Episode 14: Whose Supply Chain Is It Anyway? | Europe Built a Ruler
for Sovereignty — and Nobody Scored Full Marks
The data didn't leak from the sovereign cloud. It leaked from a
vendor. That single fact organises everything else in this
episode: a patent sale to Texas, a wobbly week in Neckarsulm, a
new European scoring system nobody has topped, and a €30 billion
tender that turns "buy compute" into "apply by November." Two
hosts, two readings, and a conclusion that is uncomfortable for
both of them.
In this episode:
00:00–03:19: Cold Open & A File at a
Vendor. Sarah corrects Markus's prep notes before the jingle
even plays — UpCloud is Finnish, not Swedish, and she read
forty sources while he made coffee. Then the story: early July,
Lidl informs online shop customers in Germany, Belgium and the
Netherlands about an incident at an external IT service
provider. Names, phone numbers, email addresses, dates of
birth, customer numbers. No passwords, no payment data, no
delivery addresses. The shop itself wasn't breached. Why this
is a sovereignty story: Lidl belongs to the Schwarz Group,
which runs Schwarz Digits, which runs STACKIT — Germany's
loudest sovereign cloud. And the data walked out through the
supply chain, not through the cloud. Whether that vendor is
itself part of the group is speculation from comment sections;
the hosts flag it as an open question and leave it open. This
is a podcast, not an indictment.
03:19–05:49: The Deal. 16 July: CrowdStrike
signs a binding agreement for the intellectual property of XM
Cyber — more than 45 patents plus source code. Schwarz had
acquired the company in 2021 for roughly 700 million dollars as
the security brain of its sovereign cloud. Now the brain is
sold, but the structure is unusual: customers and revenue stay
with Schwarz, only the technology goes to Texas. In return,
CrowdStrike's Falcon platform moves onto STACKIT, with
telemetry processed in Europe. Zscaler makes the same move.
Sarah signs the deal as a CFO — security products are brutally
expensive, the market leader does it better, the racks get
filled. Markus asks the other question, and cites the sharpest
German critique: a sovereign solution that depends on a US
vendor isn't one. Where they land: Schwarz didn't fail at
sovereignty, Schwarz redefined it. From "we build everything"
to "we own the ground it runs on." The landlord model.
05:49–07:53: One Wobbly Week. A deliberate
attempt at fairness rather than a pile-on. In the same stretch
of days: the data incident, a disruption at the STACKIT cloud,
and the departure of co-CEO Rolf Schumann after seven years,
leaving Christian Müller in sole charge — all around the
opening of the new campus. Underneath the headlines, the
quieter and more serious problem reported by the trade press:
moving Lidl's own merchandise management into STACKIT is taking
longer than planned, and customers are still waiting for SAP
migration. Sarah's three levels: location works, operations are
unproven, value creation was deliberately given up. Which is
why "sovereignty fake" is the wrong accusation — and why the
household version lands better. The basement is built and they
own it. The furniture is rented. Their own belongings are still
in the old apartment.
07:53–10:52: Europe Builds a Ruler. Until this
year, "sovereign" was a marketing word anyone could print on a
slide. The Commission's Cloud Sovereignty Framework scores
eight objectives — strategic control, legal control, security,
supply chain — and weights supply chain heaviest at twenty
percent. The scale is SEAL, Sovereignty Effectiveness Assurance
Level, 0 to 4, where 4 demands a full European supply chain
from chips to software. In April it was used for real money:
contracts for the EU institutions themselves, up to 180 million
euros over six years, deliberately awarded to four providers so
no single dependency emerges. Post Telecom with OVHcloud and
Clever Cloud: SEAL-3. STACKIT: SEAL-3. Scaleway: SEAL-3.
Proximus with S3NS, Clarence and Mistral: SEAL-2 — because the
underlying stack is built on a US hyperscaler's technology,
even though EU companies own and operate it. Owning the company
is necessary; it is not sufficient. On this ruler Schwarz looks
good, which retires the word "fake" and replaces it with a
harder question: how do you hold SEAL-3 while inviting Falcon
and Google services onto the platform? And the loose thread for
later: nobody reached SEAL-4.
10:52–14:30: The Omnibus — Right Answer, Wrong
Question. State of play on both buses. The AI omnibus is done:
Regulation (EU) 2026/1744, in force since 27 July, five days
before the original deadline. The trade inside it — industry
got time, with high-risk obligations moved to December 2027 and
August 2028, while civil society got new prohibitions on
nudifier applications and child abuse material from December
2026. Transparency was left untouched: Article 50 has applied
since 2 August, which is why this show discloses its synthetic
host in every episode. The data omnibus is still in the shop,
and two of its proposals read as if written for the Lidl
incident: breach notification in 96 hours instead of 72, and a
Single Entry Point replacing parallel filings under GDPR, NIS2
and DORA. Both make reporting cheaper. Neither makes the
incident less likely. And the counter-example: Article 88b, the
one measure that helped users rather than companies, was struck
in a Council compromise published by noyb in June — then the
vote was postponed, leaving the Council position to the Irish
presidency. Parked, not dead. Plus the detail worth savouring:
in the Commission's own draft, media service providers were
exempt from honouring the very signals users would set.
