EU Awards €180M Sovereign Cloud Contract to Four European Providers — US Hyperscalers Excluded as Operators

The European Commission awarded a six-year, €180 million cloud services contract to four European provider consortia on April 17 — the largest sovereign cloud procurement the EU has executed under its new Cloud Sovereignty Framework.

The winners: Post Telecom + CleverCloud + OVHcloud; StackIT (the IT brand of Schwarz Group, the retail conglomerate behind Lidl and Kaufland); Scaleway (part of Xavier Niel’s Iliad Group); and a Proximus-led consortium that includes Belgian telecoms infrastructure, Mistral AI for AI services, and S3NS — Google’s French sovereign cloud subsidiary.

Why Four Providers, Not One

The Commission explicitly structured the award across four distinct consortia “to ensure diversification and resilience and avoid over-reliance on a single provider.” The framework covers all EU institutions, bodies, offices, and agencies — approximately 8,500 staff and an estimated 60 petabytes of data over the contract’s first three years. Concentrating that workload with a single vendor would violate the Commission’s own stated infrastructure risk principles.

Spreading the award also insulates the procurement from the political optics of a single dominant provider failing, pivoting, or acquiring a conflicting business interest during the six-year term.

The Proximus-S3NS Precedent

The most consequential detail in the award is the inclusion of the Proximus-S3NS consortium. S3NS is Google’s dedicated sovereign cloud entity, established to operate Google Cloud infrastructure under French law with EU-based encryption keys, EU-based data residency, and EU-based operational staff. The Commission found this arrangement satisfies SEAL-2 (Data Sovereignty) requirements under the Cloud Sovereignty Framework.

That is a significant precedent. U.S. hyperscalers are not categorically excluded from EU sovereign procurement — they are excluded as direct operators, but their infrastructure can qualify if a European entity controls the operational layer. AWS, Azure, and Google Cloud government sales teams will study this ruling carefully, and several are already building or accelerating European-operated overlay entities modeled on S3NS.

What the Tender Required

The procurement, launched in October 2025, was technically open to all global cloud providers. The barrier was SEAL-2 certification under the Commission’s Cloud Sovereignty Framework, which evaluates eight dimensions: supply chain provenance, applicable legal jurisdiction, data residency, audit rights, EU key management, NIS2 compliance, GDPR compliance, and incident response transparency.

The dimension U.S. hyperscalers cannot satisfy as direct operators is legal jurisdiction. AWS, Azure, and Google Cloud parent companies remain subject to U.S. CLOUD Act orders, which can compel data disclosure regardless of where that data physically sits. That jurisdiction exposure — not technical capability — is what SEAL-2 is designed to address.

Wider Implications

Several EU member states are actively revising their own cloud procurement frameworks in alignment with the Commission’s approach. If SEAL-2 becomes the de facto baseline across member states, the combined market for EU-qualified cloud services could be worth tens of billions over the next decade. OVHcloud, Scaleway, and StackIT gain not just a contract but a reference architecture they can replicate for national government tenders across the bloc.

The EU just put €180 million behind what was previously just a policy aspiration. That changes the market.