Hi, I’m Mustafa Isik, Chief Technologist, Sovereign Cloud, Amazon Web Services. I lead a team of technology and compliance specialists focused on digital sovereignty, working closely with customers, partners, regulators, but also national and international cybersecurity authorities in Europe and globally. In this presentation, I will give you a comprehensive overview of the AWS European Sovereign Cloud, what it is, how it’s built, why it matters, and what’s available to you today. I’ll walk you through the sovereignty assurances we’ve designed into the architecture, the compliance milestones we’ve already achieved, the services and capabilities available, and real examples of organizations building on it today.
Whether you’re evaluating sovereign cloud options, navigating regulatory requirements like DORA or NIS2 or simply exploring how to innovate without compromising control, this session is for you.
What is Digital Sovereignty? What are the key differences between data sovereignty and operational sovereignty? How does digital sovereignty differ from traditional data residency?
There is no single definition of digital sovereignty. It means different things to different organizations, depending on their industry, their regulatory environment, and their risk posture. But from our conversations with thousands of customers, partners and regulators, we’ve identified consistent themes. At AWS, we organize these into two core dimensions.
What are the key pillars of AWS European Sovereign Cloud?
First, data sovereignty.
This is about data residency: where your data physically resides? And it’s about operator access restrictions: who can access your data and under what conditions?
Second, operational sovereignty.
This is about the resilience and survivability of your infrastructure, and it’s about independence and transparency, understanding how your cloud operates and ensuring that it can function when exposed to different types of disruptive scenarios. These are the principles that guide everything we build and operate regarding digital sovereignty. They’re not abstract; they’re engineering requirements that drive real design decisions.
The AWS Cloud is sovereign-by-design. Let me explain what that means. We offer a comprehensive set of cutting-edge technical measures, operational controls, and contractual protections that give customers control over where their data is located, who can access it, and how it’s used.
Security is and has always been our top priority at AWS. It’s fundamental to digital sovereignty.
You cannot have sovereignty without security, and we’ve built both into the foundation of our cloud from day one.
We have the most proven operational experience of any cloud provider. Our customers benefit from a cloud and network architecture designed to meet the requirements of the most security sensitive organizations on the planet. Millions of customers around the world rely on AWS not simply for innovative technology, but for a secure and trustworthy foundation on which that technology operates.
To provide greater transparency and assurance, we continue to pursue and obtain third-party attestations, accreditations, and certifications. Today, AWS supports more than 140 security standards and compliance certifications globally. But we know that for some customers, particularly in the European public sector and highly regulated industries, and for some of their workloads, they need something complementary that caters to different interpretations of specific requirements in the domains of data privacy, data protection, cybersecurity, and resilience and transparency. And that’s exactly why we built what I’m about to show you.
AWS offers a wide range of capabilities from distributed cloud to edge computing to meet requirements with capabilities wherever customers need them. Customers take advantage of the same services, same architecture, same APIs, and same tools across all environments. That consistency is critical. It accelerates innovation, increases operational efficiency, reduces costs, and helps you meet industry and government specific compliance standards without rearchitecting. This includes AWS regions, local zones, outposts, dedicated local zones, AI factories, and hybrid cloud and far edge solutions like EKS anywhere and IoT. And it includes the AWS European Sovereign Cloud.
What makes it unique, and why it matters for European organizations?
We announced the general availability of the AWS European Sovereign Cloud on January 15, 2026. The AWS European Sovereign Cloud Region is located in the state of Brandenburg, Germany, supported by €7.8 billion investment in infrastructure, talent and skills development.
Everything needed to operate the AWS European Sovereign Cloud is located in the European Union. The talent, the technology, the infrastructure, the leadership.
What you find in the AWS European Sovereign Cloud is the experience you know from our other AWS Regions. The resilience of multiple availability zones, the security of the AWS Nitro system, encryption capabilities, and the full depth of AWS services.
