6 min read<\/p>\n
By 2026, reshoring won\u2019t be a marketing label\u2014it\u2019ll be a line item in the budget. German mid-sized companies are moving specific workloads from US hyperscaler regions back to EU data centres\u2014some entirely, many in hybrid setups. The drivers aren\u2019t just sovereignty debates. It\u2019s audit questions from BSI-KRITIS assessments, customer C5 certifications, and KRITIS-Dachgesetz obligations kicking in from October 2025 that are forcing operational changes.<\/strong><\/p>\n Key takeaways<\/p>\n Related<\/span>Cloud Repatriation 2026: The TCO Model<\/a> \/<\/span> Broadcom-VMware Channel: The Provider Landscape 2026<\/a><\/p>\n This isn\u2019t a mass exodus\u2014it\u2019s workload triage. What must stay in the EU? What can run hybrid? What can pragmatically remain in AWS us-east-1 or Azure East US? This article explores what\u2019s actually happening in projects since early 2026\u2014and where the narrative clashes with hyperscaler-scale reality.<\/p>\n Three clear clusters are driving mid-sized companies to migrate in 2026. First: KRITIS-relevant workloads. Since the KRITIS-Dachgesetz and Germany\u2019s NIS2 implementation, operators of critical infrastructure must provide evidence on data processing location, access, and control. Energy providers, water utilities, and hospital groups are pulling patient and control data back\u2014often to Open Telekom Cloud or IONOS.<\/p>\n Second: personal data analytics and CRM data with Schrems II risks. Companies that relied on AWS SCCs and the EU-US Data Privacy Framework in 2024\/25 are facing audit pushback. Analytics pipelines are moving to EU-native providers or AWS Frankfurt (eu-central-1) with explicit region-lock policies.<\/p>\n Third: backups and long-term archives with legal retention requirements (commercial and tax law, \u00a7257 HGB, \u00a7147 AO). Cold data is shifting from US S3 to S3-compatible EU providers or OVHcloud Object Storage. The migration effort is manageable, but the compliance argument is strong.<\/p>\n Three frameworks dominate the debate, each carrying different weight. The BSI\u2019s C5 (Cloud Computing Compliance Criteria Catalogue)<\/strong> is the most practically significant lever. Major clients and public-sector buyers demand C5 Type 2 as a contractual baseline. AWS, Azure, and Google Cloud hold C5 attestations for their EU regions, but the additional criteria (DEU C5:2020) on data localisation force explicit region configuration. Anyone who\u2019s deployed globally until now will need to re-architect.<\/p>\n BSI-KRITIS<\/strong> isn\u2019t a certificate\u2014it\u2019s a mandatory regime for operators of critical infrastructure. The obligation under \u00a78a of the BSI Act requires proof of adequate protective measures every two years. In practice, that means cloud outsourcing must be documented, data processing agreements must be watertight, and exit strategies must be robust. Hyperscalers\u2019 standard DPAs often no longer cut it.<\/p>\n Gaia-X<\/strong> provides an architecture and labelling framework (Gaia-X Labels Level 1 to 3) that guarantees data sovereignty. Productive workloads on Gaia-X-certified services remain rare. Gaia-X primarily serves as a tender criterion in the public sector and as a template for internal governance. Anyone expecting Gaia-X to deliver a ready-made cloud will be disappointed.<\/p>\n The sovereignty story sounds clean: out of US clouds, into EU providers. In real-world projects, the narrative fractures at three key points.<\/p>\n First fracture point: Managed Services.<\/strong> Teams running production workloads on Amazon Aurora, DynamoDB, or Azure Cosmos DB won\u2019t find equivalent managed services with EU providers. Migration often means switching to self-managed PostgreSQL or smaller service catalogues\u2014doable, but costly in engineering time.<\/p>\n Second fracture point: SaaS dependencies.<\/strong> Microsoft 365, Salesforce, and ServiceNow all sit on US-owned platforms. Even Microsoft\u2019s EU Data Boundary offerings can\u2019t fully escape the CLOUD Act. If you\u2019re serious about blocking US access, you\u2019ll need to start at the SaaS layer, not IaaS.