In June 2025 a US hyperscaler’s French subsidiary was asked, in a public hearing, whether it could guarantee that data stored in France would not be handed to US authorities.
It said no.
That was a candid answer rather than a scandal, and it is the most commercially useful sentence any European software vendor has been handed in years, because it ended an argument that had been running for a decade. Storing data inside the EU and being outside US legal reach are two different things, and the company best placed to know said so out loud.
What follows from that is your opening. It is also, and this is the part most vendors miss, a problem you probably share.
Location is not jurisdiction
The buyer’s question was never where are the servers. It was who can compel you to hand this over.
The CLOUD Act reaches US-headquartered providers regardless of where the data physically sits. So a European region of an American cloud answers a geography question that nobody senior was actually asking, which is why procurement teams have stopped accepting it as an answer.
Now the uncomfortable implication. If your product is hosted on a US hyperscaler’s Frankfurt or Stockholm region, your “data stays in the EU” claim has exactly the same gap as theirs. A great many European vendors selling sovereignty are running on infrastructure that cannot deliver it, and a competent buyer will find that out in the third procurement email.
I am not saying move your infrastructure this quarter. I am saying know which claim you can actually defend, because the cost of being caught overclaiming here is much higher than the cost of being honest about a limitation.
The lazy version, and the version that works
Most sovereignty marketing is a badge and a paragraph.
GDPR compliant. Your data is safe with us. Hosted in Europe.
That says nothing a buyer can put in a file. Compare it with something specific.
Customer data is stored and processed in the EU. Our infrastructure provider is incorporated in the EU and not subject to the US CLOUD Act. Subprocessors are listed below with their locations. We have never received a foreign government data request, and if we did our policy is to notify you unless legally prohibited. DPA available to sign before trial.
That second block is longer, duller and enormously more persuasive, for the same reason a specific outcome beats a provenance claim in any other part of your positioning. It names the mechanism instead of the feeling.
If your privacy claim would still be true if you moved your hosting to Virginia tomorrow, it is not a sovereignty claim.
Put it on the pricing page
This is the part I would argue with people about.
Sovereignty material usually lives in a trust centre, three clicks deep, written by whoever handles compliance. Which makes sense if you think of it as a document that satisfies a requirement.
It is not that. It is a reason somebody switches, which makes it a sales argument, and sales arguments belong where the buyer is deciding. On the pricing page, in the comparison table, in the first email. One line on the pricing page, linking to the detail.
The trust centre still needs to exist. It is where the buyer’s security reviewer goes, and what they will ask for is a separate and more tedious exercise. But burying your strongest differentiator in the place people only visit after they have already chosen you is a filing decision masquerading as a strategy.
What is actually happening in 2026
The regulatory machinery moved a long way this year, and the commercial reading of it matters more than the detail.
The Commission published its tech sovereignty package on 3 June, with the Cloud and AI Development Act as the centrepiece and final adoption targeted for late 2027. It introduces a single EU-wide framework for assessing cloud and AI sovereignty, which means the thing you are currently asserting in prose will eventually have a standard attached to it.
In April, four sovereign cloud consortia shared a tender worth around EUR 180 million, awarded on sovereignty framework alignment. Public money is now explicitly buying this property.
On 25 June, Amazon and Microsoft were preliminarily designated gatekeepers under the Digital Markets Act for their cloud businesses, which points towards stricter obligations around lock-in.
And the one with a date your sales team should know: under Article 25 of the Data Act, switching fees are banned from 12 January 2027.
Read that last one as a buyer. The cost of leaving an incumbent is being legislated downwards. Every objection of the form “we would love to but migrating is expensive” gets weaker on a known date, and you can say so in a sales conversation this week without exaggerating anything.
The window is closing, which is the actual argument
Here is where I would push back on the general enthusiasm.
All of this standardisation is going to turn sovereignty from a differentiator into a hygiene factor. When there is an EU-wide framework with a label attached, having the label stops being a reason to choose you and not having it starts being a reason to lose. That is what happens to every compliance property eventually.
So the opportunity is now, in the awkward interval where buyers are nervous, the standard does not exist yet, and most vendors are still saying “hosted in Europe” and hoping nobody asks the follow-up.
What survives the standardisation is not the claim. It is whether you can answer the specific question quickly, in writing, without a meeting. That is a documentation asset and a sales process, and it takes months to build, which is the argument for starting while it still wins deals rather than after it merely prevents losses.
One caution about the other direction
Do not let this become your whole pitch, and be careful pointing it at the wrong market.
A buyer still has to want the product. Sovereignty removes an objection, it does not create desire, and a vendor whose homepage leads with jurisdiction is telling me it has nothing better to say.
It also travels badly. An American buyer is largely indifferent to this and occasionally reads it as a lecture. Segment the message by market rather than running one version everywhere.
Where I come out
Stop treating this as compliance overhead. It is the strongest commercial argument available to a European vendor right now, and it has a shelf life.
Find out this week what your actual position is, including whose infrastructure you are really on. Write the specific version of the claim, the one that names mechanisms rather than feelings. Put a line about it where people decide rather than where they audit.
Then use the January 2027 date in conversations, because a legislated reduction in your prospect’s switching cost is a better closing argument than anything you were going to invent.
My notes on content marketing cover how the rest of the site follows from a claim like that. If you’d like to think through your own position, drop me a line on email, WhatsApp or LinkedIn and we can have a quick chat. I’m contracted full time so this isn’t a pitch.