On Saturday, AWS let its European Sovereign Cloud spend a few hours away from the family network. By all accounts, the kid was fine. But last week Washington ruled that what matters is who your parents are, and this kid’s parents still live in Seattle.
Sovereign AI | theCUBE Research | Amit Eyal Govrin | October 2026
The first sleepover
Run the calendar back to September 28.
AWS sent the note home. Stéphane Israël, who runs the AWS European Sovereign Cloud, posted it on the AWS Security Blog: “On Saturday, October 24, 2026, we will conduct an exercise.” [1]
The house rules were strict. For several hours, the Brandenburg region would run without its connection to the AWS Global Network backbone, using “dedicated internet connectivity from European internet service providers” instead. No calling home. The team would also switch off, entirely, the separate system that handles the region’s “limited, controlled transfers” of operational data. [1] No care packages either.
The goal: “verifiable technical and operational evidence” that the region runs without anything outside the EU. [1]
Saturday, October 24. The sleepover reportedly went ahead. [3]
Tuesday, October 27, as I write this. AWS’s Security Blog and its European newsroom have published nothing on how it went. [13][14] AWS said it “will share an update after the exercise with regulators and customers.” [1] InfoQ notes AWS hasn’t said the results will be published. [2]
So the report card goes to the teachers and the other parents. Not you, unless you’re one of them. Not me either.
That’s the whole edition. Every parent knows a kid who survives one night away hasn’t moved out. AWS proved its European cloud can sleep somewhere other than Seattle’s network. The question Europe has been asking for eight years is whether it’s allowed to move out.
Credit where it’s earned
Credit to AWS first, because this is real work, and pretending otherwise cheapens the rest of the argument.
It put the sleepover on the family calendar, in public, four weeks out. [1] I haven’t seen another hyperscaler announce a disconnection of its sovereign cloud in advance. A fire drill with a date on it is still a fire drill.
It took the phone away too. Switching off the transfer channel is the harder half, because that’s the pipe that “accepts vetted source code mirroring and software updates.” [1] Cutting the backbone proves the kid can find its own way home. Cutting the update pipe proves it can live off what’s already in the fridge.
It graded itself on the school’s rubric, not the family’s. AWS tied the exercise to the European Commission’s EU Cloud Sovereignty Framework and to C3A, the cloud autonomy criteria Germany’s BSI published in April. [1][9] Vendors usually write their own test and then pass it. This one picked a public test.
And the setup is serious. More than €7.8 billion committed. Three subsidiaries incorporated in Germany, led by EU citizens. An advisory board with two independent members. And a brand-new German parent company. [4]
Hold on to the word “parent.” It comes back.
That’s the most credible sovereignty evidence any US hyperscaler has offered this year.
Then you read the launch press release.
The brochure said it could move out. The test was one night.
January 15, launch day. Amazon’s release said the region can “continue operations indefinitely, even in the event of a communications disruption with the rest of the world.” Same release: “There is zero operational control outside of EU borders.” [4]
October 24, the test: “several hours.” [1]
Indefinitely is moving out. Several hours is a sleepover. I’ll take the sleepover, gladly. I just won’t confuse the two, and neither should your risk register.
Odd-Arne Haraldsen, who runs IT operations for a Swedish municipality, put it best in InfoQ: “Redundancy is not the same as independence, and continued operation is not the same as sustained autonomy.” [2]
The number I want isn’t whether the kid slept through the night. It’s how many weeks it lasts with the update channel off before it calls home for clean laundry. That’s the drill I’d pay to watch.
AWS ran the “down” drill. Europe’s problem is “prohibited.”
In the first edition of this newsletter, I asked you to run a 72-hour “prohibited, not down” drill. The distinction is the whole point.
“Down” is the kid’s phone dying at a friend’s house. A cable cut, a fiber in the Baltic, a routing mistake. That’s an engineering problem, and AWS just showed it can handle a few hours of one.
“Prohibited” is a letter from the parents’ lawyer. A court order, an executive order, a sanctions list, a request for data in a provider’s “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.” [7] A letter doesn’t travel over the backbone. It travels through the family tree.
Here’s the part nobody put in the note home.
