The Agentic Cloud: Where Europe Can Still Win the Next Platform

Layer 6 — The agent runtime and the tool layer

• Who controls it today. Nobody yet, in any settled way. Agent frameworks, tool-calling conventions and the emerging Model Context Protocol (MCP) ecosystem are young. Each hyperscaler is building its own agent platform. Enterprises are assembling agents from open frameworks, vendor SDKs and custom code.

• What sovereign can mean: own. This is the most important layer in the whole stack, and the one where European ownership is most feasible. The agent runtime is where work happens:

  • credentials are held;

  • tools are invoked;

  • decisions are taken, logged and, in principle, reversed.

  An agent runtime run by a provider under foreign jurisdiction is a channel through which foreign law can reach not just data but action. The German Interior Ministry’s legal opinion finds the CLOUD Act reaches data wherever a US company has “control”, and reads control broadly (German legal opinion, pp.3–5). In the agentic era that reach extends to the agent’s working memory and its keys.

• Where a European operator can win. By offering a jurisdiction-clean agent runtime with audit built in: a place where agents run under EU law only, every tool call is logged in a tamper-evident form, and the customer holds the keys. Here the old hyperscaler advantages of a vast catalogue, global regions and frontier models count for least, and trust counts for most.

Layer 7 — Identity, keys and audit

• Who controls it today. Mostly the platform providers’ own identity and key services, with customer-managed keys as an option. Workplace identity in most European organisations runs through Microsoft.

• What sovereign can mean: own. Keys and audit trails are small, cheap and decisive. Customer-held keys in European hardware security modules, and audit logs stored under European control, change the legal position materially.

  • The limit of encryption. The German legal opinion cautions that a provider which locks itself out by encryption may still face US preservation and discovery duties, with sanctions for non-compliance (German legal opinion, pp.6–7). Encryption helps most when the provider itself is outside US jurisdiction.

  • Workspace by STACKIT. It shows the hybrid: Google Workspace with client-side encryption and keys held in STACKIT data centres, used to move about 600,000 Schwarz Group workplaces off Microsoft Office (STACKIT workplace migration).

• Where a European operator can win. By making the key and audit layer portable across clouds, so a public body can hold its keys and its agent audit trail in one sovereign place even while some workloads run elsewhere.

Layer 8 — Enterprise data and systems of record

• Who controls it today. European software is strong here. SAP runs the financial and operational core of a large share of European enterprises. Industrial data sits with Siemens, Bosch and thousands of manufacturers. Public registers sit with states.

• What sovereign can mean: own, through gravity. This is where Europe holds the asset the agentic cloud most needs: the data agents must act on.

  • RISE with SAP on STACKIT. It became commercially available in September 2026 at price parity with US hyperscalers. Deployments start in November 2026, and STACKIT describes itself as the “first European hyperscaler” in the programme (SAP launch).

  • Why it matters. It puts the European system of record and a European agent platform in the same jurisdiction and, ideally, the same data centre.

• Where a European operator can win. By co-locating agents with the systems of record they act on, which cuts latency, egress and legal exposure at once. Celonis running single-tenant on STACKIT, and Snowflake integrating with STACKIT key management, point the same way (Schwarz Digits press release, 17 September 2026, schwarz-digits.de).

Layer 9 — Sector applications

• Who controls it today. Fragmented: thousands of European software firms, systems integrators and public-sector IT providers, plus the hyperscalers’ own vertical offerings.

• What sovereign can mean: federate. No single operator should own the application layer. Policy should make it easy for European software firms to build agents on any sovereign infrastructure.

  • openDesk. The German open-source workplace suite, steered by ZenDiS, is the model. STACKIT became its first “Approved Sovereign Service Provider”, a role that requires BSI C5 (public-sector release).

  • Federal AI platform. The German federal AI platform shows the consortium form: SVA as integrator, Codesphere as platform layer, STACKIT as infrastructure, about €250 million in total (STACKIT on the federal AI platform).

• Where a European operator can win. By being the infrastructure partner of choice for European application builders. That means stable APIs, fair revenue terms and no competing first-party application that takes the partner’s market.

What the anatomy shows

Laid out this way, the sovereign agentic cloud is neither impossible nor automatic.

• Own (4 layers): power and sites, AI-factory operations, the agent runtime, and identity, keys and audit. Europe can own these, and with the systems-of-record layer they hold most of the trust value.