The AWS European Sovereign Cloud also has separate billing and usage metering systems operating entirely within the region. But there is more. The AWS European Sovereign Cloud is built on four fundamental assurances.
The first assurance is enhanced data residency. Customers have always had control over the location of their data in AWS. Your customer content, the data you upload to S3 buckets, stored in RDS databases, and so on, stays within the AWS Region you select. That’s true in every AWS Region globally.
The AWS European Sovereign Cloud goes further. It allows customers to keep all the metadata they create within the EU. Elements like roles, permissions, resource tags, and configurations you use to operate on AWS. This is a meaningful distinction for organizations with broad EU data residency requirements. It’s important to note that sovereignty is a continuum.
Customers can choose to deploy their data to any of our 8 existing AWS European regions to keep data securely in Europe, or they can build on our 6 regions located within EU member states to meet specific EU data residency needs.
The AWS European Sovereign Cloud provides the broadest level of residency assurance for those who require it.
The second assurance is operational autonomy.
The AWS European Sovereign Cloud has no critical dependencies, physical or logical, on any AWS infrastructure outside of the EU. It is more than a region; it is an independent cloud.
Daily operations, technical support, and customer services are provided exclusively by EU residents who are located in EU member states and subject to EU law. Data centers are exclusively managed by EU residents located in the EU.
We are also gradually transitioning the AWS European Sovereign Cloud to be operated exclusively by EU citizens located in the EU. During this transition period we will continue to work with a blended team of EU residents and EU citizens located in the EU.
Its unique design allows it to continue operations indefinitely, even in the event of disruption of communications with the rest of the world.
To support continuity, even in extreme circumstances, authorized AWS employees of the European Sovereign Cloud have independent access to a replica of the source code necessary to maintain services.
That is a level of operational independence that is unique to the AWS European Sovereign Cloud.
The third assurance is European governance.
Who controls AWS European Sovereign Cloud?
AWS has established a dedicated governance structure in Europe. We incorporated a new parent company, AWS European Sovereign Cloud GMBH, in Germany, along with 3 local subsidiaries, one for infrastructure, one for research and development, and one serving as a trust and certificate provider.
The AWS European Sovereign Cloud is led by EU citizens who are required to comply with European laws and act in the best interest of the region.
Two EU member state citizens are proud to serve as managing directors. Stéphane Israël, whose appointment was announced in September 2025, and Stefan Hoechbauer, who was appointed as co-managing Director in January 2026, bringing executive expertise in compliance and regulation. Hoechbauer also holds the position of VP of AWS Global Sales Germany and Europe Central.
We’ve also established an independent advisory board composed of five members, all EU citizens and residents, of which two are independent and not affiliated with Amazon.
This board serves as a source of expertise and provides accountability on all aspects related to the sovereignty of the European sovereign cloud. Zero operational control resides outside of the EU. That’s by design.
The fourth assurance is our sovereign reference framework, the AWS European Sovereign Cloud: Sovereign Reference Framework (ESC-SRF). The ESC-SRF is available today in AWS Artifact. It lists sovereignty criteria across multiple domains. Governance independence, operational control, data residency, and technical isolation.
The ESC-SRF was developed by working backwards from our customers’ sovereign use cases.
We incorporated direct customer feedback, EU regulatory requirements across multiple member states, industry leading framework guidance, AWS’s own contractual commitments, and input from our implementation partners.
It’s industry and sector agnostic, written to address fundamental sovereignty needs at the foundational layer of cloud.
The framework builds on core AWS security capabilities, encryption, key management, AWS Nitro-based isolation, and internationally recognized compliance certifications.
On top of that, it adds sovereignty specific measures, independent EU corporate structures.
Dedicated EU trust and certificate services, operations by EU resident personnel, strict residency for customer data and customer created metadata, complete separation from all other AWS regions and incident response operated from within the EU.