Remember the new German parent company? It has a parent too. The AWS European Sovereign Cloud, per InfoQ, “remains wholly owned by Amazon.com Inc.” [5] InfoQ adds the line every European general counsel already knows: “Courts can require parent companies to produce data held by subsidiaries.” [5]
AWS’s own FAQ answers the CLOUD Act question this way: it “does not give the U.S. government or any government unfettered or automatic access to data.” [6]
Read that twice. Not unfettered. Not automatic. That’s a description of the curfew. It isn’t a promise the parents can’t call.
And last week Washington settled what parents mean. The DHS order on DeepSeek didn’t care where the weights ran. It cared whose jurisdiction the developer answers to. [10][12] Washington applied that rule to a model from Hangzhou. Europe just got a cloud in Brandenburg whose parents live in Seattle.
You can unplug a cable. You can’t unplug a parent.
In China, Amazon’s cloud lives with a host family
Now the receipt.
Amazon already runs cloud regions it doesn’t operate. Two of them, in China. Beijing Sinnet Technology operates the Beijing region. Ningxia Western Cloud Data Technology operates the Ningxia region. Amazon’s own page: “China Regions’ operations are separate from Amazon Web Services Global Regions.” [8]
So the playbook exists. In China, Amazon’s cloud lives with a host family that holds the house keys. In Germany, it lives with its parents. [5][8]
I’m not saying Europe should copy China, and I’m not picking a team. I’m grading the dependency, not the company. But the next time someone tells you a US hyperscaler can’t let go, show them Amazon’s China page. It can. It depends on who’s asking, and how firmly.
The five pillars, under pressure
Same test I run on every vendor. This week the vendor is the AWS European Sovereign Cloud, and the buyer is a European bank, ministry or hospital that moved in because the brochure said sovereign. Hi, Frankfurt. Hi, Brussels. Hi, every procurement team that just ticked the C3A box.
01 Territorial
The question. Where do your data and compute physically reside, at rest and in motion?
The story. Brandenburg, with sovereign Local Zones planned for Belgium, the Netherlands and Portugal. [4] During the drill, traffic moved to European internet providers. [1]
Under pressure. Saturday was this exact test.
Verdict. Pass. It slept in its own bed.
02 Operational
The question. Who runs it, who holds the keys, who gets paged, and who can pull the plug?
The story. EU residents, working in the EU, on the region’s own hardware and software. [1] This is the pillar the sleepover was built to prove, and the one AWS deserves the most credit on.
Under pressure. “Indefinitely” on the brochure, “several hours” on the test. [1][4] And the report card goes to regulators and customers, not the public. [1]
Verdict. Holds, for one night. Ask me again after summer camp.
03 Technological
The question. Can you audit it, fork it, self-host it?
The story. You can audit what AWS’s compliance package shows you. You can’t fork it and you can’t self-host it. And the software still comes from home: the channel AWS switched off on Saturday is the one that “accepts vetted source code mirroring and software updates.” [1]
Under pressure. Switch that channel off for a quarter instead of an afternoon, and ask who writes the next patch.
Verdict. Partial. The kid has its own room. The homework still comes from home.
04 Legal
The question. Which court can compel whoever holds your data, your keys or your model?
The story. German companies under German law, led by EU citizens. [4][6] Owned, per InfoQ, by Amazon.com Inc. [5] The CLOUD Act reaches whatever a provider controls, wherever it sits. [7]
Under pressure. A US order lands on the parent, not the GmbH. No backbone is involved, so no drill can test it.
Verdict. Fail. The kid slept elsewhere. The custody papers didn’t move.
05 Financial
The question. Can you leave? On your timeline, at a survivable cost?
The story. €7.8 billion buys a serious region. [4] It doesn’t buy you a different API. The sovereign cloud speaks AWS. Leaving it means leaving AWS. Same services, same lock-in, new postcode.
Under pressure. Your regulator asks for evidence of independence. AWS says that evidence goes to regulators and customers. [1] So the proof of independence is a customer benefit. You see the report card after you enroll.
Verdict. Breaks, unless you priced the exit before the move. It’s still on the family plan.
A clean pass on concrete, an honest hold on operations, and a fail where the parents live. That’s a better report card than most I’ve graded this year. It’s still not a sovereignty certificate. Sovereignty is not binary. It’s control with an acceptable risk sidecar.
