It is clouds that run AI agents: they serve AI responses all day, bill per token, and are judged on whose law they sit under. A European operator can win that market, but only by building the parts the hyperscalers cannot credibly offer.
ENSI Research Division · Report 3 of 3 in the Sovereign AI Cloud series · Built on a library of 150 primary documents across 15 angles, official Schwarz Group and STACKIT documents, competition-authority findings, EU legislation and impact assessments, government legal opinions, national compute strategies, energy-system studies and frontier arXiv research. Report 1 examines the Schwarz Group’s bid as a company. Report 2 sets out the EU policy playbook. This report covers the technology and the operating model underneath both.
The argument, before the list
In 2024 Mario Draghi wrote the sentence that every European cloud strategy now has to answer. He said it is “too late for the EU to try and develop systematic challengers to the major US cloud providers: the investment needs involved are too large” (Draghi report, p.36). He was right about the war he was describing. That war ran from roughly 2006 to 2020. It was fought over rented virtual machines, object storage, managed databases, and the developer tools and marketplaces built around them. Europe lost it decisively.
Market share. European providers’ share of their own market fell from 29% in 2017 to 15% in 2022 and has “remained stagnant since then”. Three non-EU hyperscalers control over 70% (CADA proposal, p.3).
Lock-in. In the UK, fewer than 1% of customers switch provider in a year (UK CMA decision, p.15).
Scale. The largest European operator, Deutsche Telekom, holds about 2% (Draghi report, p.26).
Nothing in this report argues that this war can be refought.
The argument is that a different platform is being built on top of the old one, and its rules differ in ways that matter to Europe. Call it the agentic cloud: infrastructure that runs AI agents, not only stores data and hosts applications. Agents reason over long contexts. They call tools, read from and write into enterprise systems, and act on behalf of a person or an institution. Four properties separate this platform from the cloud Europe lost.
It runs on inference, not storage. The cost centre moves from disks and virtual machines to accelerators answering queries all day. Epoch’s analysis finds that cumulative inference costs have reached levels “comparable to, or in some cases exceeding, the initial training costs” (inference economics paper, p.1).
It is billed per token, and agents use far more tokens than chat. A 2026 study of eight frontier models on real software tasks finds that agentic tasks consume about 1,000 times more tokens than code chat or code reasoning. Averaged across tasks the ratio is 3,500 times, and identical runs can differ by up to 30 times (agent token study, pp.1, 3). The unit of the new market is the token, and token demand grows much faster than seat or storage demand.
It is sensitive to trust and jurisdiction in a way storage never was. An agent is not a passive container for data. It holds credentials, reads the mailbox, drafts the contract, approves the invoice and touches the systems of record. Whoever runs the agent runtime can, in principle, see and steer the work itself. In this platform, jurisdiction is part of the product, not a compliance footnote.
It gains its value from integration with systems of record. An agent is only as useful as the data and processes it can safely act on: the ERP, the production line, the patient file, the case register. That data is in Europe, it is regulated in Europe, and much of it already runs on European software (SAP above all).
Each property shifts the ground a little towards a European operator. None of them guarantees anything. The Commission’s own impact assessment projects that EU data-centre demand will outrun supply by about 9 GW in 2030 (CADA impact assessment, pp.44–49). Bruegel counts only 2 GW of AI compute in the EU, 5% of the world total, and says planned projects “will barely change the EU’s global share” (Bruegel on AI compute, p.1). The chips are American, and so are most of the open-weight models a European cloud serves today. And the hyperscalers are not standing still: each now sells a “sovereign” edition of its own cloud.
Even so, the window is real, and a competition regulator has documented it. After two years of investigation, the UK Competition and Markets Authority concluded that “AI is yet to materially alter the competitive dynamics in cloud services”. Accelerated-compute infrastructure “is being used by a small number of customers who are primarily AI model developers” (UK CMA decision, p.13). Read the other way, the market for AI clouds that run agents for ordinary enterprises and public bodies has not yet locked in. The habits, contracts, integrations and data gravity of the old cloud have not yet carried over to the new one. A European operator that arrives with the right architecture before those habits harden is competing for an open market, not trying to reverse a closed one.
This report sets out what “the right architecture” means. It treats the sovereign agentic cloud as a stack of nine layers. For each layer it asks who controls it today and what sovereignty can realistically mean: owning the layer, federating it with other Europeans, or renting it with a guaranteed exit. It then identifies eight wedges where a European operator can win on merit rather than on protection. It looks at the unit economics that decide whether any of this survives contact with a balance sheet. And it specifies the agentic engine: the AI agents that should run the sovereign cloud and the policy around it, with humans accountable for every decision that matters. It closes with ten design laws and the first moves for operators and governments.
The Schwarz Group’s STACKIT runs through the report as the worked example. It is the most serious attempt to date by a European company outside the telecom sector to build a full-stack cloud and AI platform. It is also an unusually well-documented one, with a published price list, service certificates for its GPU and model-serving products, and a run of 2026 announcements. The point is not to grade one company; Report 1 does that. The point is to use a real operator’s actual choices to show where the stack is sovereign today and where it is not.
Summary of the main points
The old cloud war is over; the agentic one has not started in earnest. The CMA finds AI has not yet reshaped cloud competition. Agentic workloads use 1,000 to 3,500 times more tokens than chat. A token-metered, jurisdiction-sensitive platform is forming, and its customer habits are not yet fixed.
Sovereignty is a property of each layer, not of the whole cloud. Of nine layers, Europe can own four (sites and power, the AI-factory operations, identity, keys and audit, and the agent runtime). It can federate three (orchestration, models, sector applications). For the rest, above all accelerators, it must rent with a contractual and technical exit.
STACKIT shows both the promise and the gaps. It has BSI C5 coverage of its AI Model Serving, an OpenAI-compatible API and a model-serving catalogue at roughly €0.45 per million input tokens and €0.65 per million output tokens. But every model in that catalogue is American or Chinese, and the GPU fleet tops out at H100 (STACKIT AI models; GPU service certificate, p.3).
Eight wedges are winnable. They are:
regulated workloads;
public administration;
industrial AI;
the gravity of SAP systems;
multilingual and open European models;
sovereign inference at price parity;
energy-advantaged sites;
the agent audit and accountability layer.
Each is backed by demand that already exists and that US-run sovereign offerings cannot fully serve.
The economics are utilisation economics. At STACKIT’s list price of €8.04 per H100-hour, a GPU must sell roughly 12 million output tokens an hour to recover its rental value at current token prices. That only happens when demand keeps batches full. Whoever aggregates the most steady agent traffic wins on cost.
