Why does sovereignty matter so much right now? Regulation is certainly one factor. European SAP users operate under a dense and growing web of regulations. Any organization processing personal data—effectively all SAP users via HR—must comply with GDPR, NIS-2, DORA, KRITIS, and BSI standards, which directly influence cloud design. Forty-five percent of SAP user organizations report security and privacy concerns when running core workloads in the public cloud.3
But regulation is only a part of the story. The broader context is geopolitical. As the world shifts towards a multipolar order, Europe’s economic strength increasingly depends on technological independence. Heavy reliance on non-European providers creates structural dependencies with unpredictable consequences, particularly in times of political tension. Technology is no longer just an enabler; it is the foundation of sovereignty. Every enterprise increasingly relies on AI capabilities, secure data flows, resilient cloud infrastructure.
Cloud architecture decisions are therefore not merely compliance choices. They are strategic positioning decisions for long-term competitiveness and resilience. For regulated sectors such as public administration, banking, insurance, and energy, the stakes are even higher. Addressing sovereignty early avoids redesigns, contractual friction, and costly operational corrections later.
The real question: Which level of sovereignty per workload?
The strategic breakthrough comes from reframing the question from “Public or private cloud?” to “Which sovereignty level is required per workload?”.
Not every SAP system needs the same level of sovereignty. A development system with anonymized data doesn’t pose the same risk of exposure as a productive finance system with booking-relevant, real-time data. HR payroll data triggers stricter requirements than inventory stock information. That’s why the decisive question isn’t “sovereign or not”, but “which sovereignty level does each workload require?”.
This view changes RISE planning: sovereignty becomes a core design parameter across business transformation (which processes and data are most critical), the operating model (who is responsible for what, incident response, and SLAs), and infrastructure (public, private, or hybrid).
Get it right up front and your journey stays on track.
Multi-cloud: Maximum sovereignty, optimized cost
Hyperscalers such as AWS, Azure, and Google Cloud deliver global scale, rich service ecosystems, and rapid innovation, ideal for non-critical workloads. Yet for sensitive or regulated workloads, sovereignty and operational control can take priority as their mother companies are liable to non-EU data disclosure regulations such as the CLOUD Act.
The most effective answer is multi-cloud: connect the best of both worlds and assign each workload to the right environment. This approach also supports cost discipline. Running everything in a sovereign private cloud may be unnecessary and expensive, while placing everything on a hyperscaler can create compliance and risk gaps. Multi-cloud balances both: maximum sovereignty where required and optimized costs elsewhere.
