In May 2025, Google Cloud unveiled significant enhancements to its Sovereign Cloud offerings, aiming to address the growing demand for digital sovereignty among European governments and enterprises. This is welcome, especially in light of the sovereignty challenges I recently highlighted in my blog “Why US Isolationism is Now a Global Cloud Risk.” But do they go far enough?
.png)
Figure 1: Cloud Sovereignty Risks
These announcements build on the sovereign solutions that Google previously provided. Google cloud has a significant global footprint, with more than 42 cloud regions, 127 zones, 202 network edge locations, and 33 subsea cables.
In this blog I will examine how these developments align with the four key dimensions of sovereignty: Data Sovereignty, Operational Sovereignty, Infrastructure Sovereignty, and Technology Sovereignty.
Data Sovereignty: Ensuring Control Over Data Location and Access
Google Cloud’s Commitment
Google Cloud has introduced the Google Cloud Data Boundary, via assured workloads, enabling customers to control where their data is stored and processed, with options to confine data within specific regions such as the EU. This service includes features like customer-managed encryption keys, confidential computing, and User Data Shield, which leverages Mandiant services to validate the security posture of customer applications.
Residual Risk
Despite these measures, Google Cloud remains a U.S.-based company and is subject to U.S. laws like the CLOUD Act. While technical controls are in place to mitigate unauthorized access, legal obligations may still pose challenges to complete data sovereignty.
Operational Sovereignty: Localized Control and Oversight
Google Cloud’s Commitment
To enhance operational sovereignty, Google Cloud has partnered with local entities across Europe. Notably, in France, it collaborates with Thales through the S3NS joint venture to provide cloud services that comply with France's SecNumCloud standards. Similar partnerships are being established in Germany with the Schwarz Group and T-Systems as well as in other countries across the world.
Residual Risk
While these partnerships offer localized control, the extent to which they can operate independently of Google's global infrastructure and policies remains to be fully demonstrated. The effectiveness of these arrangements in providing true operational autonomy is yet to be assessed.
Infrastructure Sovereignty: Isolated and Secure Cloud Environments
Google Cloud’s Commitment
Google Cloud has developed Google Cloud Dedicated and Google Cloud Air-Gapped solutions. The former offers dedicated infrastructure operated by local partners, while the latter provides a fully isolated environment with no connectivity to external networks, suitable for sensitive workloads in sectors like defense and intelligence.
Residual Risk
Implementing and maintaining such isolated environments can be complex and resource intensive. Additionally, the reliance on Google's technology stack may still introduce dependencies that could affect complete infrastructure sovereignty.
Technology Sovereignty: Reducing Dependence on Proprietary Technologies
Google Cloud’s Commitment
Google emphasizes support for open-source technologies and interoperability. The Google Cloud Platform leverages open-source technology in several key areas, from underlying infrastructure to AI and machine learning tools. It uses open-source projects like Kubernetes and TensorFlow as building blocks for its services and offers many of these as fully managed services. This is intended to allow for the deployment of workloads on-premises or at the edge, providing flexibility and reducing lock-in to proprietary systems. The integration of AI models like Gemini into these environments further supports technological autonomy.
Residual Risk
Despite these efforts, some core services and tools remain proprietary, which could limit the ability of organizations to switch providers or fully customize their cloud environments. Achieving complete technology sovereignty may require further openness and standardization.
Conclusion: Progress Towards Sovereignty with Ongoing Challenges
Google Cloud's recent announcements represent a key step towards addressing the sovereignty concerns of European customers. By enhancing data control, fostering local partnerships, and offering isolated infrastructure options, Google is aligning its services with the requirements of digital autonomy.
However, challenges persist, particularly concerning legal jurisdictions, operational independence, and technological dependencies. Organizations must carefully evaluate these factors when considering Google Cloud's offerings in the context of their sovereignty objectives.
To learn more about this and other cyber security development register for Identity-Centric Cybersecurity Impact Day 2025 in Frankfurt November 6th, 2025.