Capacity is an order of magnitude short. Lübbenau’s planned 200 MW and up to 100,000 GPUs is a strategic asset for Germany. It is still about one-fiftieth of the 9 GW that Epoch’s trend projects for a single leading AI system in 2030, and a tenth of the EU’s entire current AI compute.
An agentic engine should run the sovereign cloud. Eight agents would do the work: sovereignty assurance, procurement matching, capacity and grid siting, portability and exit, licensing and egress watch, model routing, AI Act compliance, and kill-switch drills. Humans keep the decisions and the accountability.
The main risks are clear. They are chip dependence and US rule changes, dependence on US and Chinese model weights, utilisation failure (Japan’s Sakura loss, India’s under-used GPU portal) and “sovereignty-washing” by offerings that remain reachable by US law.
Ten design laws sum it up. Build sovereignty where it is checkable, federate what is open, rent what you cannot make with an exit you have tested, and win on the agent layer, where trust is the product.
How this report is organised
The report moves from the platform to the stack to the market to the machine.
Part I, The platform shift. Eight signals that the agentic cloud is a distinct platform, with the evidence for each.
Part II, The anatomy. The nine-layer sovereign agentic stack, each layer described as who controls it today · what sovereign can realistically mean · where a European operator can win.
Part III, The wedges and the economics. Where Europe can win, and the unit economics that decide whether it does.
Part IV, The agentic engine. The agents that should run a sovereign cloud and its policy, the risks that could sink the project, ten design laws, and the first moves.
Part I — The platform shift: eight signals
The claim that “the agentic cloud is a new platform” carries the whole argument, so it has to be earned rather than asserted. Eight signals from the library support it.
1. Compute for the frontier doubles faster than any cloud has ever scaled
Epoch’s dataset of 500 AI supercomputers from 2019 to 2025 shows computational performance doubling every nine months. Hardware cost and power needs each double every year (Epoch AI, p.1).
Today’s leader. xAI’s Colossus (March 2025) used 200,000 AI chips, cost about $7 billion in hardware and needed 300 MW, “as much as 250,000 households”.
The 2030 trend. If the trend holds, the leading system in 2030 uses two million chips, costs about $200 billion and draws 9 GW.
Concentration. The United States holds about 75% of global AI-supercomputer performance, and China about 15%.
This is not the economics of a storage business. It is the economics of heavy industry, closer to a steel mill or an aluminium smelter than to a software company.
2. Training costs grow at 2.4 times a year, which narrows who can build frontier models
The amortised cost of the most compute-intensive training runs has grown about 2.4 times a year since 2016. The largest runs were on track to exceed a billion dollars by 2027 (Epoch on training costs, p.1). Accelerator chips and staff are the biggest cost items. Server components add 15–22%, cluster interconnect 9–13% and energy only 2–6%.
The policy lesson is not that Europe must match frontier training budgets. Few countries outside the US and China can. It is that the frontier-model layer will stay concentrated. A European agentic cloud must be designed to serve many models, including models it did not train, rather than to depend on owning one.
3. Inference now rivals training, and inference economics reward scale of demand
Erdil’s model of inference economics shows the cost per token falls as batch size rises, up to an optimal batch size. When “not limited by an insufficient number of incoming requests, it is always optimal to set the batch size equal to” that optimum (inference economics paper, p.2). The practical meaning is blunt. An inference cloud with too little traffic cannot fill its batches, and pays more per token than a rival with steady demand. In the agentic era, cost advantage comes from aggregating demand, not only from buying chips cheaply.
4. Agents multiply token demand by three orders of magnitude
The token-consumption study finds that agentic coding tasks consume about 1,000 times more tokens than code chat. Input tokens drive most of the cost, because agents re-read their growing context at every step. Usage is highly random: the same task can cost 30 times more on one run than on another. Some models consume over 1.5 million more tokens per task than others on identical work (agent token study, pp.1–3). Two consequences follow for a cloud operator.
Demand will grow far faster than seats. Each knowledge worker who moves from asking a chatbot to running agents raises their token use by orders of magnitude.
Cost control becomes a platform feature. Routing a task to a token-efficient model is worth real money. So are context caching and predicting a task’s cost before it runs. These are agent-layer capabilities, not hardware ones.
5. Generative AI is an energy business
Luccioni and colleagues measured inference energy across 88 models and many tasks. Generative, multi-purpose models are “orders of magnitude more expensive than task-specific systems”, even at similar parameter counts (Luccioni et al., p.1). Text generation averages about 0.05 kWh per 1,000 inferences and image generation up to 2.9 kWh, against 0.002–0.007 kWh for classification (p.5).
At grid scale, the IEA projects global data-centre electricity rising from about 415 TWh in 2024 to about 945 TWh in 2030. Europe adds more than 45 TWh, up 70% (IEA, pp.14, 64). The agentic cloud ties cloud competition to electricity prices and grid access in a way the storage cloud never did. That is bad news for Frankfurt and good news for wherever power is cheap and the grid has room.
6. Sovereign AI has become a stated priority for organisations, not only for states
The Linux Foundation’s 2025 global survey finds that 79% of organisations consider sovereign AI valuable and a strategic priority (Linux Foundation survey, p.2).
Drivers. Data control (72%) and national security (69%) are the top drivers.
Preferred approaches. Open-source software (81%), open standards (65%) and open data (65%).
Europe stands out. Transparency and auditability are the top benefits of open source for sovereign AI, rising to 80% in Europe.
So demand for sovereignty in AI is no longer a ministerial talking point. Buyers rank it, and European buyers rank checkability highest.
7. The incumbents’ AI advantage has not yet hardened into market power
The CMA finds that Microsoft, AWS and Google are “strong vertically integrated providers of accelerated compute and AI-related cloud services, including through partnerships with AI model developers”, and that “other cloud providers are significantly weaker in this respect”. It also finds that AI “is yet to materially alter the competitive dynamics” (UK CMA decision, p.13).
Both findings matter. The incumbents start ahead, but the lock-in that defines the old market has not yet formed in this one. That lock-in comes from egress fees, licensing practices that let rivals’ costs exceed Microsoft’s own retail prices, and switching rates under 1% (p.16). Agent workflows, tool integrations and prompt-and-context assets are being built now. Where they are built is still open.