• Federate (3 layers): orchestration, models and applications. Here open governance and portability matter more than ownership.

• Rent with exit (1 layer): accelerators. This is the hard dependency, managed through supplier diversity, stockpiles and contracts.

• Own through gravity (1 layer): systems of record, where Europe already holds the asset.

STACKIT’s current profile maps onto this almost exactly:

• Strong: sites, operations, C5 certification, key custody, and SAP co-location.

• Federated by necessity: the models, all of them non-European today.

• Dependent: accelerators a generation behind.

• Undecided: the agent runtime, the layer that matters most, which is still being built in the market.

Part III — Where Europe can win: eight wedges, and the economics that decide them

A wedge is a market segment where a European operator can win on merit:

• the customer’s need is real and growing;

• US-run offerings, including their “sovereign” editions, cannot fully meet it;

• the European operator has an asset the incumbents lack.

Protection can help a wedge open, but it cannot be the reason the wedge exists. That is the lesson of France’s state-built Cloudwatt and Numergy. They failed by 2016 “for lack of market uptake” at a cost to the state of about €56 million, while OVH grew “without having received subsidies” (French Senate 2019, pp.136, 222).

The eight wedges below are ranked by how strong the evidence of demand is and how hard the incumbents would find it to respond.

Wedge 1 — Regulated workloads where jurisdiction is a legal requirement

The need. Banks, insurers, health systems, critical-infrastructure operators and defence suppliers face overlapping obligations: data protection, operational-resilience rules on concentration risk such as DORA, NIS2 security duties and, from 2026, the AI Act’s duties for high-risk systems. Each pushes towards provable control over where the data sits and who can reach it. Even a sceptical law-firm analysis treats DORA’s concentration-risk tools as part of the sovereignty toolkit (Clifford Chance, p.3).

Why incumbents cannot fully answer it. The Dutch government commissioned a legal review of the AWS European Sovereign Cloud. It concluded that the US can gain access to metadata, and that services can be suspended or terminated under US sanctions or executive orders. It rated these risks “improbable” but “not inconceivable” (Dutch legal review of AWS, pp.1–2). The responsible minister drew the plain conclusion that full sovereignty is not achieved (Dutch minister’s letter, pp.1–3). Asked under oath by the French Senate whether it could guarantee that French citizens’ data would never reach foreign authorities without French consent, Microsoft France answered that it could not (French Senate inquiry, p.23).

The European asset. An operator outside US jurisdiction, with EU staff and a security certification that already covers its AI services. STACKIT’s BSI C5 attestation covers compute with GPUs, managed Kubernetes, the major databases and AI Model Serving (STACKIT certificates).

Wedge 2 — Public administration and the sovereign workplace

The need. States are the largest IT buyers in their own economies, and most do not yet know what they run.

• The Netherlands. Central government uses 1,588 cloud services. For 26% of them the type is unknown, and two-thirds of the material public-cloud services had no risk assessment (Dutch Court of Audit, pp.6–7).

• EU institutions. They spent €87 million on public cloud services in 2025 (Commission answer to MEPs, p.1).

• The EU sovereign cloud tender. It is worth €180 million over six years and was scored on the Cloud Sovereignty Framework. It selected four European providers, including STACKIT (STACKIT on the EU tender).

Why incumbents cannot fully answer it. France’s “cloud au centre” doctrine requires particularly sensitive data to sit in a cloud qualified under SecNumCloud and “immune to any unauthorised access by public authorities of third states” (French cloud doctrine, p.9). SecNumCloud caps non-EU ownership at 24% individually and 39% collectively (SecNumCloud rules, pp.50–51). In the protected tier, a US-controlled provider cannot qualify by design.

The European asset. An open-source workplace and agent layer ready to deploy. openDesk is the workplace suite; STACKIT is its first approved sovereign service provider (public-sector release). The German federal AI platform is the agent and infrastructure layer (STACKIT on the federal AI platform). The agentic step comes next: case-handling, drafting and register-query agents running on the same sovereign substrate.

Wedge 3 — Industrial AI on production data

The need. Europe’s comparative advantage is in machines, vehicles, chemicals and energy systems. The data they generate is large, proprietary and commercially sensitive. Industrial agents will plan maintenance, tune processes, check designs and handle supply-chain exceptions, and they need direct access to that data.