Why is the AWS European Sovereign Cloud: Sovereign Reference Framework (ESC-SRF) particularly valuable?
The ESC-SRF serves a dual purpose. First, it’s an assurance model, providing end to end visibility from each Sovereignty criterion through to its implementation in a manner that can be independently validated by a third-party auditor. Customers can use this with internal auditors, external assessors, supervisory authorities, and regulators. It reduces the need for ad hoc evidence requests.
Second, it’s a design reference. Customers and partners can leverage the ESC-SRF as a foundation upon which they build their own complementary sovereignty criteria and controls. You can refer to the framework when shaping your own sovereignty architecture, selecting configurations and defining internal controls. Because it’s sector agnostic, you apply only the criteria relevant to your specific use case. Each criterion is implemented through sovereign controls that are independently validated by a third-party auditor. This provides clear, enforceable sovereignty assurances, not marketing promises.
What compliance certifications does AWS European Sovereign Cloud have?
Now, let me share something that our customers are building on today. In March 2026, just two months after general availability, we announced our first major compliance milestone, SOC 2 and C5 Type 1 attestation reports, along with seven key ISO certifications for the AWS European Sovereign Cloud.
The attestation reports already cover 69 services operating within the AWS European Sovereign cloud. That’s 69 services with independently validated security controls. The SOC 2 report addresses three critical AICPA trust services criteria, security, availability, and confidentiality. It includes internal controls mapped directly to the ESC-SRF.
Independent auditors validated the design and implementation of our controls, addressing EU corporate structures, EU resident personnel operations, strict residency requirements, and complete separation from all other AWS regions.
The C5 attestation, which is the German government backed Cloud Computing Compliance
Criteria Catalog introduced by BSI, is one of the most comprehensive cloud security standards in Europe, if not globally.
Our C5 Type 1 report confirms we meet both the basic criteria and the additional criteria. The basic criteria cover fundamental security requirements across more than a dozen domains. The additional criteria address enhanced requirements for handling sensitive data and critical applications, making this attestation particularly valuable for customers with the most stringent sovereignty requirements.
And the seven ISO certifications, ISO 27001 for information security management, ISO 27017 for cloud specific security controls, ISO 27018 for personal data protection and cloud environments, ISO 27701 for privacy information management, ISO 22301 for business continuity and organizational resilience, and ISO 20000-1 for IT service management. And finally, ISO 9001 for quality management. These certifications collectively demonstrate comprehensive operational excellence.
They confirm that the AWS European Sovereign Cloud has been integrated into Frameworks for managing security, privacy, continuity, service delivery, and quality, meeting the highest standards through systematic risk management and continuous improvement, based on certifications and criteria that are well established and highly relevant today.
By securing these foundational certifications early in our implementation, we’re demonstrating that security, transparency, and regulatory alignment have been part of the DNA of the AWS European Sovereign Cloud from day one. And this is just the beginning of our certification portfolio.
Which European regulators have endorsed AWS European Sovereign Cloud?
The response from European regulators and policymakers has been resounding. We’ve received public endorsements from officials in 14 European countries supporting the European sovereign cloud, including the president of Germany’s BSI, the Czech Republic’s National Cyber and Information Security Agency, and Romania’s National Cybersecurity Directorate. Claudia Plattner, president of the BSI, put it clearly. “The development of a European AWS Cloud will make it much easier for many public sector organizations and companies with high data security and data protection requirements to use AWS services.”
We continue to apply lessons learned from our engagements with regulators and National cybersecurity authorities across Europe. This isn’t a one-time effort. It’s an ongoing and deep collaboration. The AWS European Sovereign Cloud is fully featured, and we’re continuing to expand our services and capabilities.
What services are available today on AWS European Sovereign Cloud? What support is available?
This is a critical point. The AWS European Sovereign Cloud offers the full power of AWS services.