8. Europe’s compute gap is real, but its constraint is grids and permits, not capital
Bruegel’s 2026 policy brief makes the uncomfortable point plainly. The EU hosts only 2 GW of AI compute, 5% of the world total. “Private capital is not the crucial constraint.” Speed to operation and grid access are, and grid access “is left out of the scope” of the Cloud and AI Development Act (Bruegel on AI compute, p.1). The same brief notes that 1 GW powers between 450,000 and 750,000 GPUs depending on efficiency (p.3). That is a useful conversion for every capacity claim in this report.
Grid connection queues reach up to 10 years in the Netherlands and up to 7 in Germany, while the US average is one to three years (IEA, p.94). The bottleneck for a European agentic cloud is physical and administrative, and that is good news. Physical and administrative bottlenecks are exactly what states control.
Taken together, the signals describe a platform that is:
heavy-industrial in its infrastructure;
concentrated at the frontier-model layer;
demand-aggregating in its economics;
exponentially token-hungry in its use;
energy-bound in its geography;
sovereignty-sensitive in its buying criteria;
not yet locked in.
A European strategy that fits those seven facts looks very different from one that tries to rebuild AWS.
Part II — The anatomy: a sovereign agentic cloud in nine layers
“Sovereign cloud” is usually discussed as if it were a single property that a provider either has or lacks. That framing produces two equally unhelpful positions. One says sovereignty is impossible because the chips are American. The other says a German data centre is automatically sovereign. Both are wrong, and the Commission’s own procurement instrument shows why.
The Cloud Sovereignty Framework scores a provider on eight separate objectives. The objectives are strategic, legal, data and AI, operational, supply chain, technology, security and environmental, each rated on five assurance levels from SEAL-0 to SEAL-4. The weights are uneven: supply chain is 20%, legal immunity only 10% (Cloud Sovereignty Framework, pp.2–3, 6). Sovereignty is a profile across layers, not a yes-or-no.
The anatomy below breaks the agentic cloud into nine layers, from the substation to the sector application. Each has three lines:
who controls it today;
what sovereign can realistically mean, using three modes:
own: European ownership, operation and control;
federate: shared European or open governance across several actors;
rent with exit: non-European supply under a tested contractual and technical exit;
where a European operator can win.
Layer 1 — Power, land and sites
Who controls it today. States and grid operators, more than any company. EU27 installed data-centre capacity is about 12.4 GW in 2025. The central scenario reaches 28 GW in 2030 against 37 GW of demand (CADA impact assessment, pp.44–49).
Hubs. Connection queues at the FLAP-D hubs (Frankfurt, London, Amsterdam, Paris, Dublin) average 7–10 years and reach 13 (Ember, p.18).
City load. Data centres already take 33–42% of electricity in Amsterdam, London and Frankfurt and almost 80% in Dublin (p.10).
What sovereign can mean: own. This is the one layer Europe can own outright. Land, permits and grid capacity are allocated by European authorities under European law.
Where a European operator can win. By building where the grid has room, not where the old hubs are.
Siting. Ember finds countries with half the connection time attract about 20% more data-centre growth (p.18).
STACKIT’s sites. Its new sites already follow this logic. Lübbenau is a 13-hectare former power-plant site in Brandenburg with about 200 MW connected load (Lübbenau page). Dummerstorf near Rostock is planned for 240 MW by 2033, with an option for 1 GW and offshore wind supply (ZDFheute).
Capacity hoarding. This is also where policy can do the most for the least money. European data centres use only 44% of their nominal power rating (Ember, p.18). Use-it-or-lose-it connection rules would free capacity faster than any subsidy.
Layer 2 — Accelerators
Who controls it today. US chip designers, Taiwanese and Korean foundries, and the US government’s export-control regime. “In 2024, 96% of AI chips sold in the EU were from US vendors.” Taiwan holds 77% of foundry capacity at 7 nm and below and South Korea 23% (Chips Act 2.0 assessment, p.22).
What sovereign can mean: rent with exit. For the rest of this decade the accelerator layer cannot be owned. Chips Act 1.0 triggered about €80 billion of announced investment but no leading-edge AI logic production (p.11). The realistic version of sovereignty here has three parts:
multi-vendor procurement (NVIDIA, AMD, and emerging inference chips);
long-term supply contracts signed before shortages;
the ability to keep running for months on installed hardware if supply is cut.
Where a European operator can win. Not by designing chips but by buying well and running them hard.
STACKIT’s fleet. Its published certificate lists A100, L40S, H100 NVL and 8× HGX H100 nodes, with no Blackwell generation yet (GPU service certificate, p.3). That is a generation behind the frontier.
Partners. The partnership with Fujitsu on sovereign compute, including its Arm-based MONAKA processor, is a hedge worth watching (Schwarz Digits press release, 22 October 2026, schwarz-digits.de). For agentic inference, CPU-plus-accelerator diversity matters more than it does for training.
Layer 3 — The AI factory: facility, cluster and operations
Who controls it today. In Europe, a mix: hyperscaler regions, colocation providers, EuroHPC’s public AI Factories, and a few European operators.
AI Factories. EuroHPC’s 13 selected factories plus supercomputing total €10 billion of EU investment over 2021–2027. The largest current systems have up to 25,000 processors (AI Continent plan, pp.5–6, 8).
Gigafactories. The AI Gigafactories aim at more than 100,000 processors each.
What sovereign can mean: own. Operating the cluster is the layer where European ownership and European staff are both feasible and decisive. Control of physical access, maintenance, firmware updates and the operations centre determines who can actually reach the workload. The Commission’s framework scores exactly this under operational sovereignty (SOV-4: EU staff, EU support, source code and documentation). It also scores security under SOV-7, which requires EU-only security operations centres (Cloud Sovereignty Framework, pp.2–3).
Where a European operator can win. By running the cluster better than a public research centre and more accountably than a foreign hyperscaler.
The rules. The gigafactory regulation requires the coordinator to be “headquartered in the Union and controlled, directly or indirectly, by entities or persons established in the Union”. The EU pays up to 17% of computing capex, Member States at least match it, and the consortium carries the rest plus all operating costs (gigafactory regulation, pp.4, 8).
What that rewards. An operator who can carry two-thirds of capex and all opex, which a retailer with €185.6 billion of revenue can (Schwarz FY2025 results).
Layer 4 — Orchestration: Kubernetes, storage and the cloud control plane
Who controls it today. The software is largely open source (Kubernetes, OpenStack, Ceph and the wider cloud-native ecosystem). Its commercial control planes are dominated by the hyperscalers’ managed services.
What sovereign can mean: federate. This is a commons layer. No single European firm needs to own it. Europe needs its providers to be first-class contributors, and it needs workloads to move between them.
