Key Takeaways<\/h2>\n\n- \u20ac250 million, two lots:<\/strong> The consortium led by T-Systems and SAP commands 70 %, while the group comprising SVA, Schwarz Digits and Codesphere holds 30 %. No lot is awarded to a US hyperscaler.<\/li>\n
- Sovereignty is in the contract, not the marketing:<\/strong> Zero-Trust, Bring Your Own Key and open-source components are mandatory tender conditions, not optional extras. Operator, infrastructure and key management must remain anchored inside the EU.<\/li>\n
- The lesson for private operators:<\/strong> If you want to sell sovereignty, you must deliver key sovereignty, open interfaces and verifiable compliance, not just claim it. The federal government has just defined what the specification sheet must look like.<\/li>\n<\/ul>\n
Related:<\/span>Frontier model offline by ministerial decree<\/a> \/<\/span> Cleanly separating NIS2 and DORA compliance clusters in Kubernetes<\/a><\/p>\n1. Sovereignty is now a tender criterion, not a buzzword<\/h2>\n
\u201cDigital sovereignty\u201d long sounded like a keynote platitude. In this tender, the term becomes a contractual acceptance condition with explicit evaluation criteria. The federal government demands that the operator, infrastructure, key management and platform software all remain fully anchored within the EU. For the first time, a federal AI cloud is being built on a stack in which not a single lot is awarded to an American hyperscaler.<\/p>\n
Concretely, this translates into two operational imperatives. First, Zero-Trust: every access request is individually verified, whether it originates from inside or outside the network. Second, Bring Your Own Key: the using authorities retain cryptographic control over their own keys; the platform operator is not granted access to plaintext data. This is the technical definition of control, not the legal one.<\/p>\n
For private operators, the message is uncomfortable. Sovereignty without key sovereignty is merely a label. If you want to serve the public sector or regulated industries, you will henceforth be measured against exactly these two points.<\/p>\n
2. Open-source has become a contractual obligation<\/h2>\n
The platform must explicitly be built on open interfaces and allow open-source components. This reads like a commitment but acts as a lock-in brake. The German government has learned from the past: a cloud whose interfaces belong to a single provider is not a sovereign cloud, but a dependency with a German data center.<\/p>\n
The strategic effect is clear. Open interfaces reduce switching costs and keep competition alive in the stack. This same logic is driving private operators who want to get a grip on their multi-cloud costs, as the cloud-broker model<\/a> demonstrates. Where open standards take hold, negotiating power shifts back to the customer.<\/p>\nThe acid test is the exit. A platform is only truly open when switching to another operator doesn\u2019t trigger a migration project lasting months. Open-source components and documented interfaces turn a theoretical switching option into a practical one. For operators, this means: if you build openly, you must actively test the exit, not just promise it. A data export that takes three weeks of manual labor in an emergency has no place in the federal government\u2019s requirements as proof of sovereignty.<\/p>\n
\nThe award in figures<\/p>\n
70 \/ 30<\/strong> Lot distribution: T-Systems and SAP lead, followed by SVA with Schwarz Digits and Codesphere.
\n0<\/strong> Lots awarded to US hyperscalers.
\nISO 27001, BSI C5<\/strong> Compliance baseline, with the C3A sovereignty catalog slated as the next tier.<\/p>\n<\/div>\n3. PaaS means: the federal government rents the platform, not the responsibility<\/h2>\n
The cloud is explicitly being procured as a Platform-as-a-Service, not raw infrastructure. The consortium led by T-Systems and SAP delivers the PaaS services, SVA owns architecture and integration, Schwarz Digits provides the infrastructure via its BSI-certified StackIT Cloud, and Codesphere supplies the platform layer. Responsibilities are cleanly separated, but accountability remains with the federal government.<\/p>\n
This is where many sovereignty debates fall short. PaaS shifts operations, not liability. Whoever rents the platform still needs to know how keys rotate, how incidents escalate, and who picks up the phone at 03:40 a.m. in a crisis. The operator question doesn\u2019t disappear; it\u2019s merely delegated to contracts.<\/p>\n
For private providers, it\u2019s worth examining the underlying math. When a sovereign stack becomes financially viable hinges on utilization, staffing, and make-or-buy decisions, an issue Digital Chiefs dissects using concrete cost models<\/a>.<\/p>\n4. Compliance requirements are rising measurably<\/h2>\n
ISO\/IEC 27001 and BSI C5 serve as the baseline. The tender explicitly names the C3A sovereignty catalogue as the next hurdle, tightening the proof-of-sovereignty requirement. This is more than a simple tick in the specification sheet. It sets a moving target: whoever delivers today must be able to demonstrate tomorrow that they meet the stricter catalogue.<\/p>\n![\"3.](\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/post-iav0-hero-6.jpg\")
Federal government uses PaaS services \u2013 yet responsibility remains with the government.<\/figcaption><\/figure>\nThis is where ambition diverges from operations. Sovereignty, zero-trust and auditable key management must work in unison; otherwise \u201csecurity by incident\u201d replaces \u201csecurity by design.\u201d The difference can cost you a sleepless week and a supervisory question, as the parallel debate around NIS2 and DORA in Kubernetes clusters<\/a> shows.<\/p>\nA shifting compliance target also rewrites contract logic. Selling a certificate as a snapshot will fail the moment the next catalogue kicks in. A better operating model schedules audits as recurring beats: key rotation, logging and evidence collection run continuously, not just for the audit. For private operators, this is the uncomfortable takeaway from the award. The bar is not fixed, so the security concept cannot be either.<\/p>\n\n\n”<\/span><\/p>\n\/\/ Quote<\/div>\nWith the AI cloud we are creating the backbone of a sovereign, digital and AI-capable administration.<\/p>\n
