers can be fully GDPR compliant when Standard Contractual Clauses (SCCs) are properly implemented. The inverse myth is equally dangerous: "Storing data in the EU means we're compliant." This conflation of residency and sovereignty leads companies to either over-invest in unnecessary migrations or under-protect against genuine legal risks that have nothing to do with server geography. The right starting point for any compliance review is a precise mapping of which regulations actually apply to your organisation — and what those regulations literally require, not what a vendor's sales deck says they require. The Hidden Economics of "Easy" Cloud Your monthly compute and storage invoice is just the visible tip of your cloud cost structure. For many organisations, the most significant costs are below the waterline — and they compound quietly for years before anyone looks closely. The Egress Fee: Cloud's Built-In Exit Tax Every time data leaves hyperscaler platforms — to end users, partners, analytics tools, or other systems — you pay. Egress fees are deliberately structured to make multi-cloud setups more expensive and to penalise organisations for moving data out of the ecosystem. For high-traffic workloads, geospatial platforms, or any business regularly transferring large data volumes to clients, egress fees can represent a substantial hidden cost that never appears on a simple compute price comparison. The Proprietary Service Lock-In Trap Hyperscalers offer genuinely powerful managed services — DynamoDB, SageMaker, AWS Lambda — that solve real problems. The trade-off is deep ecosystem dependency. Teams begin with one managed service, which requires another, until the application is tightly integrated into a proprietary stack. The cost of untangling this lock-in becomes a migration liability that M&A buyers now routinely flag and discount for in due diligence. The Utilisation Gap A consistent finding across client assessments: organisations pay for significantly more than they use. Services activated for evaluation and never deactivated. Reserved instances that don't match actual workload patterns. A rigorous audit of actual utilisation versus invoiced services typically reveals 20–30% of cloud spend delivering no active business value. Cost Comparison: Hyperscaler vs. EU Bare Metal (Standard Compute Workload) Infrastructure Type Est. Monthly Cost Egress Fees Notes AWS EC2 (standard compute) €400–600/month Variable — can be significant at scale Extensive managed services ecosystem Hetzner Bare Metal (equivalent) €80–120/month Included in flat rate (20TB+) Requires capable DevOps team Typical saving ~60% lower base cost Near zero vs. variable Narrows with advanced managed service usage The important caveat: this comparison applies to standard compute and storage. Organisations that genuinely rely on advanced managed services — ML pipelines, global CDN, sophisticated database services — will see the cost differential narrow. But for the majority of enterprise workloads, the economics are material. Building the Business Case: The Sovereign ROI Formula Sovereignty is not just a compliance discussion. For the right organisations, it is a financial and strategic one. The business case rests on three components — and understanding which ones apply to your situation determines whether migration creates or destroys value. 6–12mo Typical break-even timeline for qualifying orgs 20–40% Avg. cost saving on standard workloads 60–75% Saving on high-egress & GPU workloads ~40% Companies that do NOT need full migration Component 1: Direct Cost Savings The most straightforward calculation. Compare your current all-in cloud spend — compute, storage, egress fees, and proprietary service costs — against equivalent EU provider pricing. For standard workloads, our client data consistently shows 20–40% operating cost reductions. For workloads with high egress or GPU compute, savings of 60–75% are achievable. Component 2: Avoided Risk (Regulatory and Revenue) This is where the business case often becomes most compelling. GDPR fines can reach up to 4% of global annual revenue. NIS2 carries penalties up to 2% of global turnover. Beyond penalties, many public sector and regulated industry contracts now require sovereign infrastructure as a prerequisite. If sovereignty unlocks a €2M government tender, the migration cost becomes marketing spend with a very fast payback period. Component 3: Valuation and Exit Multiple For companies anticipating investment rounds or acquisition, this is increasingly relevant. Deep proprietary cloud dependencies are flagged in due diligence as re-platforming liabilities. Buyers discount for them. Moving to open, portable infrastructure before a transaction can genuinely improve exit multiples — a benefit that rarely appears in standard ROI calculations, but can dwarf the operational cost savings. ROI Reality Check For companies with genuine economic drivers — high egress, GPU workloads, regulated contracts — typical break-even on a sovereignty migration is 6–12 months. Not years. Months. The key phrase is "genuine economic drivers." The ROI calculation looks very different for a company that doesn't actually have them. Who Actually Needs Data Sovereignty? Let's be direct about which organisations have genuine migration reasons — and which don't. One of the most expensive mistakes in this space is applying a one-size-fits-all answer to a question that depends entirely on your specific sector, contracts, and cost structure. Category 1: Regulated Financial Services and Healthcare For organisations in these sectors, sovereignty is not a strategic choice — it is a legal mandate. DORA requires operational resilience for financial entities. NIS2 covers healthcare and critical infrastructure with personal liability provisions. If your organisation falls into these categories, the question is not whether to address sovereignty, but how to do it most effectively and at what pace. Category 2: Government and Public Sector Contracts Public sector tenders across most EU member states increasingly require that sensitive data never leaves EU legal control — not merely EU geography. The CLOUD Act issue means that having servers in Frankfurt is insufficient if the provider is a US-incorporated company. Organisations competing for government contracts, defence work, or regulated public sector engagements must address this gap or accept disqualification. Category 3: High-Egress or GPU-Intensive Workloads For companies with infrastructure costs dominated by egress or GPU compute — geospatial platforms, gaming, AI model training — the economic case is independent of regulation. H100 GPU compute costs $7–11 per hour on US hyperscalers versus approximately $2–3 per hour on European sovereign providers. For serious AI training workloads, this arithmetic becomes rapidly decisive. Who Doesn't Need a Full Migration Approximately 40% of companies we assess have no genuine migration requirement. B2B SaaS, e-commerce, MarTech, and most commercial applications can achieve full regulatory compliance with SCCs and proper data governance — without a six-figure infrastructure overhaul. For these organisations, spending on a full sovereignty migration would destroy value, not create it. The Four-Step Evaluation Framework When clients ask us "Should we migrate to EU sovereign cloud?", this is the framework we apply. Each step gates the next — you don't invest in Step 2 until Step 1 confirms it's warranted. This sequencing is critical: it prevents expensive decisions based on assumptions. Step 1 — Map Your Actual Regulatory Requirements Question to Answer Why It Matters Which specific regulations apply to your organisation? Sector and data type determine which laws actually apply — many are sector-specific What do those regulations literally mandate? 60–70% of companies overestimate requirements at this stage Are there alternative compliance mechanisms (SCCs, adequacy decisions)? These may satisfy requirements without full migration The first step is not to talk to a cloud provider. It is to conduct an independent legal and technical review. The worst outcome is a million-euro infrastructure decision made from a vendor sales deck. Step 2: Calculate the True Migration Cost If Step 1 confirms a migration requirement, you need a realistic total cost — not just infrastructure pricing. Based on projects we've delivered: Migration Cost Breakdown (Mid-size Organisation) Cost Component Typical Range Key Variable Discovery & Assessment €5,000–20,000 Complexity of current architecture Infrastructure Setup €10,000–50,000 Environment complexity Application Refactoring €20,000–150,000+ Depth of proprietary API dependencies Dual Environment Running €10,000–40,000 Duration of parallel operation Team Training €8,000–25,000 Current team capabilities Total (Realistic) €50,000–300,000 Always budget toward the upper end The most common source of cost overruns: proprietary dependencies. Systems relying heavily on DynamoDB, SageMaker, or Lambda-specific features face significantly more complex refactoring. Identify these dependencies before committing to timelines — otherwise you're guessing. Step 3: Assess Operational Impact Four operational questions must be answered before committing to migration: Operational Readiness Assessment 1 Will performance suffer? For standard workloads, EU providers like OVHcloud, Hetzner, and Scaleway perform on par with hyperscalers. Gaps appear in global CDN coverage for latency-sensitive global applications. 2 Do you rely on advanced managed services? If core workflows depend on SageMaker, Azure Cognitive Services, or similar proprietary services, migration complexity and cost increase substantially. Quantify this before committing. 3 Can EU providers meet your SLAs? Most can for standard workloads. Evaluate specifically against your architecture — particularly for global CDN coverage and third-party integrations. 