IPCEI-CIS. It was built for exactly this: up to €1.2 billion of state aid and €1.4 billion of private money for 19 projects building open-source software across the cloud-edge continuum (IPCEI-CIS announcement, p.1). The German participants include SAP, Deutsche Telekom, Siemens and IONOS, but not the Schwarz Group (IPCEI-CIS decision, pp.13–15).
German standard. The German administration’s cloud framework requires open standards, multi-cloud capability and minimised lock-in (German administration cloud strategy, pp.7–8).
Where a European operator can win. By making portability a selling point rather than a threat. STACKIT’s managed Kubernetes engine sits inside its BSI C5 scope (STACKIT certificates). An agentic cloud whose control plane is standard can promise what the incumbents’ business models resist: that a customer can leave. The CMA found egress fees above 5–10% of annual cloud spend for a typical customer moving a fifth of its data (UK CMA decision, pp.15, 153). On that evidence, a credible exit is a competitive weapon.
Layer 5 — Models
Who controls it today. The frontier is American, closed, and trained at billion-dollar budgets (Epoch on training costs, p.1). The open-weight tier is American (Meta, Google, OpenAI’s open-weight releases) and Chinese (Qwen, Kimi, DeepSeek). European open models exist but are smaller.
STACKIT’s catalogue. It makes the dependency concrete. Its AI Model Serving lists Google’s Gemma, OpenAI’s GPT-oss, Meta’s Llama 3.3 70B and several Qwen models, priced around €0.45 per million input tokens and €0.65 per million output tokens for the mid-sized tier. It lists no European model (STACKIT AI models).
What sovereign can mean: federate, with a hedge of owned models. The realistic goal is not a European GPT. It has three parts:
the ability to run any open-weight model on European infrastructure with European keys, so the weights are a commodity input;
a pipeline of European models good enough for the tasks where language, law and domain matter;
the legal and technical ability to switch models without rewriting agents.
Teuken-7B. The OpenGPT-X project shows the second part is achievable. Teuken-7B supports all 24 official EU languages, was trained on about 60% non-English data and uses a custom multilingual tokenizer (Teuken-7B paper, p.1).
Cohere and Aleph Alpha. The merger, with €500 million of Schwarz financing and an expectation that the combined company runs on STACKIT, is the most important model-layer move in this story (Cohere deal; TechCrunch). The resulting champion is Canadian-led with a German research base. That is federation among allies, not European ownership.
Where a European operator can win. By being the best place to run, fine-tune and audit open models on regulated data. The operator does not have to own the best model, only to be the safest place to use one.
Layer 6 — The agent runtime and the tool layer
Who controls it today. Nobody yet, in any settled way. Agent frameworks, tool-calling conventions and the emerging Model Context Protocol (MCP) ecosystem are young. Each hyperscaler is building its own agent platform. Enterprises are assembling agents from open frameworks, vendor SDKs and custom code.
What sovereign can mean: own. This is the most important layer in the whole stack, and the one where European ownership is most feasible. The agent runtime is where work happens:
credentials are held;
tools are invoked;
decisions are taken, logged and, in principle, reversed.
An agent runtime run by a provider under foreign jurisdiction is a channel through which foreign law can reach not just data but action. The German Interior Ministry’s legal opinion finds the CLOUD Act reaches data wherever a US company has “control”, and reads control broadly (German legal opinion, pp.3–5). In the agentic era that reach extends to the agent’s working memory and its keys.
Where a European operator can win. By offering a jurisdiction-clean agent runtime with audit built in: a place where agents run under EU law only, every tool call is logged in a tamper-evident form, and the customer holds the keys. Here the old hyperscaler advantages of a vast catalogue, global regions and frontier models count for least, and trust counts for most.
Layer 7 — Identity, keys and audit
Who controls it today. Mostly the platform providers’ own identity and key services, with customer-managed keys as an option. Workplace identity in most European organisations runs through Microsoft.
What sovereign can mean: own. Keys and audit trails are small, cheap and decisive. Customer-held keys in European hardware security modules, and audit logs stored under European control, change the legal position materially.
The limit of encryption. The German legal opinion cautions that a provider which locks itself out by encryption may still face US preservation and discovery duties, with sanctions for non-compliance (German legal opinion, pp.6–7). Encryption helps most when the provider itself is outside US jurisdiction.
Workspace by STACKIT. It shows the hybrid: Google Workspace with client-side encryption and keys held in STACKIT data centres, used to move about 600,000 Schwarz Group workplaces off Microsoft Office (STACKIT workplace migration).
Where a European operator can win. By making the key and audit layer portable across clouds, so a public body can hold its keys and its agent audit trail in one sovereign place even while some workloads run elsewhere.
Layer 8 — Enterprise data and systems of record
Who controls it today. European software is strong here. SAP runs the financial and operational core of a large share of European enterprises. Industrial data sits with Siemens, Bosch and thousands of manufacturers. Public registers sit with states.
What sovereign can mean: own, through gravity. This is where Europe holds the asset the agentic cloud most needs: the data agents must act on.
RISE with SAP on STACKIT. It became commercially available in September 2026 at price parity with US hyperscalers. Deployments start in November 2026, and STACKIT describes itself as the “first European hyperscaler” in the programme (SAP launch).
Why it matters. It puts the European system of record and a European agent platform in the same jurisdiction and, ideally, the same data centre.
Where a European operator can win. By co-locating agents with the systems of record they act on, which cuts latency, egress and legal exposure at once. Celonis running single-tenant on STACKIT, and Snowflake integrating with STACKIT key management, point the same way (Schwarz Digits press release, 17 September 2026, schwarz-digits.de).
Layer 9 — Sector applications
Who controls it today. Fragmented: thousands of European software firms, systems integrators and public-sector IT providers, plus the hyperscalers’ own vertical offerings.
What sovereign can mean: federate. No single operator should own the application layer. Policy should make it easy for European software firms to build agents on any sovereign infrastructure.
openDesk. The German open-source workplace suite, steered by ZenDiS, is the model. STACKIT became its first “Approved Sovereign Service Provider”, a role that requires BSI C5 (public-sector release).
Federal AI platform. The German federal AI platform shows the consortium form: SVA as integrator, Codesphere as platform layer, STACKIT as infrastructure, about €250 million in total (STACKIT on the federal AI platform).
Where a European operator can win. By being the infrastructure partner of choice for European application builders. That means stable APIs, fair revenue terms and no competing first-party application that takes the partner’s market.
What the anatomy shows
Laid out this way, the sovereign agentic cloud is neither impossible nor automatic.