Related:<\/span>Frontier model offline by ministerial decree<\/a> \/<\/span> Cleanly separating NIS2 and DORA compliance clusters in Kubernetes<\/a><\/p>\n \u201cDigital sovereignty\u201d long sounded like a keynote platitude. In this tender, the term becomes a contractual acceptance condition with explicit evaluation criteria. The federal government demands that the operator, infrastructure, key management and platform software all remain fully anchored within the EU. For the first time, a federal AI cloud is being built on a stack in which not a single lot is awarded to an American hyperscaler.<\/p>\n Concretely, this translates into two operational imperatives. First, Zero-Trust: every access request is individually verified, whether it originates from inside or outside the network. Second, Bring Your Own Key: the using authorities retain cryptographic control over their own keys; the platform operator is not granted access to plaintext data. This is the technical definition of control, not the legal one.<\/p>\n For private operators, the message is uncomfortable. Sovereignty without key sovereignty is merely a label. If you want to serve the public sector or regulated industries, you will henceforth be measured against exactly these two points.<\/p>\n The platform must explicitly be built on open interfaces and allow open-source components. This reads like a commitment but acts as a lock-in brake. The German government has learned from the past: a cloud whose interfaces belong to a single provider is not a sovereign cloud, but a dependency with a German data center.<\/p>\n The strategic effect is clear. Open interfaces reduce switching costs and keep competition alive in the stack. This same logic is driving private operators who want to get a grip on their multi-cloud costs, as the cloud-broker model<\/a> demonstrates. Where open standards take hold, negotiating power shifts back to the customer.<\/p>\n The acid test is the exit. A platform is only truly open when switching to another operator doesn\u2019t trigger a migration project lasting months. Open-source components and documented interfaces turn a theoretical switching option into a practical one. For operators, this means: if you build openly, you must actively test the exit, not just promise it. A data export that takes three weeks of manual labor in an emergency has no place in the federal government\u2019s requirements as proof of sovereignty.<\/p>\n The award in figures<\/p>\n 70 \/ 30<\/strong> Lot distribution: T-Systems and SAP lead, followed by SVA with Schwarz Digits and Codesphere. The cloud is explicitly being procured as a Platform-as-a-Service, not raw infrastructure. The consortium led by T-Systems and SAP delivers the PaaS services, SVA owns architecture and integration, Schwarz Digits provides the infrastructure via its BSI-certified StackIT Cloud, and Codesphere supplies the platform layer. Responsibilities are cleanly separated, but accountability remains with the federal government.<\/p>\n This is where many sovereignty debates fall short. PaaS shifts operations, not liability. Whoever rents the platform still needs to know how keys rotate, how incidents escalate, and who picks up the phone at 03:40 a.m. in a crisis. The operator question doesn\u2019t disappear; it\u2019s merely delegated to contracts.<\/p>\n For private providers, it\u2019s worth examining the underlying math. When a sovereign stack becomes financially viable hinges on utilization, staffing, and make-or-buy decisions, an issue Digital Chiefs dissects using concrete cost models<\/a>.<\/p>\n ISO\/IEC 27001 and BSI C5 serve as the baseline. The tender explicitly names the C3A sovereignty catalogue as the next hurdle, tightening the proof-of-sovereignty requirement. This is more than a simple tick in the specification sheet. It sets a moving target: whoever delivers today must be able to demonstrate tomorrow that they meet the stricter catalogue.<\/p>\n This is where ambition diverges from operations. Sovereignty, zero-trust and auditable key management must work in unison; otherwise \u201csecurity by incident\u201d replaces \u201csecurity by design.\u201d The difference can cost you a sleepless week and a supervisory question, as the parallel debate around NIS2 and DORA in Kubernetes clusters<\/a> shows.<\/p>\n A shifting compliance target also rewrites contract logic. Selling a certificate as a snapshot will fail the moment the next catalogue kicks in. A better operating model schedules audits as recurring beats: key rotation, logging and evidence collection run continuously, not just for the audit. For private operators, this is the uncomfortable takeaway from the award. The bar is not fixed, so the security concept cannot be either.<\/p>\n \n”<\/span><\/p>\n With the AI cloud we are creating the backbone of a sovereign, digital and AI-capable administration.<\/p>\n1. Sovereignty is now a tender criterion, not a buzzword<\/h2>\n
2. Open-source has become a contractual obligation<\/h2>\n
\n0<\/strong> Lots awarded to US hyperscalers.
\nISO 27001, BSI C5<\/strong> Compliance baseline, with the C3A sovereignty catalog slated as the next tier.<\/p>\n<\/div>\n3. PaaS means: the federal government rents the platform, not the responsibility<\/h2>\n
4. Compliance requirements are rising measurably<\/h2>\n