Why incumbents cannot fully answer it. Industrial firms fear handing process know-how to a platform that may also serve their competitors or be compelled by a foreign state. Bitkom’s 2025 survey finds 51% of German firms “strongly dependent” on US digital imports. On average, firms say they could survive only about 14 months without foreign digital imports, and 67% say Europe needs its own hyperscalers (Bitkom survey, pp.6–7, 18).

The European asset. European industrial firms and European clouds share one jurisdiction. STACKIT signed a memorandum of understanding with Bosch Mobility in July 2026 (STACKIT news, 8 July 2026, stackit.com), and Siemens and SAP sit inside the IPCEI-CIS cloud consortium. The wedge is industrial agents running next to industrial data, not general chat.

Wedge 4 — The gravity of SAP and other systems of record

The need. Agents that act on enterprise processes must read and write the ERP. Running the agent and the system of record in different clouds and jurisdictions adds cost on every call: latency, egress and legal exposure.

Why incumbents cannot fully answer it. They can host SAP. What they cannot offer is SAP plus agents inside a single European jurisdiction with no US parent.

The European asset. RISE with SAP on STACKIT, at price parity, with deployments from November 2026 (SAP launch). The Schwarz Group itself is migrating its ERP landscape onto it (TECH 2025 release). The group’s own SAP estate is very large; Lidl alone abandoned an earlier migration after seven years and about €500 million (ChannelPartner). That gives a European operator a reference workload that no marketing budget could buy. This may be the single strongest structural asset in the whole European agentic-cloud story.

Wedge 5 — Multilingual, open and auditable models

The need. Twenty-four official languages, many more regional ones, and legal and administrative language that general models handle poorly. Public bodies and regulated firms also need to inspect, fine-tune and freeze the models they rely on.

Why incumbents cannot fully answer it. Closed frontier models cannot be inspected or frozen. Their providers decide when to retire or change them. Open-weight models from US and Chinese labs can be run sovereignly, but their training data and alignment choices are made elsewhere.

The European asset. The open-model ecosystem: Teuken-7B covers all 24 EU languages with about 60% non-English training data (Teuken-7B paper, p.1), plus the European research labs and the merged Cohere and Aleph Alpha. The Linux Foundation finds transparency and auditability are the top benefits of open source for sovereign AI, at 80% in Europe (Linux Foundation survey, p.2). An operator that serves open models with full lineage, from data sheet and weights hash to evaluation record and version freeze, sells something the closed frontier cannot. That STACKIT’s catalogue today lists no European model is the clearest gap in the wedge, and the cheapest to close.

Wedge 6 — Sovereign inference at price parity

The need. Most agent steps do not need a frontier model. Retrieval, extraction, classification, drafting and tool selection can be handled by mid-sized open models at a fraction of the cost. And because agents use about 1,000 times more tokens than chat, the cost per token decides whether an agent deployment pays.

Why incumbents cannot fully answer it. They can match price, but not jurisdiction, at the same time.

The European asset. STACKIT’s open-model prices are already in the commodity range: about €0.45 per million input and €0.65 per million output tokens for 27–120-billion-parameter models, and €0.15 / €0.25 for GPT-oss 20B (STACKIT AI models). For scale, the token-consumption study quotes official frontier pricing of $1.25 per million input and $10 per million output tokens for GPT-5 (agent token study, appendix). The capabilities differ, but the price gap is what makes routing worthwhile: European agents can send most steps to sovereign open models and reserve the frontier for the steps that need it.

Wedge 7 — Energy-advantaged sites outside the congested hubs

The need. Inference capacity close enough to European users for interactive agents, powered by cheap, clean electricity, and connectable this decade rather than the next.

Why incumbents cannot fully answer it. They can and do build in the Nordics. But their European capacity planning is one input to a global allocation, which US policy has already tried to direct: the AI Diffusion rule required US-headquartered cloud firms to keep at least 75% of their AI compute in the US and allied countries (RAND on export rules, pp.3–4).

The European asset. Grids with room. Ember finds the Nordics and Southern Europe will see demand grow about 110% to 2030, nearly double the FLAP-D hubs’ 55%. The Nordics “top the list”, with low congestion, low power prices and carbon intensity, cheap land and less cooling. Norway’s grid operator is planning for a tripling of data-centre demand (Ember, pp.5, 13–14). A European operator with a federated footprint (training and batch work in the north, latency-sensitive inference near users) uses Europe’s geography as an advantage.