<\/p>\n Third fracture point: AI stack.<\/strong> EU providers are investing (STACKIT has an AI platform, OVHcloud offers GPU instances), but the gap with Bedrock or Vertex AI remains wide. Teams building LLM-based products often stay with US hyperscalers for inference, at least. Reshoring here means keeping data in the EU while running model inference where the models live.<\/p>\n If you’re launching a reshoring project, follow this sequence:<\/p>\n Reshoring in 2026 isn\u2019t a political statement\u2014it\u2019s an engineering project with a compliance driver. The cleanest approach is unglamorous: prioritise workloads, rigorously test one provider, and build in exit readiness. Do this methodically, and you\u2019ll gain data sovereignty without the scaling setbacks the narrative often downplays. Those planning reshoring as a total exit from US clouds quickly land in SaaS debates the IaaS team can\u2019t resolve.<\/p>\n Ultimately, the deciding question is: what do you need the audit stamp for? For KRITIS obligations and public tenders, EU providers are often non-negotiable. For productive AI and data platforms, the hybrid reality persists: EU regions with hyperscalers, strict region locks, plus an EU-native provider for components requiring C5 Type 2. This two-layer architecture may lack glamour, but it will survive the next audit cycles.<\/p>\n In operational architecture work for 2026, Gaia-X rarely appears as a standalone requirement\u2014but it frequently surfaces in public sector tenders and regulated industries. What matters in practice are the self-description schemas and the label system: a provider with Gaia-X Label Level 2 or 3 signals that specific sovereignty criteria (data processing location, access rights, jurisdiction) are contractually guaranteed. For a KRITIS company needing to explain to auditors why a workload remains in a US cloud, the label provides a usable argument. Without it, the discussion drags on.<\/p>\n EuroStack is newer, politically charged, and currently more of a roadmap debate. The vision of a seamless European infrastructure stack\u2014from silicon to compute to platform services\u2014isn\u2019t yet a foundation for mid-market architecture decisions in 2026. However, it appears in funding calls and influences which EU providers remain strategically relevant for the next five years. If you\u2019re planning reshoring today, check which providers are actively involved in EuroStack projects. It\u2019s not a buying criterion, but it signals long-term investment commitment.<\/p>\n In practice, this means: make Gaia-X Label a must-have in tenders, and EuroStack participation a bonus. Communicate both internally without fanfare. Overhype Gaia-X as a marketing topic, and you\u2019ll lose the compliance team; ignore it, and you\u2019ll lose public tenders.<\/p>\n The legal core of the reshoring wave isn\u2019t in Berlin\u2014it\u2019s in Luxembourg. Since the 2020 Schrems II ruling and the subsequent debates around the EU-US Data Privacy Framework, transferring personal data to the US has only been permissible with additional technical and organisational measures. The 2023 Data Privacy Framework formally stabilised the situation, but it remains under constant scrutiny. Several EU data protection authorities have signalled they would re-examine it if the framework faces political or legal challenges.<\/p>\n For architecture, this means: companies running productive systems with personal data in US regions today carry a residual risk\u2014one that can be mitigated by EU region locks, but never fully eliminated. The CLOUD Act allows US authorities to access data held by US companies under certain conditions, regardless of where the data is physically stored. For most mid-sized businesses, this isn\u2019t an operational issue, but it *is* an auditable item\u2014and those always end up in the risk register sooner or later.