Own (4 layers): power and sites, AI-factory operations, the agent runtime, and identity, keys and audit. Europe can own these, and with the systems-of-record layer they hold most of the trust value.
Federate (3 layers): orchestration, models and applications. Here open governance and portability matter more than ownership.
Rent with exit (1 layer): accelerators. This is the hard dependency, managed through supplier diversity, stockpiles and contracts.
Own through gravity (1 layer): systems of record, where Europe already holds the asset.
STACKIT’s current profile maps onto this almost exactly:
Strong: sites, operations, C5 certification, key custody, and SAP co-location.
Federated by necessity: the models, all of them non-European today.
Dependent: accelerators a generation behind.
Undecided: the agent runtime, the layer that matters most, which is still being built in the market.
Part III — Where Europe can win: eight wedges, and the economics that decide them
A wedge is a market segment where a European operator can win on merit:
the customer’s need is real and growing;
US-run offerings, including their “sovereign” editions, cannot fully meet it;
the European operator has an asset the incumbents lack.
Protection can help a wedge open, but it cannot be the reason the wedge exists. That is the lesson of France’s state-built Cloudwatt and Numergy. They failed by 2016 “for lack of market uptake” at a cost to the state of about €56 million, while OVH grew “without having received subsidies” (French Senate 2019, pp.136, 222).
The eight wedges below are ranked by how strong the evidence of demand is and how hard the incumbents would find it to respond.
Wedge 1 — Regulated workloads where jurisdiction is a legal requirement
The need. Banks, insurers, health systems, critical-infrastructure operators and defence suppliers face overlapping obligations: data protection, operational-resilience rules on concentration risk such as DORA, NIS2 security duties and, from 2026, the AI Act’s duties for high-risk systems. Each pushes towards provable control over where the data sits and who can reach it. Even a sceptical law-firm analysis treats DORA’s concentration-risk tools as part of the sovereignty toolkit (Clifford Chance, p.3).
Why incumbents cannot fully answer it. The Dutch government commissioned a legal review of the AWS European Sovereign Cloud. It concluded that the US can gain access to metadata, and that services can be suspended or terminated under US sanctions or executive orders. It rated these risks “improbable” but “not inconceivable” (Dutch legal review of AWS, pp.1–2). The responsible minister drew the plain conclusion that full sovereignty is not achieved (Dutch minister’s letter, pp.1–3). Asked under oath by the French Senate whether it could guarantee that French citizens’ data would never reach foreign authorities without French consent, Microsoft France answered that it could not (French Senate inquiry, p.23).
The European asset. An operator outside US jurisdiction, with EU staff and a security certification that already covers its AI services. STACKIT’s BSI C5 attestation covers compute with GPUs, managed Kubernetes, the major databases and AI Model Serving (STACKIT certificates).
Wedge 2 — Public administration and the sovereign workplace
The need. States are the largest IT buyers in their own economies, and most do not yet know what they run.
The Netherlands. Central government uses 1,588 cloud services. For 26% of them the type is unknown, and two-thirds of the material public-cloud services had no risk assessment (Dutch Court of Audit, pp.6–7).
EU institutions. They spent €87 million on public cloud services in 2025 (Commission answer to MEPs, p.1).
The EU sovereign cloud tender. It is worth €180 million over six years and was scored on the Cloud Sovereignty Framework. It selected four European providers, including STACKIT (STACKIT on the EU tender).
Why incumbents cannot fully answer it. France’s “cloud au centre” doctrine requires particularly sensitive data to sit in a cloud qualified under SecNumCloud and “immune to any unauthorised access by public authorities of third states” (French cloud doctrine, p.9). SecNumCloud caps non-EU ownership at 24% individually and 39% collectively (SecNumCloud rules, pp.50–51). In the protected tier, a US-controlled provider cannot qualify by design.
The European asset. An open-source workplace and agent layer ready to deploy. openDesk is the workplace suite; STACKIT is its first approved sovereign service provider (public-sector release). The German federal AI platform is the agent and infrastructure layer (STACKIT on the federal AI platform). The agentic step comes next: case-handling, drafting and register-query agents running on the same sovereign substrate.
Wedge 3 — Industrial AI on production data
The need. Europe’s comparative advantage is in machines, vehicles, chemicals and energy systems. The data they generate is large, proprietary and commercially sensitive. Industrial agents will plan maintenance, tune processes, check designs and handle supply-chain exceptions, and they need direct access to that data.
Why incumbents cannot fully answer it. Industrial firms fear handing process know-how to a platform that may also serve their competitors or be compelled by a foreign state. Bitkom’s 2025 survey finds 51% of German firms “strongly dependent” on US digital imports. On average, firms say they could survive only about 14 months without foreign digital imports, and 67% say Europe needs its own hyperscalers (Bitkom survey, pp.6–7, 18).
The European asset. European industrial firms and European clouds share one jurisdiction. STACKIT signed a memorandum of understanding with Bosch Mobility in July 2026 (STACKIT news, 8 July 2026, stackit.com), and Siemens and SAP sit inside the IPCEI-CIS cloud consortium. The wedge is industrial agents running next to industrial data, not general chat.
Wedge 4 — The gravity of SAP and other systems of record
The need. Agents that act on enterprise processes must read and write the ERP. Running the agent and the system of record in different clouds and jurisdictions adds cost on every call: latency, egress and legal exposure.
Why incumbents cannot fully answer it. They can host SAP. What they cannot offer is SAP plus agents inside a single European jurisdiction with no US parent.
The European asset. RISE with SAP on STACKIT, at price parity, with deployments from November 2026 (SAP launch). The Schwarz Group itself is migrating its ERP landscape onto it (TECH 2025 release). The group’s own SAP estate is very large; Lidl alone abandoned an earlier migration after seven years and about €500 million (ChannelPartner). That gives a European operator a reference workload that no marketing budget could buy. This may be the single strongest structural asset in the whole European agentic-cloud story.
Wedge 5 — Multilingual, open and auditable models
The need. Twenty-four official languages, many more regional ones, and legal and administrative language that general models handle poorly. Public bodies and regulated firms also need to inspect, fine-tune and freeze the models they rely on.
Why incumbents cannot fully answer it. Closed frontier models cannot be inspected or frozen. Their providers decide when to retire or change them. Open-weight models from US and Chinese labs can be run sovereignly, but their training data and alignment choices are made elsewhere.
