In partnership with
Google spent over $40 billion on cloud infrastructure in 2025 alone. AWS spent more.
Earlier this May, Thales announced a wholly owned cloud subsidiary in Germany, staffed entirely by German personnel, running on Google's technology, under a legal structure that makes it unreachable by American law.
Europe did not build a rival to Google Cloud. It built a cage around it and kept the key.
The structure works like this. The German subsidiary is a separate legal entity under German law. No non-European entity, including Google itself, has access to the data stored or processed within it. The encryption keys are controlled by the subsidiary. Operational management sits entirely within German jurisdiction.
The US CLOUD Act, which compels American companies to hand over data regardless of where it is physically stored, cannot reach this entity. The entity is not American.
This is not a new experiment. Thales already runs an identical structure in France called S3NS. At the end of 2025, S3NS achieved SecNumCloud 3.2 qualification, the highest level of France's sovereign cloud certification, with nearly 1,200 technical requirements designed specifically to shield data from extraterritorial foreign law. The French version is operational and serving government and regulated industry clients today.
The German version is in preview now. General availability is targeted for the end of 2026.
Together they create something that has not existed before. A pan-European sovereign cloud with geo-redundant disaster recovery across two countries. If the French data center goes down, German operations continue. If the German one falls, France picks up. The resilience is continental. The jurisdiction is European. The technology is Google's.
The mechanism Europe used here is worth naming precisely because it applies far beyond cloud infrastructure.
Thales did not negotiate with Google for data sovereignty. It created a legal wrapper that made the question of Google's intentions irrelevant. The technology operates under conditions Google cannot override, not because Google agreed to those conditions as a matter of policy, but because the legal entity controlling the infrastructure sits outside Google's jurisdiction entirely.
ASML's machines are used by American chipmakers, but the export license is Dutch. Airbus flies with engines from multiple countries, but the aircraft certification is European. In each case, Europe leverages the best available global technology while retaining legal and operational control over how it is deployed and under what conditions it can be restricted.
The pattern has a name. Architectural sovereignty. Not protectionism. Not rejection of American technology. The deliberate construction of legal and institutional structures that ensure technology serves European interests regardless of who originally built it.
The EU's tech sovereignty package, expected this week, will formally restrict American cloud providers from handling sensitive government data across the entire bloc. Every European ministry still running sensitive workloads through an American provider is now operating against a closing window.
The LA Mayor Odds Are Moving. June 2 Is the Deadline.
Bass at 68%, Pratt at 27% — and $21M already trading on the outcome. The best trades happen before the picture gets clear. Get in now and get $10 free to start.
Trade responsibly.
The German market is the immediate opportunity.
Germany's new C3SA framework sets the security and sovereignty requirements that any cloud provider must meet to serve the German public sector and regulated industries, including healthcare, finance, energy, and critical infrastructure. The Thales subsidiary is being developed to meet C3SA requirements from day one.
For builders developing AI products or services for European clients, the procurement signal is specific.
The question your clients' compliance teams are asking is no longer whether sovereign infrastructure is required. It is which certified provider meets their timeline and which integrations need rebuilding on top of it. Migration tooling, compliance gap analysis, C3SA-ready architecture consulting, SecNumCloud-compatible data pipelines. The cage exists. The ecosystem around it is still being built.
That gap does not stay open long.
404 Found covers AI developments from a European Insider, three times a week.
Are you running your business on incomplete numbers?
Most small business owners have financials, but few have financial clarity. There's a real difference between books that are technically up to date and books that actually tell you what's going on in your business right now. When accounting is reactive — updated when there's time, reviewed at tax season — you lose visibility exactly when you need it most. You can't tell which clients are truly profitable. You can't spot a cash flow gap before it becomes a crisis. BELAY's outsourced accounting team changes that.