<\/p>\n The cleanest architectural response in 2026 isn\u2019t total withdrawal, but segmentation by data class: highly sensitive personal data (health records, employee information, communications) with EU-native providers, while operational data without personal ties can stay with hyperscalers. Hybrid cases require individual assessment. It\u2019s more administrative work, but it significantly reduces legal exposure\u2014and it\u2019s exactly the approach GDPR regulators want to see.<\/p>\n Two misconceptions persist. First: reshoring doesn\u2019t break dependence on US software stacks. Storing data in an EU data centre while processing it with Microsoft 365, Salesforce, or ServiceNow means you haven\u2019t truly left US jurisdiction. The SaaS question is a separate project\u2014one that demands its own solutions, like European alternatives such as Nextcloud, Open-Xchange, or specialised vertical SaaS from the DACH region.<\/p>\n What reshoring solves<\/p>\n What reshoring does NOT solve<\/p>\n Second: reshoring isn\u2019t a cost-cutting project. In most price comparisons, EU-native providers are more expensive than hyperscalers, especially for elastic workloads. Be upfront about this with your CFO\u2014or the project will collapse in the first budget review. The business case hinges on audit resilience, not infrastructure savings. Flip that logic, and you\u2019ll build a reshoring initiative that gets unwound after two years because the promised cost reductions never materialised.<\/p>\n At the latest when KRITIS obligations, C5 attestations, or BSI requirements land on your desk during the next audit cycle\u2014and your auditor explicitly raises the jurisdiction question. Below that threshold, a well-documented region lock within a hyperscaler\u2019s EU zone often suffices. It\u2019s less effort and meets most mid-market needs.<\/p>\n<\/details>\n No. Most projects in 2026 take a hybrid approach: critical workloads, classified by data sensitivity, move to EU-native providers, while the rest stay with AWS, Azure, or Google Cloud\u2014just locked to EU regions. Total-exit rhetoric works for Sunday speeches, rarely for actual roadmaps.<\/p>\n<\/details>\n In practice: BSI\u2019s C5 Type 2 as the baseline, ISO 27001 as the foundation, and Gaia-X Label Level 2+ for public tenders. KRITIS proofs (B3S) are sector-specific add-ons. Everything else is marketing fluff\u2014useful, but not a dealbreaker.<\/p>\n<\/details>\n From day one, bet on portable tech: Kubernetes over proprietary orchestration, Terraform instead of vendor-specific consoles, open data formats instead of managed-service quirks. Don\u2019t wait to draft exit plans until you\u2019re ready to switch\u2014make them a contractual part of onboarding with your new provider.<\/p>\n<\/details>\n Little to nothing, as long as the focus stays on IaaS. The SaaS debate is its own beast\u2014driven by different factors and often far more politically charged. If you handle reshoring cleanly during an IaaS migration and sidestep the SaaS question, you\u2019ve given an honest answer. No one\u2019s ditching Microsoft 365 as a side project in an infrastructure overhaul.<\/p>\n<\/details>\n Editor\u2019s Picks<\/p>\n More from the MBF Media Network<\/p>\n Digital Sovereignty for Mid-Sized Businesses<\/a>\n<\/div>\n\n
Which workloads are being repatriated<\/h2>\n
What these certifications really drive<\/h2>\n
Where the narrative clashes with hyperscaler reality<\/h2>\n
\n
\n
Practical Steps for a Reshoring Project<\/h2>\n
\n
How Gaia-X and EuroStack Fit Into the Reshoring Debate<\/h2>\n
GDPR, Schrems II, and the Question of Jurisdiction<\/h2>\n
What Reshoring Doesn\u2019t Solve<\/h2>\n
\n
\n
Frequently Asked Questions<\/h2>\n
When does it make sense to even consider reshoring as a project?<\/strong><\/summary>\n
Do I need to completely exit US cloud services for reshoring?<\/strong><\/summary>\n
Which certifications actually matter in the reshoring discussion?<\/strong><\/summary>\n
How do I avoid swapping US lock-in for EU lock-in?<\/strong><\/summary>\n
What does reshoring mean for your company\u2019s SaaS landscape?<\/strong><\/summary>\n
\n
\n