The European asset. The open-model ecosystem: Teuken-7B covers all 24 EU languages with about 60% non-English training data (Teuken-7B paper, p.1), plus the European research labs and the merged Cohere and Aleph Alpha. The Linux Foundation finds transparency and auditability are the top benefits of open source for sovereign AI, at 80% in Europe (Linux Foundation survey, p.2). An operator that serves open models with full lineage, from data sheet and weights hash to evaluation record and version freeze, sells something the closed frontier cannot. That STACKIT’s catalogue today lists no European model is the clearest gap in the wedge, and the cheapest to close.
Wedge 6 — Sovereign inference at price parity
The need. Most agent steps do not need a frontier model. Retrieval, extraction, classification, drafting and tool selection can be handled by mid-sized open models at a fraction of the cost. And because agents use about 1,000 times more tokens than chat, the cost per token decides whether an agent deployment pays.
Why incumbents cannot fully answer it. They can match price, but not jurisdiction, at the same time.
The European asset. STACKIT’s open-model prices are already in the commodity range: about €0.45 per million input and €0.65 per million output tokens for 27–120-billion-parameter models, and €0.15 / €0.25 for GPT-oss 20B (STACKIT AI models). For scale, the token-consumption study quotes official frontier pricing of $1.25 per million input and $10 per million output tokens for GPT-5 (agent token study, appendix). The capabilities differ, but the price gap is what makes routing worthwhile: European agents can send most steps to sovereign open models and reserve the frontier for the steps that need it.
Wedge 7 — Energy-advantaged sites outside the congested hubs
The need. Inference capacity close enough to European users for interactive agents, powered by cheap, clean electricity, and connectable this decade rather than the next.
Why incumbents cannot fully answer it. They can and do build in the Nordics. But their European capacity planning is one input to a global allocation, which US policy has already tried to direct: the AI Diffusion rule required US-headquartered cloud firms to keep at least 75% of their AI compute in the US and allied countries (RAND on export rules, pp.3–4).
The European asset. Grids with room. Ember finds the Nordics and Southern Europe will see demand grow about 110% to 2030, nearly double the FLAP-D hubs’ 55%. The Nordics “top the list”, with low congestion, low power prices and carbon intensity, cheap land and less cooling. Norway’s grid operator is planning for a tripling of data-centre demand (Ember, pp.5, 13–14). A European operator with a federated footprint (training and batch work in the north, latency-sensitive inference near users) uses Europe’s geography as an advantage.
Wedge 8 — The agent audit and accountability layer
The need. Once agents act, someone must be able to show what they did, why, on whose authority, with which model version and under which law. The AI Act’s logging and human-oversight duties, financial supervisors’ model-risk expectations and public-law accountability all converge here. The EU’s own procurement framework rewards EU-only security operations and independent audits (SOV-7) (Cloud Sovereignty Framework, p.3).
Why incumbents cannot fully answer it. An audit trail held by a provider that can be compelled to disclose or suspend it is a weak audit trail. The International Criminal Court episode of 2025 turned that risk into a public fact. The prosecutor’s access to his Microsoft email was cut after US sanctions, and the court later moved about 1,800 workstations to openDesk (press reporting and UK parliamentary testimony, 2025–2026).
The European asset. A European operator can build the agent ledger as a product. Every tool call, credential use, data access and model invocation would be recorded in tamper-evident form, held under EU law, exportable to the customer and readable by regulators. This is the wedge with the least competition today and the greatest long-term lock-in. Whoever holds the audit layer becomes the trusted platform for agents.
The economics: utilisation decides everything
Wedges are where demand is. Economics decide whether serving it pays. Four facts govern the unit economics of a European agentic cloud.
Fact 1 — The GPU-hour is the cost unit, and STACKIT’s list price is high
STACKIT’s price list puts an 8× HGX H100 server at €64.33 an hour, or €46,318 a month (STACKIT price list, p.14). That is about €8.04 per H100-hour. A single A100 80 GB is €2.66 an hour and a single L40S €1.74. List prices are not the operator’s cost, and large customers negotiate. But a published sovereign list price far above global rental rates tells customers that sovereignty costs extra. The Cour des comptes estimates a sovereignty premium of 25–40% above standard cloud for SecNumCloud hosting in France (French Court of Audit, pp.10–11). The strategic task is to shrink that premium towards zero on inference, where the wedge is price parity.
Fact 2 — Token prices set the revenue a GPU-hour must earn
At €0.65 per million output tokens, recovering €8.04 per GPU-hour requires selling about 12.4 million output tokens per GPU-hour, roughly 3,400 tokens per second, every second, continuously. (This is an illustrative ENSI calculation from the two published STACKIT prices; it ignores input-token revenue, which adds income, and idle time, which removes it.) That throughput is possible for mid-sized models only with large batches. Erdil’s model shows batches can only be filled when enough requests arrive (inference economics paper, p.2). A sovereign inference cloud with thin traffic loses money on every idle second. One with steady agent traffic makes money on the same hardware.
Fact 3 — Utilisation, not subsidy, is the make-or-break variable
The international record is a warning. Japan subsidised about half of SAKURA internet’s ¥100 billion GPU-cloud investment under its economic-security law (Sakura investor deck, pp.3, 6). Sakura still reported a loss on its GPU business in 2026 (press reporting, 2026). India onboarded 38,000 GPUs against a 10,000 target and sells them at a subsidised ₹65 per GPU-hour (IndiaAI factsheet, pp.1–4). Its portal is reported to be under-used, with most subsidy flowing to a handful of model builders (press reporting, 2026). Capacity built ahead of demand is a cost, not an asset. That is why public demand (Report 2) and the agent wedges above matter more than the size of the capex grant.
Fact 4 — Energy is a small share of cost but a large share of margin
Training cost models put energy at only 2–6% of the total (Epoch on training costs, p.1). In commodity inference, where competition drives prices towards cost, the electricity bill and the cooling overhead (EU average PUE 1.36, Commission data-centre energy report, p.8) become a large slice of what is left. Siting matters on two counts:
the Nordic and Iberian power-price advantage;
Lübbenau’s design: direct liquid cooling and waste heat sold into district heating for up to 75,000 households from 2028 (Lübbenau page).
In the agentic era these are cost levers, not merely sustainability features.
What it implies for capacity
Bruegel’s conversion of 450,000 to 750,000 GPUs per gigawatt puts Lübbenau’s 200 MW at roughly 90,000–150,000 GPUs (Bruegel on AI compute, p.3). That is consistent with the company’s own figure of up to 100,000. Three comparisons put it in proportion:
Against the EU’s total AI compute (2 GW), Lübbenau is a tenth: a national-scale asset.
Against the projected EU data-centre shortfall of about 9 GW in 2030 (CADA impact assessment, pp.44–49), it is about 2%.