We launched with more than 90 services, and today, more than 110 services are already available. And this is just the beginning. This includes compute, storage, databases, analytics, networking, machine learning and artificial intelligence, developer tools, security services, enterprise applications, containers, cloud financial management, and AWS marketplace.
You shouldn’t have to choose between sovereignty and capability. And with the AWS European Sovereign Cloud, you don’t have to.
Can customers use the same APIs and tools across AWs European Sovereign Cloud and standard AWS regions?
You get both the same services, same APIs, same tools you already know, operating in an environment that caters to stringent sovereignty requirements.
Can I use AI/ML on sovereign infrastructure? What AI models are available?
AI is where many of our customers are placing their biggest bets right now, and they choose to do it on dedicatedly sovereign infrastructure.
The AWS European Sovereign Cloud delivers the full range of AWS AI and machine learning services. This includes Amazon SageMaker to build, train and deploy custom machine learning models, Amazon Bedrock to work with foundation models and generative AI applications, and Amazon Quick for AI powered assistance and productivity.
In the coming months, customers will also gain access to new AI capabilities, including Nova 2 Lite and open weight models from Mistral AI and OpenAI on Amazon Bedrock. This gives organizations greater choice to build generative AI applications that meet their sovereignty, performance, and cost requirements.
We’re also launching Mantle, Amazon Bedrock’s next generation inference engine. Mantle provides zero operator access, meaning customer prompts and responses are never visible to AWS operators.
Can customers train custom models on sensitive European data?
Your sensitive data remains private by design, inaccessible to anyone but you and who you choose to share data with. You are in control. Mantle also dynamically allocates capacity to requests, improving availability for steady state workloads, while allowing rapid scaling as demand grows.
This gives organizations in highly regulated industries the confidence to run their most sensitive AI workloads; that’s sovereignty and innovation together. We know that organizations need to manage the impact of regulatory changes and geopolitical events on their access to cloud infrastructure. This isn’t hypothetical. Regulatory mandates are accelerating right now.
DORA, KRITIS, NIO, they all raise the bar on resilience, operational control, and third-party risk for regulated European enterprises. Many organizations conclude that they need sovereign infrastructure to meet that bar, and the enforcement timelines are already here.
Customers tell us they need resilience, not just a backup, but don’t know where to begin when it comes to cross-partition sovereignty. That’s why we offer resilience and disaster recovery for the AWS European sovereign Cloud powered by pilot light architecture.
What is the failover process if geopolitical events disrupt connectivity?
Here’s how it works. Your primary workloads run in your existing AWS region. The disaster recovery footprint runs in the European sovereign Cloud, pre-provisioned and kept in sync. If you need to fail over, whether due to a regulatory trigger, or a geopolitical event, or an operational disruption, the full environment scales up on demand entirely within the EU.
No data leaves Europe, no dependency on non-EU regions, no shared identity boundaries.
This is a fully isolated partition with validated architecture, published runbooks, and one click activation.
You don’t need to migrate production workloads. You don’t need to learn a new platform.
This production ready infrastructure positions your organization for European independence and regulatory confidence today, not someday.
We’re going further by offering dedicated features that are unique to AWS European sovereign Cloud. First, dedicated networking infrastructure and connectivity from European providers, including sovereign points of presence for direct network connection via AWS Direct Connect. This gives customers a fully autonomous connection path.
Second, a dedicated Amazon Route 53 instance providing highly available and scalable DNS, domain registration and health checking services. The name servers use only European top-level domains.
Third, a dedicated route European trust service provider, or certificate authority.
All key material, certificates, and identity verification needed for SSLTLS operate entirely within the AWS European Sovereign Cloud. And fourth, a dedicated European Security Operations Center (SOC) that mirrors our global security practices but operates entirely within the EU.
These aren’t add-ons. They’re architectural decisions that ensure end to end sovereignty across every layer of the stack.
Can my existing partners and ISVs work with AWS European Sovereign Cloud? What third-party solutions are available?