Wedge 8 — The agent audit and accountability layer

The need. Once agents act, someone must be able to show what they did, why, on whose authority, with which model version and under which law. The AI Act’s logging and human-oversight duties, financial supervisors’ model-risk expectations and public-law accountability all converge here. The EU’s own procurement framework rewards EU-only security operations and independent audits (SOV-7) (Cloud Sovereignty Framework, p.3).

Why incumbents cannot fully answer it. An audit trail held by a provider that can be compelled to disclose or suspend it is a weak audit trail. The International Criminal Court episode of 2025 turned that risk into a public fact. The prosecutor’s access to his Microsoft email was cut after US sanctions, and the court later moved about 1,800 workstations to openDesk (press reporting and UK parliamentary testimony, 2025–2026).

The European asset. A European operator can build the agent ledger as a product. Every tool call, credential use, data access and model invocation would be recorded in tamper-evident form, held under EU law, exportable to the customer and readable by regulators. This is the wedge with the least competition today and the greatest long-term lock-in. Whoever holds the audit layer becomes the trusted platform for agents.

The economics: utilisation decides everything

Wedges are where demand is. Economics decide whether serving it pays. Four facts govern the unit economics of a European agentic cloud.

Fact 1 — The GPU-hour is the cost unit, and STACKIT’s list price is high

STACKIT’s price list puts an 8× HGX H100 server at €64.33 an hour, or €46,318 a month (STACKIT price list, p.14). That is about €8.04 per H100-hour. A single A100 80 GB is €2.66 an hour and a single L40S €1.74. List prices are not the operator’s cost, and large customers negotiate. But a published sovereign list price far above global rental rates tells customers that sovereignty costs extra. The Cour des comptes estimates a sovereignty premium of 25–40% above standard cloud for SecNumCloud hosting in France (French Court of Audit, pp.10–11). The strategic task is to shrink that premium towards zero on inference, where the wedge is price parity.

Fact 2 — Token prices set the revenue a GPU-hour must earn

At €0.65 per million output tokens, recovering €8.04 per GPU-hour requires selling about 12.4 million output tokens per GPU-hour, roughly 3,400 tokens per second, every second, continuously. (This is an illustrative ENSI calculation from the two published STACKIT prices; it ignores input-token revenue, which adds income, and idle time, which removes it.) That throughput is possible for mid-sized models only with large batches. Erdil’s model shows batches can only be filled when enough requests arrive (inference economics paper, p.2). A sovereign inference cloud with thin traffic loses money on every idle second. One with steady agent traffic makes money on the same hardware.

Fact 3 — Utilisation, not subsidy, is the make-or-break variable

The international record is a warning. Japan subsidised about half of SAKURA internet’s ¥100 billion GPU-cloud investment under its economic-security law (Sakura investor deck, pp.3, 6). Sakura still reported a loss on its GPU business in 2026 (press reporting, 2026). India onboarded 38,000 GPUs against a 10,000 target and sells them at a subsidised ₹65 per GPU-hour (IndiaAI factsheet, pp.1–4). Its portal is reported to be under-used, with most subsidy flowing to a handful of model builders (press reporting, 2026). Capacity built ahead of demand is a cost, not an asset. That is why public demand (Report 2) and the agent wedges above matter more than the size of the capex grant.

Fact 4 — Energy is a small share of cost but a large share of margin

Training cost models put energy at only 2–6% of the total (Epoch on training costs, p.1). In commodity inference, where competition drives prices towards cost, the electricity bill and the cooling overhead (EU average PUE 1.36, Commission data-centre energy report, p.8) become a large slice of what is left. Siting matters on two counts:

• the Nordic and Iberian power-price advantage;

• Lübbenau’s design: direct liquid cooling and waste heat sold into district heating for up to 75,000 households from 2028 (Lübbenau page).

In the agentic era these are cost levers, not merely sustainability features.

What it implies for capacity

Bruegel’s conversion of 450,000 to 750,000 GPUs per gigawatt puts Lübbenau’s 200 MW at roughly 90,000–150,000 GPUs (Bruegel on AI compute, p.3). That is consistent with the company’s own figure of up to 100,000. Three comparisons put it in proportion:

• Against the EU’s total AI compute (2 GW), Lübbenau is a tenth: a national-scale asset.

• Against the projected EU data-centre shortfall of about 9 GW in 2030 (CADA impact assessment, pp.44–49), it is about 2%.

• Against the 9 GW that Epoch’s trend projects for the single leading AI system in 2030 (Epoch AI, p.1), it is about one forty-fifth.

