For years, European digital sovereignty has mostly lived in policy papers and procurement checklists. Airbus just put a migration schedule on it. The aerospace manufacturer has selected Scaleway, the French cloud provider owned by Iliad, as its sovereign cloud partner following a competitive European tender, with around 70 critical applications moving off AWS by the end of 2028 and a broader programme that could reach up to 900 applications over five to six years.
What Airbus actually said
Airbus’s Executive Vice President of Digital, Catherine Jestin, was explicit about the motive: the move is meant to keep “critical data assets shielded from foreign extraterritorial laws” while the company maintains control and resilience over its industrial operations. That is a direct reference to the US CLOUD Act and the exposure that comes with running aircraft design, engineering, and manufacturing data on infrastructure ultimately subject to US legal reach, regardless of which region it physically sits in. Scaleway CEO Damien Lucas framed it as industrial capability needing infrastructure that combines performance with “trust, openness and long-term control.” The deal adds to Airbus’s existing multi-cloud footprint rather than replacing it outright, but the applications in scope are described as the ones the company considers too sensitive to leave where they were.
SecNumCloud is doing real work here
The contract aligns with France’s “cloud de confiance” framework and its SecNumCloud qualification, the security certification issued by ANSSI, France’s cybersecurity agency, that requires a provider to be immune from non-EU legal jurisdiction over customer data as a condition of certification, not just a marketing claim layered on top of standard hosting. That distinction matters for any organisation evaluating sovereign cloud claims: a US hyperscaler’s EU region can restrict where data is stored and who operationally touches it, but it generally cannot remove the parent company’s exposure to US law. SecNumCloud is built specifically to close that gap, which is why it keeps showing up as the reference point in serious European sovereignty procurements rather than just AWS, Azure, or Google Cloud’s own sovereign region offerings.
A number the rest of the market will be measured against
What makes this deal notable is scale and specificity. Plenty of European organisations have said sovereignty matters; few have published a multi-year application count and a 2028 deadline. For CIOs and procurement teams elsewhere in aerospace, defence, energy, and other sectors where design and industrial data carries similar sensitivity, Airbus’s tender criteria, technical capability, interoperability, scalability, AI readiness, and legal and governance safeguards, now function as a public reference architecture for what a sovereignty-driven migration actually requires in practice, rather than what it requires on a vendor’s slide deck.
If your organisation is assessing whether a sovereign cloud migration makes sense for your workloads, or needs a realistic technical and legal gap analysis before committing to a multi-year programme like this one, contact Excello Digital. We help European organisations turn sovereignty requirements into workable architecture, not just intent.