To support Europe’s ongoing innovation and evolving sovereignty needs, we’ve built a robust partner ecosystem. We’re proud to have more than 180 launch partners for the AWS European Sovereign Cloud, including partners like OpenText, Vodafone, and Widdix, to name just a few. More than 165 solutions are available on AW’s Marketplace, optimized specifically for the European Sovereign Cloud. I want to highlight one in particular.
Can I run SAP on AWS European Sovereign Cloud?
SAP Cloud ERP Private is now generally available on the AWS European Sovereign Cloud.
This is an SAP sovereign cloud capability, security hardened cloud solutions from SAP aligned with industry standards for regulated industries and governments. These partner solutions inherit the robust security controls and operational independence of the AWS European Sovereign Cloud infrastructure while adding their own sovereignty specific features. Customers benefit from choice, capability and confidence all in one environment. Looking ahead, we’re expanding the AWS European Sovereign Cloud footprint across the EU.
This starts with new AWS local zones located in Belgium, the Netherlands and Portugal to support stringent isolation, in-country data residency and low latency requirements. These local zones will be connected to the AWS European sovereign Cloud parent region in Germany through our redundant high bandwidth private network. They bring sovereign compute and storage closer to customers across the EU enabling workloads that require both local presence, lowest latency, and European sovereignty.
European customers across virtually every regulated industry are using or actively evaluating the AWS European Sovereign Cloud, government at the federal, state and local level, healthcare, financial services, defence and aerospace, energy and utilities, telecommunications, manufacturing, research institutions, SAS and ISV providers, and many more. The common thread.
Organizations that need to accelerate innovation while adhering to strict compliance and data sovereignty requirements. They want the full power of cloud without compromising on control.
Are other organizations in my industry using AWS European Sovereign Cloud?
I’d like to share a few examples in the Financial and Healthcare sectors.
SCHUFA is one of Germany’s leading providers of credit information, protecting the financial data of more than 69 million German consumers. They’re migrating workloads from on-premises data centers and other cloud environments to the AWS European Sovereign Cloud.
As part of their digital transformation, SCHUFA has built a new credit scoring system that shows consumers exactly how their credit worthiness is assessed, including the criteria used and how they’re weighted. Dr. Klaus Kolitz their CTO, puts it perfectly.
‘The AWS European Sovereign Cloud gives us what we need a fully isolated Infrastructure within the EU operated exclusively by EU resident staff with no access from outside Europe. And the best part, we don’t have to sacrifice innovation for sovereignty. We get both.’ That’s the promise of the European Sovereign cloud, and SCHUFA is living proof that it delivers. European organizations are also choosing the AWS European Sovereign Cloud as the foundation for developing new AI capabilities.
The University of Hospital Essen is a leading healthcare center in the Ruhr region, highly respected for clinical research and development of new technologies and treatment methods. ‘Their Institute for Artificial Intelligence in Medicine brings together researchers developing AI methods that improve patient care’. Professor Jens Kleesiek, the Institute’s director, says it clearly. ‘The AWS European Sovereign Cloud will support their mission by allowing them to work with health data at scale while meeting German and European sovereignty expectations.’
These are just a couple of examples. There are many more. Healthcare, finance, government, energy. Organizations across Europe are building on the European sovereign cloud today. As we discussed, there is real complexity involved in digital sovereignty. The regulatory landscape is evolving. Geopolitical dynamics are shifting.
Organizations need to move forward with confidence, and that means partnering with a cloud provider that has both the technical depth and the long-term commitment to get this right. A partner that is recognized for uncompromising customer obsession. A partner that has the experience, the track record of operational excellence, and innovation capacity to back it up.
Adopting cloud solutions that align with local regulatory frameworks, respect data privacy commitments, and adhere to the highest security standards. That’s how organizations drive innovation while meeting their requirements. It can be difficult to navigate this ever-changing landscape, but you don’t have to do it alone. Working with our AWS team and our partners can help you move faster and more efficiently while keeping costs manageable.