The conclusion is not that Lübbenau is too small. It is that no single European operator can match frontier training scale, and none needs to. A sovereign agentic cloud is an inference and integration business first. Its capacity should be sized to the European agent traffic it can win, and it can grow in modules as that traffic shows up, which is exactly the modular, two-phase design Lübbenau uses (Max Bögl).

A rough sense of the scale of the prize is useful, with the caveat that it is an illustration and not a forecast. Suppose European enterprises and public bodies ran one million substantial agent tasks a day at about two million tokens each, which the token-consumption study’s per-task figures make plausible for complex work. That is about two trillion tokens a day. At the throughput implied in Fact 2, serving that needs on the order of 7,000 H100-class GPUs running continuously: a small fraction of one Lübbenau. Agent adoption is likely to run much higher than one million complex tasks a day across a continent of 450 million people within a few years. If it does, the demand side justifies multiple Lübbenaus. The question is whether that traffic lands on European infrastructure or flows to US regions by default.

Part IV — The agentic engine: agents that run a sovereign cloud and its policy

Europe’s sovereignty instruments share one weakness: they are checked on paper, occasionally and slowly.

• A certificate is issued and renewed.

• A tender is scored once.

• A grid-connection queue is reviewed by hand.

• A legal opinion is commissioned after a scare.

Meanwhile the thing being governed changes weekly, with new models, new tools, new subprocessors and new US executive orders. The Dutch Court of Audit’s finding that two-thirds of material public-cloud services had no risk assessment is not a failure of diligence (Dutch Court of Audit, p.7). It is what happens when governance runs at human speed over a machine-speed system.

The ENSI proposal is to run sovereignty the way a sovereign agentic cloud runs everything else: continuously, with agents doing the monitoring, matching and evidence-gathering, and named humans owning every decision. Eight agent archetypes cover the job. For each: what it does · the data it needs · who is accountable.

1. The sovereignty-assurance agent

• What it does. It turns the Commission’s Cloud Sovereignty Framework, BSI C5 and SecNumCloud from periodic attestations into a live score. For every service it maintains a current SEAL rating on each of the eight objectives, and it flags any change that would lower one. Examples: a new non-EU subprocessor, a change of control, a support desk outside the EU, a model served from a non-EU endpoint.

• The data it needs. Corporate-ownership registers, subprocessor lists, staff-location data from the operations centre, the software bill of materials and hardware bill of materials, key-custody configuration, and the framework’s scoring rules (Cloud Sovereignty Framework, pp.2–6).

• Accountability. The operator’s chief compliance officer signs the live score. The certifying authority (BSI, ANSSI or an accredited body) audits the agent’s method and samples its evidence.

2. The procurement-matching agent

• What it does. It reads public tenders, classifies each workload by sensitivity and finds every qualified European offer that meets the required sovereignty level. It also produces the written justification that CISPE proposes buyers should file when they choose a non-EU provider (CISPE manifesto, pp.2–4). And it flags single-bidder tenders, which ECIPE’s analysis of 8,725 contracts shows rising from 28% to 46% under sovereignty framing (ECIPE on tenders, pp.2–3). Both sides of the policy argument are served: more European bids and more competition.

• The data it needs. Tenders Electronic Daily, national procurement portals, the live sovereignty scores from agent 1 and workload-classification rules such as France’s “particularly sensitive” category (French cloud doctrine, p.9).

• Accountability. The contracting authority’s procurement officer decides. The agent recommends and documents.

3. The capacity and grid-siting agent

• What it does. It matches planned data-centre capacity to grid headroom, permitting speed, power price, heat-reuse potential and latency to demand. It ranks candidate sites for AI Gigafactories, for CADA’s Data Centre Acceleration Zones and for operators’ own expansion. It also watches connection queues for hoarded capacity: contracted but unused, as with EirGrid customers drawing about 34% of contracted capacity (Ember, p.18).

• The data it needs. Grid operators’ queue and headroom data, ENTSO-E system data (ENTSO-E), the EU data-centre reporting database under Delegated Regulation 2024/1364, land registers, and permitting timelines by region.

• Accountability. The national energy regulator and the permitting authority decide allocation. The agent makes the trade-offs visible and the queue rules enforceable.

