The invisible dependency
For cloud and AI, Europe mainly uses services from US corporations. What this means for companies, what Gaia-X was supposed to achieve and which European alternatives exist.
When a European company sends an email, stores a document in the cloud or runs an AI analysis today, this data is highly likely to pass through the servers of a US corporation. According to data collected by Synergy Research Group, Amazon Web Services, Microsoft Azure and Google Cloud Platform together account for 70 per cent of the European market for cloud infrastructure services (IaaS, PaaS and Hosted Private Cloud), while all European providers together have remained at around 15 per cent since 2022 (Synergy Research Group, “European Cloud Providers' Local Market Share Now Holds Steady at 15%”, 24 July 2025, based on data for the full year 2024 and the first half of 2025, srgresearch.com). European alternatives such as OVHcloud, Deutsche Telekom (Open Telekom Cloud) and German data centre operators share the remainder.
These figures do not just describe an economic situation. They describe a strategic dependency. European companies, public authorities and hospitals have outsourced their digital infrastructure to firms that are subject to US law. For providers subject to US law, the CLOUD Act, FISA Section 702 and Executive Order 12333 can apply even if the servers are located in Frankfurt, Amsterdam or Paris. In its Recommendations 01/2020, the European Data Protection Board (EDPB) made it unequivocally clear that technical measures alone cannot eliminate this risk as long as the provider itself falls under US jurisdiction.
The dependency goes beyond cloud storage. It continues with artificial intelligence: many of the models used in European companies today come from US providers. This creates a double dependency: on the infrastructure where the data is stored, and on the models that analyse it.
China: the National Intelligence Law
While the debate on digital sovereignty in Europe often focuses on the USA, there is an at least equally threatening legal regime on the other side. The National Intelligence Law of the People's Republic of China (国家情报法), which came into force on 28 June 2017, obliges all Chinese organisations and citizens in Article 7 to support national intelligence work and to cooperate with the intelligence services. Article 14 expressly allows the intelligence services to compel companies to provide technical support, data and information.
The scope of this law is enormous: it applies worldwide and without exception to every Chinese company, regardless of whether it operates in Beijing, London or Berlin. For European companies, this means a concrete risk when using products from Chinese manufacturers. The debate about Huawei in the field of 5G infrastructure was only the most visible tip of this iceberg. The same structural question arises for all providers subject to this law: Articles 7 and 14 oblige them to cooperate with the intelligence services.
The German Federal Office for Information Security (BSI) has pointed out the risks posed by technology from untrustworthy third countries in several statements. The ENISA Threat Landscape 2024 lists state-directed cyber attacks and data leakage via commercial products as a growing threat to European companies. Digital dependency therefore does not only concern US providers. Europe stands between two superpowers that have both created legal instruments to access the data of foreign companies, and it needs an independent response to this.
USA: when access is switched off
Dependence on US services is not just a data protection problem. It is an operational risk. And this risk does not only exist in crisis regions. Transatlantic relations between the USA and Europe are subject to political cycles, trade disputes and changing governments. The tariff escalation between the USA and the EU in spring 2025 showed that economic pressure is used even between allies.
Trade conflicts, political crises or new export restrictions can affect access to services from third countries. Anyone who wants to safeguard their own ability to act spreads this risk deliberately.
The German Federal Government AI Strategy (updated 2025) names the "reduction of critical dependencies on non-European providers" as one of five strategic goals. This is not anti-Americanism. It is economic common sense. No European company would entrust its power supply to a single foreign supplier. With digital infrastructure, almost all of them do.
Gaia-X: ambition and current status
When the then German Federal Minister for Economic Affairs Peter Altmaier and his French counterpart Bruno Le Maire presented the Gaia-X project in October 2019, the vision was ambitious: a sovereign European cloud infrastructure, which meets European data protection standards and reduces dependence on US hyperscalers. The idea was to create a federated system in which European cloud providers offer their services via common standards and interfaces, interoperable, transparent and GDPR-compliant.
What happened next is a textbook example of the difficulties of European technology policy. Gaia-X grew from a Franco-German project into a consortium with more than 350 members, including Amazon Web Services, Microsoft Azure, Google Cloud, Alibaba and Palantir. The original idea of an alternative to the hyperscalers turned into a forum in which precisely these hyperscalers helped write the standards that were actually supposed to regulate them. Several European founding members, including Scaleway (France), left the project in protest at the dilution of the sovereignty goals.
Today, Gaia-X still exists and works on compliance labels and data space standards, but the original vision of a European cloud alternative has not been fulfilled in this form. The CISPE (Cloud Infrastructure Services Providers in Europe) stated clearly in its 2024 position paper: Gaia-X has done valuable groundwork on interoperability standards, but as an instrument for establishing digital sovereignty it has missed its goal. This does not mean that the need has disappeared, quite the opposite. It means that digital sovereignty will not come from a single prestige project, but from concrete products that work and that European companies actually use.
Mistral and Aleph Alpha: Europe's answer
While Gaia-X got stuck in the political process, the real European answer emerged where innovation happens: in start-ups. Mistral AI, founded in Paris in May 2023 by former researchers from Google DeepMind and Meta AI, has built its own family of language models within just a few years, including freely available open-weight models. According to Mistral's model overview, the flagship Mistral Large 3 is now also available under the Apache 2.0 licence (Mistral: Models Overview, accessed on 23 September 2026). It comes from a European company based in Paris.
On the German side Aleph Alpha, founded in Heidelberg in 2019, has chosen a different path. Instead of targeting the consumer market, Aleph Alpha focuses on public authorities, defence and regulated industries. With its "Sovereign AI" platform, it offers on-premises deployment and operation on European infrastructure, an offering that is particularly relevant for the public sector and critical infrastructure. The German Federal Government has identified Aleph Alpha as a strategic company within the national AI strategy, and partnerships with Forschungszentrum Jülich and the DFKI underline the company's importance for the German AI landscape.
Both companies show that Europe no longer has to depend on US models. The quality is there. The infrastructure is there. European companies therefore have a real choice. As part of the "France 2030" programme, the French government has invested more than €500 million in AI companies. The German Federal Government AI Strategy 2025 provides for additional funding for sovereign AI infrastructure. The political will exists. Now it has to reach business practice.
Whoever controls the AI controls the data
The debate on digital sovereignty is often reduced to the question "Where are the servers?" That falls short. The crucial question is: Who controls the processing? Because with artificial intelligence, data is not simply stored: it is analysed, linked, interpreted and turned into decisions. An AI model that processes your customer data, analyses your contracts or optimises your business processes has a deep understanding of your organisation. Whoever controls this model controls this knowledge.
This is the fundamental difference between cloud storage and AI infrastructure. A document stored on a server can be copied, but it first has to be read and understood before it can be evaluated. An AI model that has processed thousands of your documents has already carried out this evaluation. It knows your customer structure, your pricing, your internal weaknesses. That is why, with AI, what counts is not only the storage location but also who controls the processing and which law that provider is subject to.
The EU AI Act, which came into force on 1 August 2024, addresses transparency and risk classification, but does not go far enough on the question of infrastructure sovereignty. It regulates how AI systems may be used, not who owns the computing capacity and the models they run on. The concentration of AI capacity among a few non-European providers remains unaffected. If Europe wants to remain economically and politically capable of acting in the AI era, it must not only have its own models. It must control the entire chain: from the hardware and the training infrastructure to the deployment platform on which companies use these models.