SAP Sovereign Cloud France: What March 19, 2026 Means for German IT Leaders

19 March 2026

3 Min. reading time

On March 19, 2026, SAP officially launched its Sovereign Cloud in France. The partner is Bleu, a joint venture between Orange and Capgemini aiming for SecNumCloud certification. For German IT decision-makers, this is more than just a French press release: SAP is positioning itself as the first major enterprise software provider with a genuine sovereignty strategy within the EU. The question is whether this model will also come to Germany.

The key points at a glance

🇫🇷 SAP launched the Sovereign Cloud in France on March 19, 2026, operated by Bleu (joint venture of Orange + Capgemini).
🔐 Goal is SecNumCloud 3.2 certification by ANSSI. First fully compliant services available mid-2026, 80 percent by year-end.
🏛️ Target audience: Opérateurs d’Importance Vitale (OIV), public administration, and regulated industries requiring SecNumCloud-compliant infrastructure.
📊 SAP serves 437,000 customers worldwide with cloud services. The Sovereign Cloud addresses the growing need for CLOUD Act-free infrastructure.
🇩🇪 In Germany, a similar model exists with Delos Cloud (SAP subsidiary) based on Azure, but without a certification equivalent to SecNumCloud.

What SAP has built in France

The SAP Sovereign Cloud France does not run on SAP’s own infrastructure, but on the platform provided by Bleu. Bleu is a joint venture founded in 2022 by Orange and Capgemini, offering Microsoft and SAP services on French infrastructure. The key difference: Bleu is pursuing SecNumCloud 3.2 certification from ANSSI (Agence nationale de la sécurité des systèmes d’information), the French equivalent to Germany’s BSI C5.

SecNumCloud goes a step further than BSI C5: The certification requires that the cloud provider not be subject to the jurisdiction of a third country. This excludes the US CLOUD Act. An SAP service running on Bleu’s infrastructure with SecNumCloud certification would thus be the first enterprise cloud service from a major provider able to claim genuine legal sovereignty.

The timeline: First fully compliant SAP services will be available from mid-2026. By the end of 2026, 80 percent of SAP’s cloud services are expected to run via Bleu. The target audience explicitly includes OIVs (Opérateurs d’Importance Vitale), the French public administration, and regulated industries requiring SecNumCloud-compliant infrastructure.

SecNumCloud 3.2

First enterprise software with genuine sovereignty certification in the EU

SAP + Bleu (Orange/Capgemini), certification targeted 2026

Why this is relevant for Germany

In Germany, Delos Cloud represents a conceptually similar model. Delos is an SAP subsidiary providing Microsoft Azure-based services for the German federal administration. The difference: Delos lacks a certification comparable to SecNumCloud. BSI C5 certifies technical security, but not legal immunity against the CLOUD Act.

Even Delos co-founders have admitted that in a conflict scenario, the cloud could operate independently from Microsoft for only a few months. Netzpolitik.org already headlined in 2024: “Into digital dependency with Microsoft.” The SAP-Bleu model raises a critical question: If France is getting a SecNumCloud-certified SAP cloud, why is Germany only getting an Azure-based interim solution?

The answer lies in regulatory pressure. France’s SecNumCloud standard forces providers to make a clear choice: either full sovereignty or no access to the public sector. Germany has BSI C5 as a technical standard, but lacks a comparable political consequence. This could change: The EU’s Cloud and AI Development Act (CADA) aims to establish uniform sovereignty standards across Europe.

France sets a clear condition: Anyone wanting to move critical infrastructure to the cloud must comply with SecNumCloud. This is not a recommendation, but a requirement. SAP has decided to meet this condition.
Analysis based on ANSSI requirements and SAP/Bleu press release (March 19, 2026)

What IT decision-makers should evaluate now

German companies face three key action areas:

First: Review the SAP roadmap. Companies using or planning to adopt SAP S/4HANA Cloud should clarify whether and when a sovereign SAP cloud option will be available in Germany. The Bleu partnership in France signals that SAP takes this issue seriously. Whether a comparable model will be introduced for Germany remains open.

Second: Understand SecNumCloud vs. BSI C5. Regulated industries should assess whether BSI C5 meets their compliance requirements, or whether the higher SecNumCloud level (excluding the CLOUD Act) is necessary. For companies serving French customers or public sector contracts, SecNumCloud will become mandatory.

Third: Monitor CADA developments. The Cloud and AI Development Act could establish EU-wide standards exceeding BSI C5. Organizations investing in cloud infrastructure now should ensure flexibility to adapt to stricter future requirements.

Conclusion: France is setting the benchmark

The SAP Bleu launch is more than just a product rollout. It demonstrates what digital sovereignty looks like in practice: a local operator, a recognized certification, and an enterprise software provider that complies with the standard rather than bypassing it. For Germany, this sets a benchmark—not because we need to copy France, but because an unavoidable question arises: If SAP can deliver SecNumCloud in France, why is BSI C5 sufficient for us?

Frequently Asked Questions

What is Bleu?

Bleu is a joint venture founded in 2022 by Orange and Capgemini. It provides Microsoft and SAP cloud services on French infrastructure and is pursuing ANSSI’s SecNumCloud 3.2 certification.

What is SecNumCloud and how does it differ from BSI C5?

SecNumCloud is the French security standard for cloud services, issued by ANSSI. Unlike BSI C5, SecNumCloud requires that the operator not be subject to the jurisdiction of a third country (e.g., USA/CLOUD Act). BSI C5 certifies technical security, while SecNumCloud additionally demands legal sovereignty.

Can I use the SAP Sovereign Cloud from Germany?

Technically yes, if you become a contractual partner with SAP France/Bleu. Practically, the solution is primarily designed for French OIVs and government agencies. For German companies, Delos Cloud is the current SAP sovereignty solution, although it is Azure-based and lacks a SecNumCloud equivalent.

When will a comparable solution be available in Germany?

There is no official announcement yet. Delos Cloud serves the German public sector but has a different architecture (Azure-based). The EU Cloud and AI Development Act (CADA) could establish uniform standards exceeding BSI C5.

What does the launch mean for existing SAP cloud customers?

In the short term, nothing changes for existing SAP cloud customers. Long-term, the launch signals SAP’s willingness to meet sovereignty requirements. Customers in regulated industries should monitor developments and keep their cloud strategy flexible.