4. The portability and exit agent

• What it does. It keeps every critical workload ready to leave. It maintains an up-to-date migration plan for each one and estimates the egress and re-architecture cost. On a schedule, it rehearses a real move of a sample workload to a second provider and measures the time taken. This turns the Data Act’s switching rights into a tested capability rather than a paper right. It also answers the question ECIPE’s CADA cost study raises, where re-architecting accounts for about 70% of the projected transition cost (ECIPE on CADA, p.2), by measuring that cost in practice rather than modelling it.

• The data it needs. Infrastructure-as-code repositories, dependency graphs, data volumes, provider price sheets and egress tariffs.

• Accountability. The customer’s CIO owns the exit plan. Supervisors for regulated sectors can require evidence of rehearsal.

5. The licensing and egress watchdog

• What it does. It monitors the practices the CMA identified as harming competition: egress fees, interconnection terms and licensing that charges more for running software on rival clouds. It computes the effective cost penalty a customer faces for multi-cloud. CISPE puts the extra cost of running Microsoft software on rival clouds at about 28% (CISPE complaint, pp.3–4). It flags breaches of Data Act switching obligations and of any commitments under the DMA.

• The data it needs. Public price lists, licensing terms, customer invoices (with consent) and competition-authority decisions (CMA update 2026).

• Accountability. The competition authority and the Data Act enforcement authority act on its findings. The agent never sanctions anyone.

6. The model-routing agent

• What it does. For every agent step it chooses the model that meets the quality bar at the lowest cost and the required sovereignty level. By default it prefers European and open models served on sovereign infrastructure, and it escalates to frontier models only where they are needed and allowed. The token-consumption study shows models differ by over 1.5 million tokens per task on identical work and that more tokens do not mean better answers (agent token study, pp.1–3). Routing is therefore both a cost and a sovereignty lever, and it creates the steady demand European models need to improve.

• The data it needs. Evaluation results by task type, model prices, token-use predictions, data-classification labels and the jurisdiction of each model endpoint.

• Accountability. The customer’s AI owner sets the policy: which data may go to which model. The agent applies it and logs every decision to the audit ledger.

7. The AI Act compliance agent

• What it does. It maintains the technical documentation, logs, human-oversight records and incident reports for each AI system that falls under the AI Act. It maps every deployed agent to its risk category and keeps its required evidence current. For public bodies it produces the transparency record that citizens and courts can inspect.

• The data it needs. The agent ledger (wedge 8), model lineage records (wedge 5), deployment inventories and the AI Act’s obligations.

• Accountability. The deployer’s designated AI compliance officer, and in public bodies a named senior official, signs the documentation. Market surveillance authorities audit it.

8. The kill-switch drill agent

• What it does. It simulates the scenarios sovereignty exists to survive and measures the result. Examples:

  • a US sanction cutting a provider’s service;

  • an export-control change halting GPU deliveries;

  • a key-custody failure;

  • an outage of a single region.

  Each drill reports how long critical public and economic functions would keep running, which agents would fail, and what fallback exists. The Greenberg Traurig analysis is a one-off, desk-based version of this drill (Dutch legal review of AWS). Bitkom’s finding that firms could last about 14 months without foreign digital imports is a survey-based estimate of what such drills would measure directly (Bitkom survey, p.7).

• The data it needs. Service dependency maps, contracts, the installed hardware inventory, failover configurations and the exit plans from agent 4.

• Accountability. The national cyber-security and crisis-management authorities own the drill programme. Each critical entity’s board owns its own results.

The operating rule for all eight is the one that runs through every ENSI agentic design. Agents scan, match, measure, rehearse and document. Humans decide, sign and answer for the outcome. Every agent action is itself recorded in the agent ledger, so the governance system is auditable by the same means it uses to audit others.

The risks that could sink it

Five risks deserve to be stated plainly, because a strategy that hides them will be blindsided by them.

1. Chip dependence and US rule changes. The AI Diffusion rule showed how quickly European access to compute can be redrawn. It placed six EU member states (Poland, Portugal, Greece and the three Baltic states) outside the allied tier, then was rescinded within months (CSIS on export rules, p.4; RAND on export rules). With 96% of EU AI chips from US vendors, a sovereign cloud is sovereign in operation and jurisdiction, not in supply. Mitigations are multi-vendor fleets, forward contracts, installed-base resilience and Chips Act 2.0’s push into AI chips (Chips Act 2.0, pp.4–5).

2. Model dependence. If every model a European cloud serves is American or Chinese, a licence change, a security finding or a geopolitical decision can remove the product’s core. STACKIT’s catalogue today carries exactly this exposure. Mitigations are a funded European open-model pipeline, model-agnostic agent design and routing that sends real traffic to European models.