Against the 9 GW that Epoch’s trend projects for the single leading AI system in 2030 (Epoch AI, p.1), it is about one forty-fifth.
The conclusion is not that Lübbenau is too small. It is that no single European operator can match frontier training scale, and none needs to. A sovereign agentic cloud is an inference and integration business first. Its capacity should be sized to the European agent traffic it can win, and it can grow in modules as that traffic shows up, which is exactly the modular, two-phase design Lübbenau uses (Max Bögl).
A rough sense of the scale of the prize is useful, with the caveat that it is an illustration and not a forecast. Suppose European enterprises and public bodies ran one million substantial agent tasks a day at about two million tokens each, which the token-consumption study’s per-task figures make plausible for complex work. That is about two trillion tokens a day. At the throughput implied in Fact 2, serving that needs on the order of 7,000 H100-class GPUs running continuously: a small fraction of one Lübbenau. Agent adoption is likely to run much higher than one million complex tasks a day across a continent of 450 million people within a few years. If it does, the demand side justifies multiple Lübbenaus. The question is whether that traffic lands on European infrastructure or flows to US regions by default.
Part IV — The agentic engine: agents that run a sovereign cloud and its policy
Europe’s sovereignty instruments share one weakness: they are checked on paper, occasionally and slowly.
A certificate is issued and renewed.
A tender is scored once.
A grid-connection queue is reviewed by hand.
A legal opinion is commissioned after a scare.
Meanwhile the thing being governed changes weekly, with new models, new tools, new subprocessors and new US executive orders. The Dutch Court of Audit’s finding that two-thirds of material public-cloud services had no risk assessment is not a failure of diligence (Dutch Court of Audit, p.7). It is what happens when governance runs at human speed over a machine-speed system.
The ENSI proposal is to run sovereignty the way a sovereign agentic cloud runs everything else: continuously, with agents doing the monitoring, matching and evidence-gathering, and named humans owning every decision. Eight agent archetypes cover the job. For each: what it does · the data it needs · who is accountable.
1. The sovereignty-assurance agent
What it does. It turns the Commission’s Cloud Sovereignty Framework, BSI C5 and SecNumCloud from periodic attestations into a live score. For every service it maintains a current SEAL rating on each of the eight objectives, and it flags any change that would lower one. Examples: a new non-EU subprocessor, a change of control, a support desk outside the EU, a model served from a non-EU endpoint.
The data it needs. Corporate-ownership registers, subprocessor lists, staff-location data from the operations centre, the software bill of materials and hardware bill of materials, key-custody configuration, and the framework’s scoring rules (Cloud Sovereignty Framework, pp.2–6).
Accountability. The operator’s chief compliance officer signs the live score. The certifying authority (BSI, ANSSI or an accredited body) audits the agent’s method and samples its evidence.
2. The procurement-matching agent
What it does. It reads public tenders, classifies each workload by sensitivity and finds every qualified European offer that meets the required sovereignty level. It also produces the written justification that CISPE proposes buyers should file when they choose a non-EU provider (CISPE manifesto, pp.2–4). And it flags single-bidder tenders, which ECIPE’s analysis of 8,725 contracts shows rising from 28% to 46% under sovereignty framing (ECIPE on tenders, pp.2–3). Both sides of the policy argument are served: more European bids and more competition.
The data it needs. Tenders Electronic Daily, national procurement portals, the live sovereignty scores from agent 1 and workload-classification rules such as France’s “particularly sensitive” category (French cloud doctrine, p.9).
Accountability. The contracting authority’s procurement officer decides. The agent recommends and documents.
3. The capacity and grid-siting agent
What it does. It matches planned data-centre capacity to grid headroom, permitting speed, power price, heat-reuse potential and latency to demand. It ranks candidate sites for AI Gigafactories, for CADA’s Data Centre Acceleration Zones and for operators’ own expansion. It also watches connection queues for hoarded capacity: contracted but unused, as with EirGrid customers drawing about 34% of contracted capacity (Ember, p.18).
The data it needs. Grid operators’ queue and headroom data, ENTSO-E system data (ENTSO-E), the EU data-centre reporting database under Delegated Regulation 2024/1364, land registers, and permitting timelines by region.
Accountability. The national energy regulator and the permitting authority decide allocation. The agent makes the trade-offs visible and the queue rules enforceable.
4. The portability and exit agent
What it does. It keeps every critical workload ready to leave. It maintains an up-to-date migration plan for each one and estimates the egress and re-architecture cost. On a schedule, it rehearses a real move of a sample workload to a second provider and measures the time taken. This turns the Data Act’s switching rights into a tested capability rather than a paper right. It also answers the question ECIPE’s CADA cost study raises, where re-architecting accounts for about 70% of the projected transition cost (ECIPE on CADA, p.2), by measuring that cost in practice rather than modelling it.
The data it needs. Infrastructure-as-code repositories, dependency graphs, data volumes, provider price sheets and egress tariffs.
Accountability. The customer’s CIO owns the exit plan. Supervisors for regulated sectors can require evidence of rehearsal.
5. The licensing and egress watchdog
What it does. It monitors the practices the CMA identified as harming competition: egress fees, interconnection terms and licensing that charges more for running software on rival clouds. It computes the effective cost penalty a customer faces for multi-cloud. CISPE puts the extra cost of running Microsoft software on rival clouds at about 28% (CISPE complaint, pp.3–4). It flags breaches of Data Act switching obligations and of any commitments under the DMA.
The data it needs. Public price lists, licensing terms, customer invoices (with consent) and competition-authority decisions (CMA update 2026).
Accountability. The competition authority and the Data Act enforcement authority act on its findings. The agent never sanctions anyone.
6. The model-routing agent
What it does. For every agent step it chooses the model that meets the quality bar at the lowest cost and the required sovereignty level. By default it prefers European and open models served on sovereign infrastructure, and it escalates to frontier models only where they are needed and allowed. The token-consumption study shows models differ by over 1.5 million tokens per task on identical work and that more tokens do not mean better answers (agent token study, pp.1–3). Routing is therefore both a cost and a sovereignty lever, and it creates the steady demand European models need to improve.
The data it needs. Evaluation results by task type, model prices, token-use predictions, data-classification labels and the jurisdiction of each model endpoint.
Accountability. The customer’s AI owner sets the policy: which data may go to which model. The agent applies it and logs every decision to the audit ledger.