AWS remains committed to offering customers the most advanced set of sovereignty controls and security available in the cloud. The European sovereign cloud is a checkbox.
It’s an ongoing investment, a €7.8 billion investment, 180 plus partners, 69 services already certified, more than 110 services delivered, explicit endorsements from across 14 countries, and we’re just getting started. I look forward to seeing what we can accomplish by working together.
You launched the AWS European Sovereign Cloud with 90+ services. What’s available today, and how do you decide what gets added next?
We launched the AWS European Sovereign Cloud in January 2026 with over 90 services.
Today, that number has grown to more than 110 services, covering compute, storage, databases, analytics, networking, machine learning and AI, security, containers, developer tools and enterprise applications. The full breadth of what you need to build production workloads is already there.
In addition, AWS Marketplace already offers over 165 solutions optimized for the European sovereign cloud. So, you’re not just getting AWS services, you’re getting the ISVs alongside it.
How do we decide what services and features get added to the AWS European Sovereign Cloud next?
We work backwards from customer demand. The prioritization factors are direct customer requests, regulatory requirements, and the workload patterns we observe across industries.
New services are added regularly, and customers can directly influence the roadmap through their account teams. This is not a static list. It’s a continuously expanding portfolio driven by what you tell us you need.
How does AI work within the AWS European Sovereign Cloud, and what protections ensure that customer data stays private?
This is one of the most frequent questions we receive, and it’s a great one.
The full range of AI and machine learning services is available in the European Sovereign Cloud, SageMaker, Bedrock, Amazon Quick with the same APIs and the same developer experience. There is no compromise on capability.
All the data sovereignty protections I described earlier apply equally to AI workloads.
Your data stays within the AWS European Sovereign Cloud and critically, your data is never used to train AWS Foundation models without your explicit consent. Bedrock’s inference engine provides zero operator access.
Your prompts and responses are never visible to AWS operators. You also have your choice of models, open weight models from providers like Mistral AI as well as AWS’s own Nova models running on sovereign infrastructure. And of course, encryption at rest and in transit applies to all AI workloads with full KMS integration for customer managed keys. So, you get the innovation of generative AI with the sovereignty guarantees of the European sovereign cloud, no trade-off required.
What certifications and compliance frameworks the AWS European Sovereign Cloud support?
The AWS European Sovereign Cloud achieved its first compliance milestone in March 2026, just two months after general availability.
We now have SOC 2 Type 1 and C5 Type 1 attestation reports, along with seven ISO certifications. The SOC 2 report addresses three critical trust criteria security, availability, and confidentiality, and includes controls mapped directly to the sovereign reference framework. The C5 attestation, which is the German government backed cloud security standard from BSI, meets both basic criteria and additional criteria. That’s the most rigorous level.
The seven ISO certifications cover information security management, cloud-specific security controls, personal data protection in cloud environments, privacy information management, business continuity and organizational resilience, IT service management, and quality management. Together, these attestation reports cover 69 AWS services operating within AWS European Sovereign Cloud.
All these reports are available to customers directly in AWS artifact from the European Sovereign Cloud console, self-service, on demand, anytime when you need them. I want to highlight this is the beginning of our certification portfolio, not the end. We are expanding our compliance coverage continuously based on customer needs. And remember, the AWS European Sovereign Cloud Sovereign Reference Framework is the overarching sovereignty framework that ties everything together, independently audited, publicly available, and designed so that customers can adapt it to their own specific use cases. The shared responsibility model applies. We provide the certified sovereign infrastructure, and you build your workloads on top, inheriting the controls that we’re responsible for, accelerating your path to compliance while reducing your cost of compliance, since you can focus on your part of the shared responsibility model.
This article was submitted by AWS. You can find more information about the company’s capabilities through this link.