4 Is your team ready for hands-on infrastructure management? EU providers have smaller support teams and less documentation than AWS or Azure. Teams accustomed to fully managed clouds will need training investment — plan and budget for it explicitly. Step 4: Quantify the Ongoing Cost Delta Compare total current spend (compute + storage + egress + proprietary service fees) against EU provider equivalents. Critically, this step also often reveals that organisations are paying for services they're not actively using — the audit component of Step 4 frequently returns its own cost in discovered waste. The EU Provider Landscape Many organisations know AWS and Azure intimately but have limited visibility into European alternatives. Here is a practical overview of the major providers and where each makes sense: OVHcloud Wide service range, GPU clusters, sustainable infrastructure. Data centres in France, Germany, Poland, and the UK. Mid-range pricing with a strong European compliance posture. Regulated workloads Balanced needs Weak Asia-Pacific Scaleway Modern, API-first architecture. ARM instances, developer-friendly tooling. Competitive pricing, but fewer managed services means more operational overhead for your team. Developer teams Cost-sensitive Less managed services IONOS Budget-focused, SME-friendly with simple pricing. Strong presence in Germany, UK, Spain, and the US. Fewer enterprise features, but solid for straightforward workloads. Standard workloads SME-friendly Limited enterprise features Hetzner Top Pick for Cost Exceptional cost performance. Bare-metal, reliable uptime, data centres in Germany and Finland. 20TB+ traffic included. Basic management panel — requires a capable DevOps team to unlock full value. High-traffic GPU workloads Needs DevOps capability Gaia-X and EuroStack deserve a mention for future planning — truly European, open-standard, and sovereign by design. They're still developing, but organisations building 2027 infrastructure strategies should keep them on the roadmap. Sovereign AI: The Next Frontier The data sovereignty conversation is accelerating rapidly in the context of AI, and it deserves direct attention. If your organisation is training proprietary models on sensitive business data, the infrastructure question becomes critical in ways that don't apply to standard workloads. The Cost Arithmetic Is Decisive US hyperscalers charge approximately $7–11 per hour for H100 GPU compute. European sovereign cloud providers offer equivalent hardware for roughly $2–3 per hour. For organisations running serious AI training workloads — fine-tuning foundation models, training domain-specific models, large-scale inference — this differential creates a compelling economic case entirely independent of any regulatory consideration. The IP Protection Case The more strategically significant issue is control. If you train models on a US hyperscaler, your model weights, training data, and proprietary IP fall under US jurisdiction. For regulated industries, that's not a technical footnote — it's a real strategic and legal risk. The companies building the most defensible AI positions in the coming years will be those that trained proprietary models on sovereign infrastructure with full control of their data pipeline from the start. Sovereign AI — The Strategic View Sovereign AI infrastructure isn't primarily about cost. It's about ensuring that the intellectual property generated through AI training — model weights, fine-tuned capabilities, proprietary data pipelines — remains under your legal jurisdiction. In 2026, this is becoming a genuine competitive moat for regulated-sector AI deployments. A Practical Migration Approach: The Three Phases "Move to EU cloud" sounds simple. In practice, successful migrations follow a phased approach that delivers value at each stage rather than requiring a six-month investment before any return appears. The three-phase model below reflects what we've learned from delivered projects: 1 Quick Economic Wins 4–8 weeks Start with easy-to-move workloads that don't require application changes. Static storage migration High-egress workloads Standard compute instances Savings appear almost immediately 2 Compliance-Critical Systems 3–6 months Once Phase 1 infrastructure is proven, migrate sensitive and regulated data. PII and mission-critical systems NIS2 / DORA-regulated workloads Parallel environments required Full validation before cutover 3 Strategic Autonomy Ongoing programme Gradually replace proprietary services with open-source alternatives. DynamoDB → PostgreSQL SageMaker → open ML frameworks Vendor-specific APIs → portable code True infrastructure portability You do not need to complete Phase 3 to capture most of the business value. Many organisations run Phases 1 and 2 and maintain a light Phase 3 roadmap as an ongoing architectural principle rather than a finite project. Case Study Elandfill.io: From Local Project to Global Platform An environmental monitoring platform that started in Iceland and scaled globally — made possible by solving the infrastructure cost model first. 