SAP Sovereign Cloud France: Impact on German IT Decision-Makers
SAP launches its sovereign cloud in France with Bleu (Orange + Capgemini) and SecNumCloud certification. Implications for German companies, Delos Cloud, and European sovereignty.
On March 19, 2026, SAP officially launched its Sovereign Cloud in France. The partner is Bleu, a joint venture between Orange and Capgemini aiming for SecNumCloud certification. For German IT decision-makers, this is more than just a French press release: SAP is positioning itself as the first major enterprise software provider with a genuine sovereignty strategy within the EU. The question remains whether this model will also come to Germany.
At a Glance
- 🇫🇷 SAP launched its Sovereign Cloud in France on March 19, 2026, operated by Bleu (a joint venture between Orange and Capgemini).
- 🔐 The initiative aims to achieve SecNumCloud-3.2 certification from ANSSI. First full services expected by mid-2026, with 80 percent available by year-end.
- 🏛️ Target audience: Opérateurs d’Importance Vitale (OIV), public administration, and regulated industries requiring SecNumCloud-compliant infrastructure.
- 📊 SAP serves 437,000 customers globally with cloud services. The Sovereign Cloud addresses the growing demand for infrastructure free from the CLOUD Act.
- 🇩🇪 In Germany, Delos Cloud (an SAP subsidiary) offers a similar model based on Azure, though it lacks a comparable certification like SecNumCloud.
What SAP has built in France
The SAP Sovereign Cloud France does not run on SAP’s own infrastructure, but on the platform of Bleu. Bleu is a joint venture founded in 2022 by Orange and Capgemini that provides Microsoft and SAP services on French infrastructure. Notably, Bleu is aiming for the SecNumCloud 3.2 certification from the ANSSI (Agence nationale de la sécurité des systèmes d’information), France’s equivalent to the German BSI C5 standard.
SecNumCloud goes a step further than BSI C5: The certification requires that the cloud provider must not be subject to the jurisdiction of a third country, effectively excluding the U.S. CLOUD Act. An SAP service hosted on Bleu infrastructure with SecNumCloud certification would therefore be the first enterprise cloud service from a major vendor able to claim genuine legal sovereignty.
Here’s the timeline: The first complete SAP services will be available from mid-2026. By the end of 2026, 80 percent of SAP’s cloud services are expected to run via Bleu. The target audience explicitly includes OIVs (Opérateurs d’Importance Vitale), the French public administration, and regulated industries requiring SecNumCloud-compliant infrastructure.
Why This Matters for Germany
In Germany, Delos Cloud represents a conceptually similar model. Delos is an SAP subsidiary that provides Microsoft Azure-based services to the German federal administration. The difference: Delos lacks a certification comparable to SecNumCloud. The BSI C5 certifies technical security, but not legal immunity against the CLOUD Act.
Delos co-founder himself admitted that in the event of a conflict, the cloud could operate independently of Microsoft for only a few months. Netzpolitik.org already titled in 2024: “Dependence on Microsoft in the digital age.” The question SAP’s Bleu model raises: If France receives an SAP cloud certified under SecNumCloud, why does Germany only get an Azure-based interim solution?
The answer lies in regulatory pressure. France’s SecNumCloud standard forces providers to make a clear choice: full sovereignty or no access to the public sector. Germany has a technical standard in BSI C5, but lacks a comparable political consequence. This could change: The EU’s Cloud and AI Development Act (CADA) aims to establish uniform sovereignty standards across Europe.
What IT Decision-Makers Should Evaluate Now
German companies face three key areas of action:
First: Review SAP’s roadmap. Organizations currently using or planning to adopt SAP S/4HANA Cloud should clarify whether and when a sovereign SAP cloud option will become available in Germany. The Bleu partnership in France signals that SAP is taking the issue seriously. Whether a comparable model will be introduced for Germany remains to be seen.
Second: Understand SecNumCloud vs. BSI C5. Regulated industries should determine whether BSI C5 certification sufficiently meets their compliance requirements, or whether they need the higher SecNumCloud level (which includes CLOUD Act exemption). For companies serving French customers or handling government contracts in France, SecNumCloud will be essential.
Third: Monitor developments around the CADA. The Cloud and AI Development Act could establish unified European standards that go beyond BSI C5 requirements. Organizations investing in cloud infrastructure now should plan for flexibility, ensuring they can adapt to stricter requirements if needed.
Conclusion: France sets the standard
The launch of SAP Bleu is about more than just a product debut. It demonstrates how technological sovereignty can be implemented in practice: through a local operator, recognized certification, and an enterprise software provider that adheres to the standard rather than circumventing it. For Germany, this serves as a benchmark-not because we should copy France, but because an inevitable question arises: if SAP can offer SecNumCloud in France, why do we settle for BSI’s C5 standard?
Frequently Asked Questions
What is Bleu?
Bleu is a joint venture founded in 2022 by Orange and Capgemini. It offers Microsoft and SAP cloud services hosted on French infrastructure and aims to achieve the ANSSI’s SecNumCloud 3.2 certification.
What is SecNumCloud and how does it differ from BSI C5?
SecNumCloud is the French security standard for cloud services, issued by ANSSI (Agence nationale de la sécurité des systèmes d’information). Unlike BSI C5, SecNumCloud requires that the operator is not subject to the jurisdiction of a third country (e.g., the U.S./CLOUD Act). While BSI C5 certifies technical security, SecNumCloud additionally demands legal sovereignty.
Can I use the SAP Sovereign Cloud from Germany?
Technically yes, if you become a contractual partner of SAP France/Bleu. However, the solution is primarily designed for French OIVs (Opérateurs d’Importance Vitale) and public authorities. For German companies, Delos Cloud is SAP’s current sovereignty solution, though it’s based on Azure and lacks a SecNumCloud equivalent.
When will there be a comparable solution in Germany?
There is no official announcement yet. Delos Cloud serves the German public sector but uses a different architecture (Azure-based). The EU Cloud and AI Development Act (CADA) could establish unified standards that go beyond BSI C5.
What does the launch mean for existing SAP cloud customers?
In the short term, nothing changes for existing SAP cloud customers. In the long run, the launch signals SAP’s readiness to meet sovereignty requirements. Customers in regulated industries should monitor developments and keep their cloud strategies flexible accordingly.
Related Articles
- Sovereignty-Washing: Why an EU Data Center Doesn’t Guarantee Data Sovereignty – Cloud Act and Sovereignty (cloudmagazin)
- Digital Sovereignty 2026: Delos Cloud and Gaia-X – CIO Perspective (Digital Chiefs)
- Sovereign Cloud as a Board-Level Decision – Strategic Context (Digital Chiefs)
More from the MBF Media Network
- AI Paradox Germany: High Investment, Low Transformation – Latest Deloitte Study (MyBusinessFuture)
- Attack via Microsoft Teams: A0Backdoor – Security News (SecurityToday)
Header image source: Nemuel Sereti / Pexels
Translated from the German original using artificial intelligence. The German version is authoritative.