3. Utilisation failure. Subsidised capacity without customers is the most common failure in the international record: Sakura’s GPU loss, India’s under-used portal, France’s Cloudwatt and Numergy. Mitigations are public anchor demand, the agent wedges above and modular build-out paced to contracted traffic.

4. Sovereignty-washing. “Sovereign” editions of US clouds, and European resellers running on US infrastructure, will capture much of the protected demand if definitions stay loose. ECIPE’s own data show domestic tender winners often run on hyperscaler infrastructure (ECIPE on tenders, p.3). Mitigations are live sovereignty scores (agent 1), honest SEAL labelling and procurement that checks the whole stack, not the logo.

5. Concentration and complacency inside Europe. A protected market can breed a European incumbent that charges a sovereignty premium indefinitely. ECIPE warns smaller member states could become dependent on French and German providers (ECIPE on CADA, p.3). Mitigations are mandatory portability, federation among several European operators, price-parity targets and conditionality on public support, the approach Mazzucato and Rodrik set out (Mazzucato and Rodrik).

A sixth risk sits behind the others: talent and execution. The leadership change at Schwarz Digits in July 2026, the same month as a STACKIT outage and an online-shop data leak (Lebensmittel Zeitung), is a reminder that a sovereign cloud is first of all an operational discipline. Uptime is the first sovereignty feature customers check.

Ten design laws for a European agentic cloud

1. Sovereignty is per layer. Specify, score and sell it per layer: own, federate, or rent with exit. Never claim it for the whole stack.

2. Own the layers where trust lives. Power and sites, cluster operations, the agent runtime, and identity, keys and audit are the layers to own outright.

3. Federate what is open. Orchestration, open models and applications stay shared and portable among several European providers.

4. Rent what you cannot make, with a tested exit. For accelerators and frontier models: multiple suppliers, forward contracts, drills.

5. Win on the agent layer. A jurisdiction-clean agent runtime with a built-in audit ledger is the product the incumbents cannot credibly match.

6. Sit next to the system of record. Co-locate agents with SAP, industrial and public data in the same jurisdiction and, where possible, the same site.

7. Route, don’t marry. Make agents model-agnostic, send most steps to sovereign open models, and reserve the frontier for where it earns its cost.

8. Price parity on inference is non-negotiable. A sovereignty premium is tolerable for a niche, fatal for a platform.

9. Build to traffic, not to headlines. Size capacity in modules paced to contracted agent demand. Utilisation decides margins.

10. Govern at machine speed. Run assurance, procurement matching, siting, exit, competition watch, routing, compliance and drills through agents, with named humans accountable.

First moves

For operators such as STACKIT, within twelve months:

• put at least two European models in the serving catalogue with full lineage records;

• launch an agent runtime with an EU-law-only audit ledger and customer-held keys;

• package SAP plus agents as a single sovereign offer;

• publish a live sovereignty score per service;

• add a second GPU vendor or generation to the fleet;

• publish inference prices at parity with the hyperscalers’ regional prices.

For governments, within twelve months (Report 2 sets out the full playbook):

• classify public workloads by sensitivity and publish the result;

• commit anchor demand for sovereign agent platforms in public administration;

• reform grid queues on use-it-or-lose-it terms and fast-track sites with headroom;

• fund a European open-model pipeline tied to real public use cases;

• require exit rehearsals for critical public workloads;

• commission continuous, agent-based sovereignty assurance in place of annual paperwork.

Close

Europe will not out-build the United States in frontier training compute this decade. It does not need to. The agentic platform is still forming, and its value will sit where agents meet trust, law and the systems of record. That is terrain Europe holds: its regulation sets the global bar, its enterprise software runs the core of its economy, its public sector is a vast and still-undecided buyer, and its grids, outside the congested hubs, still have room. The Schwarz Group’s bet shows that a European firm can assemble most of the stack:

• sites and power;

• a certified cloud;

• SAP co-location;

• a model partner;

• the first public-sector anchors.

It also shows where the gaps are: European models, frontier-generation chips, the agent runtime, and the external traffic that keeps GPUs busy.

The option value lies in moving now, before the agentic habits harden. A European agent runtime that customers adopt in 2027 will be very hard to dislodge in 2032, just as AWS was by 2015. The one built in 2030 will be too late.