20TB+ Traffic included in flat monthly rate ≈ €0 Egress costs post-migration 4 markets Iceland → France → Sweden → global Elandfill.io processes high-resolution map data that demands significant RAM and CPU. On hyperscaler infrastructure, egress fees — charged every time map data was delivered to clients — were directly eroding per-client margins and making global expansion economically unviable. We migrated them to Hetzner bare-metal infrastructure. The economics changed completely: more than 20TB of traffic included at a flat monthly price, egress effectively at zero, and billing became predictable rather than scaling with every new client added. The infrastructure decision wasn't just a cost saving — it was what made the growth model viable. Those predictable margins enabled expansion from Iceland to France, to Sweden, and then to genuinely global scale. — Fedir Kompaniiets, CEO, Gart Solutions The pattern here is worth noting. Companies typically frame cloud independence as a defensive move — compliance, risk reduction. For the right organisations, solving the infrastructure economics is what makes an offensive growth strategy possible. The Migration Decision Checklist Two or more "yes" answers indicates a strong case for sovereignty migration. One or fewer means focus on compliance hygiene first — a full migration is likely to destroy value rather than create it. Should You Migrate? — Decision Framework 1 Are you in finance, healthcare, defence, or critical infrastructure? If yes: a true sovereignty mandate applies under DORA or NIS2. If no: standard SCCs may be sufficient. 2 Do you hold EU government or regulated public sector contracts? If yes: strict data control requirements apply. Mission-critical data migration is likely required. If no: evaluate cost-benefit only. 3 Do infrastructure costs exceed 30% of your total IT budget? If yes: almost always a signal of waste — the economic case for migration is strong. Calculate your ROI. If no: migration may not deliver meaningful savings on its own. 4 Is egress or GPU spend a major cost driver? (AI, gaming, geospatial) If yes: bare-metal EU providers will deliver immediate margin improvement. If no: maintain current setup, but monitor as workloads grow. Scoring: 2 or more "yes" answers → strong case for sovereignty migration.  |  1 or fewer → focus on compliance hygiene first. Key Takeaways 1 40% of companies don't need a full sovereignty migration No need to overcomplicate. The right tool for the job may simply be better compliance hygiene, not a six-figure infrastructure overhaul. 2 Map your real requirements before spending anything 60–70% of companies overestimate their obligations. An independent legal and technical review before any budget discussion saves enormous wasted investment. 3 EU providers are 20–40% cheaper for standard workloads The difference narrows with advanced managed services. For compute and storage, the economics are consistently attractive — and the egress story alone can justify the move. 4 Break-even is typically 6–12 months for qualifying organisations Not years — months. The key phrase is qualifying organisations: those with genuine economic drivers or regulatory mandates. For others, the ROI calculus looks very different. 5 In regulated sectors, sovereignty isn't optional — assess now Finance, healthcare, defence, government: if you operate there, a proper sovereignty assessment is not a future project. It belongs on the current quarter's agenda. The question isn't "should we go sovereign?" The question is "do we understand our current position?" Once you have that answer — whether it's "you're fully compliant as you are" or "here's a clear financial and regulatory case to move" — everything else follows. The worst outcome is doing nothing because the topic feels complicated. Know Your Position Before Your Competitors Know Theirs The starting point is a Sovereign Readiness Assessment — a structured review of your regulatory obligations, current infrastructure economics, and operational readiness. We'll give you the honest answer for your specific situation. Request a Readiness Assessment → Digital Sovereignty Readiness & EU Cloud Assessment GuideDownload Authors FK Fedir Kompaniiets CEO & Co-Founder, Gart Solutions Cloud Solutions Architect with extensive experience leading cloud migrations across Europe. Works directly with CTOs and CFOs on cloud strategy, cost optimisation, and regulatory compliance. RB Roman Burdiuzha CTO & Co-Founder, Gart Solutions Cloud Architect leading the engineering side of Gart's infrastructure and migration projects. Specialises in sovereign cloud architectures and operational resilience frameworks.