White Paper “Confident in 30 Days”: The Easy Transition to Digital Independence

Making the switch has never been easier— or more necessary: Relying on a U.S. cloud stack can cost a medium-sized company with 100–300 employees several hundred thousand euros over the years. The real cost of assessing the risks associated with this dependence is rarely just the licensing fee: it’s the personal liability of management, which grows with every year that goes by without a review.

The European Commission has unveiled its European Technological Sovereignty Package. Its central instrument is the Cloud and AI Development Act (CADA)—supplemented by a revised Chips Act 2.0, an open-source strategy, and a roadmap for the digitalization of energy infrastructure. The stated goal: to structurally reduce Europe’s dependence on non-European providers of semiconductors, artificial intelligence (AI), cloud infrastructure, and fundamental software components.

This is long overdue. But it’s not enough yet.

Why now? Three risks are converging

The geopolitical upheavals of recent months have brought a question back to the attention of boardrooms and executive suites that should have been there long ago: Who actually controls the data on which our business runs? Three developments are currently reinforcing one another.

1. Extraterritorial data access remains unresolved

The U.S. CLOUD Act (Clarifying Lawful Overseas Use of Data Act) requires U.S. providers to hand over data under their control—regardless of its physical location. A legal opinion commissioned by the Federal Ministry of the Interior reached the same conclusion in December 2025: What matters is control over the data, not the server’s location. Even “European Sovereign Cloud” offerings do not break this chain of access as long as the parent company is subject to U.S. law—as confirmed under oath by a senior representative of a U.S. hyperscaler before the French Senate in June 2025. In its resolution of January 22, 2026, the European Parliament explicitly identified Europe’s digital dependence as a strategic risk.

2. Politically motivated service suspensions are a reality

Extraterritorial sanctions can disrupt access to critical IT services. In May 2025, the Chief Prosecutor of the International Criminal Court (ICC) was temporarily cut off from his cloud account with a U.S. provider. In October 2025, the Court took action and migrated approximately 1,800 workstations to the German open-source solution openDesk . Denmark demonstrates that this approach is also feasible for an entire government administration.

3. License costs continue to rise, and vendor lock-in grows along with them

Microsoft is raising the list prices for Microsoft 365 in the business segment as of July 1, 2026 —Business Basic, for example, by 16.7 percent. At the same time, individual standalone license plans are being phased out, and companies are being steered toward larger suite bundles. This simultaneously increases both ongoing costs and dependence on proprietary ecosystems. Experience shows that this creeping dependence is only noticed when one tries to break free from it.

Liability Becomes a Top Priority: The Business Judgment Rule

Section 93 of the German Stock Corporation Act (AktG) and Section 43 of the German Limited Liability Company Act (GmbHG) require managers to exercise the due diligence of a prudent businessman. The Business Judgment Rule protects business decisions only if they were made on the basis of adequate information and following a documented risk assessment. Known structural risks—extraterritorial access laws, documented security concerns, economic dependencies—must therefore be actively assessed and documented. Experience shows that it is the disregard for risk documented over many years—rather than any single event—that triggers liability.

The NIS2 Directive (Network and Information Security 2) further exacerbates the situation: Since its national implementation, cybersecurity has explicitly been the responsibility of top management. For critical infrastructure operators, fines of at least 10 million euros or 2 percent of global annual revenue are at risk. We’ve outlined here how cloud sovereignty can now even be measured:“BSI Makes Cloud Sovereignty Measurable—What the New C3A Criteria Mean for Companies.”

The Cost of Dependency—and the Savings from Switching

The white paper quantifies the risk. An expected-loss model (expected loss = probability of occurrence × amount of loss) for a medium-sized company in a regulated industry totals approximately 660,000 euros over three years: resulting from data access from third countries, the risk of sanctions and service suspensions, license escalation, and potential GDPR fines for data transfers to third countries. This figure does not even include reputational damage, rising D&O premiums, and increased regulatory audits.

This is offset by a surprisingly modest cost side. In a three-year comparison, the SecureCloud stack—including a one-time migration—costs between 31 percent (for 50 users) and 37 percent (for 300 users) less than a comparable premium suite on the hyperscaler market. Security and compliance features, which are often purchased as paid add-ons in those environments, are included here as standard. This makes the switch to a European cloud an increasingly rational economic decision, in addition to the gain in sovereignty.

It’s never been easier: The 30-Day Migration Plan

Modern API-based migrations, structured rights transfers, and parallel operation make the transition predictable. The white paper describes it in four phases plus the start date:

Day 0 – Start. Set up a project channel, define external communication channels, digitally sign the project agreement, and perform a full backup of the legacy system. The migration is a structured process from day one.

Phase 1 (Days 1–7) – Analysis and risk assessment. Take stock of the system landscape, data volumes, security requirements, and business-critical processes. Result: a robust basis for decision-making in accordance with the Business Judgment Rule.

Phase 2 (Days 8–14) – Pilot Migration. A defined area is fully migrated; real-world access scenarios are simulated; and errors are identified in a controlled environment.

Phase 3 (Days 15–21) – Full Migration. Automated transfer of large data volumes while the old and new systems operate in parallel, with integrity and hash validation. Ongoing business operations remain stable.

Phase 4 (Days 22–30) – Go-Live. System launch, training, dedicated support, monitoring, backup validation, and a final report for the executive board and compliance.

A Robust Infrastructure as the Foundation – SecureCloud Actively Supports the Transition

SecureCloud operates its platform 100 percent in Germany on its own hardware at noris network AG, certified to BSI C5 and ISO 27001, with no U.S. parent company and no access from third countries. SecureShare, SecureWork, SecureSign, and SecureMail are specifically designed for the use cases that are now becoming the corporate standard thanks to sovereign infrastructure, open standards, and documented exit capabilities: law firms, tax consulting firms, clinics, banks and financial service providers, government agencies, and industry.

The fact that the German Bundestag, Schleswig-Holstein, Denmark, the International Criminal Court, and the German Armed Forces have taken this path is, for us, long-overdue confirmation that data sovereignty is a fundamental business responsibility. The standard that applies today to government agencies and critical infrastructure will inevitably extend to the entire regulated SME sector in the coming quarters.

Conclusion: Act now instead of reacting

Extraterritorial access laws remain in place, geopolitical uncertainties are increasing, licensing costs are rising, and regulatory requirements are becoming stricter. At the same time, the scope for action has never been greater: Never before has a structured transition been as technically plannable, as legally justifiable, and as economically sound as it is today. Gartner expects that by 2027, Europe will invest more in sovereign cloud infrastructure than North America for the first time— an increase from 6.9 to 23.1 billion U.S. dollars. The “Germany Stack” and “C3A” demonstrate that Germany is also serious about building out its own infrastructure .

For companies handling sensitive data, this issue clearly falls under the category of risk management. Sovereignty is achieved through action—and those who start today will be independent in 30 days.