7. The AI Act compliance agent
What it does. It maintains the technical documentation, logs, human-oversight records and incident reports for each AI system that falls under the AI Act. It maps every deployed agent to its risk category and keeps its required evidence current. For public bodies it produces the transparency record that citizens and courts can inspect.
The data it needs. The agent ledger (wedge 8), model lineage records (wedge 5), deployment inventories and the AI Act’s obligations.
Accountability. The deployer’s designated AI compliance officer, and in public bodies a named senior official, signs the documentation. Market surveillance authorities audit it.
8. The kill-switch drill agent
What it does. It simulates the scenarios sovereignty exists to survive and measures the result. Examples:
a US sanction cutting a provider’s service;
an export-control change halting GPU deliveries;
a key-custody failure;
an outage of a single region.
Each drill reports how long critical public and economic functions would keep running, which agents would fail, and what fallback exists. The Greenberg Traurig analysis is a one-off, desk-based version of this drill (Dutch legal review of AWS). Bitkom’s finding that firms could last about 14 months without foreign digital imports is a survey-based estimate of what such drills would measure directly (Bitkom survey, p.7).
The data it needs. Service dependency maps, contracts, the installed hardware inventory, failover configurations and the exit plans from agent 4.
Accountability. The national cyber-security and crisis-management authorities own the drill programme. Each critical entity’s board owns its own results.
The operating rule for all eight is the one that runs through every ENSI agentic design. Agents scan, match, measure, rehearse and document. Humans decide, sign and answer for the outcome. Every agent action is itself recorded in the agent ledger, so the governance system is auditable by the same means it uses to audit others.
The risks that could sink it
Five risks deserve to be stated plainly, because a strategy that hides them will be blindsided by them.
Chip dependence and US rule changes. The AI Diffusion rule showed how quickly European access to compute can be redrawn. It placed six EU member states (Poland, Portugal, Greece and the three Baltic states) outside the allied tier, then was rescinded within months (CSIS on export rules, p.4; RAND on export rules). With 96% of EU AI chips from US vendors, a sovereign cloud is sovereign in operation and jurisdiction, not in supply. Mitigations are multi-vendor fleets, forward contracts, installed-base resilience and Chips Act 2.0’s push into AI chips (Chips Act 2.0, pp.4–5).
Model dependence. If every model a European cloud serves is American or Chinese, a licence change, a security finding or a geopolitical decision can remove the product’s core. STACKIT’s catalogue today carries exactly this exposure. Mitigations are a funded European open-model pipeline, model-agnostic agent design and routing that sends real traffic to European models.
Utilisation failure. Subsidised capacity without customers is the most common failure in the international record: Sakura’s GPU loss, India’s under-used portal, France’s Cloudwatt and Numergy. Mitigations are public anchor demand, the agent wedges above and modular build-out paced to contracted traffic.
Sovereignty-washing. “Sovereign” editions of US clouds, and European resellers running on US infrastructure, will capture much of the protected demand if definitions stay loose. ECIPE’s own data show domestic tender winners often run on hyperscaler infrastructure (ECIPE on tenders, p.3). Mitigations are live sovereignty scores (agent 1), honest SEAL labelling and procurement that checks the whole stack, not the logo.
Concentration and complacency inside Europe. A protected market can breed a European incumbent that charges a sovereignty premium indefinitely. ECIPE warns smaller member states could become dependent on French and German providers (ECIPE on CADA, p.3). Mitigations are mandatory portability, federation among several European operators, price-parity targets and conditionality on public support, the approach Mazzucato and Rodrik set out (Mazzucato and Rodrik).
A sixth risk sits behind the others: talent and execution. The leadership change at Schwarz Digits in July 2026, the same month as a STACKIT outage and an online-shop data leak (Lebensmittel Zeitung), is a reminder that a sovereign cloud is first of all an operational discipline. Uptime is the first sovereignty feature customers check.
Ten design laws for a European agentic cloud
Sovereignty is per layer. Specify, score and sell it per layer: own, federate, or rent with exit. Never claim it for the whole stack.
Own the layers where trust lives. Power and sites, cluster operations, the agent runtime, and identity, keys and audit are the layers to own outright.
Federate what is open. Orchestration, open models and applications stay shared and portable among several European providers.
Rent what you cannot make, with a tested exit. For accelerators and frontier models: multiple suppliers, forward contracts, drills.
Win on the agent layer. A jurisdiction-clean agent runtime with a built-in audit ledger is the product the incumbents cannot credibly match.
Sit next to the system of record. Co-locate agents with SAP, industrial and public data in the same jurisdiction and, where possible, the same site.
Route, don’t marry. Make agents model-agnostic, send most steps to sovereign open models, and reserve the frontier for where it earns its cost.
Price parity on inference is non-negotiable. A sovereignty premium is tolerable for a niche, fatal for a platform.
Build to traffic, not to headlines. Size capacity in modules paced to contracted agent demand. Utilisation decides margins.
Govern at machine speed. Run assurance, procurement matching, siting, exit, competition watch, routing, compliance and drills through agents, with named humans accountable.
First moves
For operators such as STACKIT, within twelve months:
put at least two European models in the serving catalogue with full lineage records;
launch an agent runtime with an EU-law-only audit ledger and customer-held keys;
package SAP plus agents as a single sovereign offer;
publish a live sovereignty score per service;
add a second GPU vendor or generation to the fleet;
publish inference prices at parity with the hyperscalers’ regional prices.
For governments, within twelve months (Report 2 sets out the full playbook):
classify public workloads by sensitivity and publish the result;
commit anchor demand for sovereign agent platforms in public administration;
reform grid queues on use-it-or-lose-it terms and fast-track sites with headroom;
fund a European open-model pipeline tied to real public use cases;
require exit rehearsals for critical public workloads;
commission continuous, agent-based sovereignty assurance in place of annual paperwork.
Close
Europe will not out-build the United States in frontier training compute this decade. It does not need to. The agentic platform is still forming, and its value will sit where agents meet trust, law and the systems of record. That is terrain Europe holds: its regulation sets the global bar, its enterprise software runs the core of its economy, its public sector is a vast and still-undecided buyer, and its grids, outside the congested hubs, still have room. The Schwarz Group’s bet shows that a European firm can assemble most of the stack:
sites and power;
a certified cloud;
SAP co-location;
a model partner;
the first public-sector anchors.
It also shows where the gaps are: European models, frontier-generation chips, the agent runtime, and the external traffic that keeps GPUs busy.
The option value lies in moving now, before the agentic habits harden. A European agent runtime that customers adopt in 2027 will be very hard to dislodge in 2032, just as AWS was by 2015. The one built in 2030 will be too late.