14:30–19:17: The Billionaire Test. Markus's
thought experiment: a European billionaire, patriotic about it,
with a mountain of clean data, who wants to train a serious
model here. Can he? Route one is the science route — JUPITER in
Jülich, Alice Recoque in France, nineteen AI Factories and
thirteen antennas, accessible through EuroHPC calls. Remarkably
open, and a gift for a startup, but it means an allocation, not
a building. Route two is commercial: OVHcloud is the only
European provider listed as a Challenger in Gartner's July
ranking for cloud AI infrastructure, with Scaleway and UpCloud
serving fine-tuning and mid-sized runs. But nobody hands you
tens of thousands of accelerators on one network on a credit
card. Which leaves route three, and it isn't a purchase — it's
an application. On 30 July, EuroHPC opened the tender for AI
Gigafactories: up to seven facilities in at least seven member
states, ten billion euros of public money as anchor demand,
more than twenty billion expected privately. Deadline 12
November 2026, selection early 2027, operations within eighteen
months. An informal call for interest already produced 77
proposals from 16 member states across 60 sites. What the money
buys beyond GPU racks: local packaging, server assembly, an
on-shore chip design ecosystem — the only route on the map that
attacks the SEAL-4 gap instead of sailing around it. What it
costs: purity. You wanted to be a sovereign patriot; you end up
a public-private partnership, with tax money in the foundation.
And the loose thread resolves: nobody reached SEAL-4 because
every route runs on the same accelerators, designed in
California and fabricated in Taiwan. Sovereignty ends where
physics begins.
19:17–22:25: The Verdict. The honest
scorecard, and deliberately from the buyer's side rather than
the vendor's. Politically it worked: Europe turned a buzzword
into a procurement criterion, and for a purchasing company that
means real money saved on due diligence — the score does the
work. Demand is real, with analysts expecting European
sovereign cloud infrastructure to grow more than eighty percent
this year and nearly double again next. But note the driver:
not price, not features. The CLOUD Act, geopolitics, and
America becoming legally unpredictable. Companies aren't buying
a better product, they're buying insurance. Economically it's
half a success. For standard workloads — virtual machines,
storage, Kubernetes, databases — European providers deliver,
often cheaper. Perhaps seventy percent of a mid-sized company's
estate could move today without heroics. The other thirty is
where it hurts: ERP, AI services, the hard cases. Plus the
software layer, where sovereign infrastructure running American
software moves the jurisdiction risk up rather than removing
it, and the certification patchwork that makes cross-border
operators pay compliance more than once. What a rational
company therefore does: tier it. Sensitive and regulated
workloads go sovereign; everything else stays put. Sovereignty
in 2026 is an insurance premium, not a savings plan. Two things
would change that — SAP-class workloads running properly on
European platforms, and gigafactories delivering training you
don't have to shop for in California.
22:25–24:08: Let's Land This. One closing
thought each. Sarah: this year sovereignty stopped being a vibe
and became a score, and marketing can survive an argument but
not a number. Markus: the strangest fact in the whole story is
that Europe's biggest single bet on digital independence — the
eleven-billion-euro data center, the two-billion-euro digital
division, the SEAL-3 badge — is financed by a discount
supermarket. Not a tech giant, not the state, not the stock
market. Which is the strength: patient family money, no
quarterly earnings call, no activist investor demanding the
data centers be sold. And the weakness: a private partnership
company owes the public no accounts, and on that infrastructure
now run government platforms and, since April, the institutions
of the European Union. The question is left open on purpose — a
problem to fix, or simply Europe's way of doing it?
Ordoliberalism with a loyalty card.
24:08–28:12: Outro Song. "Sarah's Tech (Europe
On The Wire)" — like the host, mainly synthetic: the track was
produced primarily with AI.
Key Takeaways:
Location Is the Easiest Question and the Least
Informative: The Lidl data left through a vendor, not
through the cloud. Where the servers stand was never the risk;
who else touches the file is. Sovereignty is a supply chain
question.
Owning the Company Is Necessary, Not
Sufficient: A European provider with European staff
and European data centers still caps at SEAL-2 if the stack
underneath belongs to a US hyperscaler. The technology itself
has to be free of critical dependencies — which is precisely
what the CrowdStrike deal trades away.
Nobody Reached SEAL-4: Not one of the four
winners has a full European supply chain from chip to software.
Every route to training a model in Europe — public
supercomputers, commercial clouds, future gigafactories — runs
on the same imported accelerators.
The Omnibus Lowers the Cost of Compliance, Not of
Dependency: 96 hours instead of 72, one reporting
portal instead of four. Both make an incident cheaper to
report. Neither makes it less likely, and neither touches who
your vendors are.
To Train at Scale in Europe, You Apply — You Don't
Buy: The AI Gigafactories tender closes 12 November
2026 with operations roughly eighteen months after selection.
Until then, capacity means renting from OVHcloud, Scaleway or
comparable providers, with limited sovereignty either way.
For the Buyer, Sovereignty Is an Insurance
Premium: Fewer features, equal or higher price, plus
migration cost. Which is why the rational corporate answer is
tiering, not switching — and why demand is driven by legal risk
rather than by product quality.
Europe's Biggest Sovereignty Bet Is
Retail-Financed: Patient capital with no quarterly
pressure, and no obligation to explain itself to the public
whose administrations now run on it. Both halves of that
sentence matter.
Sources & Further Reading
The Digital Omnibus, both halves
European Commission — Digital Omnibus Regulation proposal:
the original text and the Commission's own reasoning.
Bird & Bird — Introduction to the European Commission's
Digital Omnibus Package: the clearest structural overview of what
the package actually contains.
White & Case — EU agrees Digital Omnibus deal to simplify
AI rules: the trilogue outcome behind Regulation (EU) 2026/1744.
Gleiss Lutz — the AI Act simplification proposal: the
deadline shifts, article by article.
Usercentrics — what the AI Act deal means for transparency
and consent infrastructure: useful on why Article 50 survived
untouched while high-risk obligations moved.
EDRi — The Digital Omnibus is going on summer break. Your
rights are not.: the civil society reading of the postponement,
including Article 88b.
LYDnews — Digital Omnibus: Streit um Cookie-Einwilligung: the
state of the fight over consent signals.
Bitkom — Stellungnahme Digital Omnibus (GDPR): the industry
position, worth reading alongside the critics rather than instead
of them.
Sovereignty, measured
European Commission, 17 April 2026 — Commission advances
cloud sovereignty through strategic procurement: the Cloud
Sovereignty Framework, the eight objectives and the SEAL levels,
including what SEAL-4 actually requires.
European Commission, 17 April 2026 — the €180 million award
for sovereign cloud services: the four winning consortia and
their assurance levels.
EuroHPC Joint Undertaking, 30 July 2026 — launch of the AI
Gigafactories call: scope, budget and the co-investment model
behind the €30 billion figure.
EuroHPC Joint Undertaking — call for tenders: selection of AI
Gigafactory consortia: the tender itself, including the 12
November deadline and the selection criteria.
OVHcloud, July 2026 — Gartner Magic Quadrant for Cloud AI
Infrastructure: the ranking in which OVHcloud appears as the only
European Challenger.
Schwarz Digits, XM Cyber and the wobbly week
CrowdStrike, 16 July 2026 — CrowdStrike and Schwarz Digits
expand strategic partnership: the binding agreement for the XM
Cyber intellectual property, in the companies' own framing.
Lebensmittel Zeitung — "Dämpfer für Digits": the STACKIT
disruption, the data incident and Rolf Schumann's departure,
reported together.
Borns IT- und Windows-Blog, 21 July 2026 — "Verraten und
verkauft?": the sharpest German critique, and the source of the
"oxymoron" argument.
heise online — "Kundendaten bei Dienstleister abgeflossen:
Datenschutzvorfall beim Lidl-Shop": the incident at the external
IT service provider and the data fields affected.
Related episodes: Episode 13, A Ritual Without a
Religion — how Europe almost killed the cookie banner, and why
Article 88b matters here too. Plus Three Lost Platforms — why
Europe keeps winning the device and losing the layer, and The
Imaginary ETF — where European tech is actually owned.
Disclosure: Sarah Vailby is a synthetic host.
Her voice is AI-generated and disclosed in every episode, in line
with the AI Act's transparency obligations. Markus works in the
web hosting industry. This show uses no tracking pixels.
Feedback: If you buy cloud services for a
company: has a sovereignty score ever changed a purchasing
decision you made — or is it a box that gets ticked after the
vendor was already chosen? And what's still stuck on a
hyperscaler because there's no European equivalent? Be specific;
we're more interested in your migration list than in your
position. Send your view — anonymously if you prefer — to
feedback@experten-system.de. The best responses make it into a
future episode.
Kommentare (0)
Melde dich an, um einen Kommentar zu schreiben.