The executive TCO
Three line items, none of which show up on the invoice:
- The report card. If the drill results only go to customers and regulators, your due diligence starts after the contract. Ask for the October 24 report in the RFP, not the onboarding deck.
- The custody papers. The CLOUD Act exposure didn’t move on Saturday. Somebody has to own it. Name it, price it, and write it into the risk register.
- The family plan. Moving from a standard AWS region to the sovereign one is a migration. Moving off AWS is a second one. Put a number on it while you still have a renewal date.
Same baseline-and-burst strategy as always. The sovereign region can be a perfectly good edge. Your keys, your identity, your audit logs, and the model you can’t afford to lose belong somewhere no parent company can be served for them.
Hybrid is fine. Mislabeling isn’t. Own the crown jewels. Rent the edges.
What to do Monday
- Ask your AWS account team for the October 24 report card. AWS says customers get an update. Get it in writing and put it in the file.
- Ask what was measured: which services ran, which degraded, for how long, and what broke when the kid came home.
- Ask the question nobody has answered in public: how many weeks can the region run with the update channel switched off?
- Hold your encryption keys outside the provider’s reach, so a letter to the parents gets ciphertext.
- Run the 72-hour “prohibited, not down” drill on your own estate. Not the cable. The letter.
- Then ask your vendor one question: “If a US court orders Amazon.com Inc. to produce data held by your German subsidiary, what happens in the first 72 hours?” Then ask who answers that email.
So when does it move out?
Three weeks, three family-court rulings.
Microsoft gave Europe visitation rights and kept custody. [11] Washington ran a paternity test on a Chinese model and ruled the parents matter more than the address. [10] This week Amazon showed its European kid can sleep over at a friend’s house.
Credit to AWS. It is the best evidence any hyperscaler has offered that the lights stay on without the mothership. But sovereignty was never about the lights. It was about who can tell you to turn them off.
If your sovereign cloud can survive a night away from its parent’s network but not a letter from its parent’s lawyers, it hasn’t moved out. It’s a kid with a curfew.
Amit
Amit Eyal Govrin is lead analyst for sovereign AI at theCUBE Research and CEO of Agentcy Labs, which designs and builds sovereign AI platforms for enterprises and governments. His research for theCUBE Research is conducted under theCUBE Research’s editorial standards and is not sponsored or directed by Agentcy Labs. Agentcy Labs may hold commercial relationships with vendors covered in this research.
References
[1] Stéphane Israël, AWS Security Blog, “AWS European Sovereign Cloud: Demonstrating an independent operation,” Sep 28, 2026. Link
[2] Steef-Jan Wiggers, InfoQ, “AWS Will Run Its European Sovereign Cloud Without the Global Backbone for Several Hours,” Oct 18, 2026. Link
[3] NeoTeo, “AWS’s European sovereign cloud test: plan and reported status,” Oct 26, 2026. Link
[4] Amazon, “AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe,” press release, Jan 15, 2026. Link
[5] Steef-Jan Wiggers, InfoQ, AWS European Sovereign Cloud general availability coverage, Jan 22, 2026. Link
[6] AWS European Sovereign Cloud, “Frequently Asked Questions.” Link
[7] 18 U.S.C. § 2713, “Required preservation and disclosure of communications and records” (CLOUD Act, Pub. L. 115-141, 2018), Cornell Legal Information Institute. Link
[8] Amazon Web Services China, “About Amazon Web Services China.” Link
[9] Vergabeblog, “BSI veröffentlicht C3A: Neuer Maßstab für digitale Souveränität in der Cloud-Beschaffung,” Apr 30, 2026. Link
[10] Amit Eyal Govrin, “Washington Just Banned an AI Model for Having the Wrong Parents,” Sovereign AI, theCUBE Research, October 2026. [link to last week’s edition]
[11] Amit Eyal Govrin, “Europe Got Visitation Rights. Microsoft Kept Custody.,” Sovereign AI, theCUBE Research, October 2026. [link to the Microsoft edition]
[12] U.S. Department of Homeland Security, “Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements,” 91 FR 66346, published Oct 20, 2026. [same link as last week’s reference 3]
[13] AWS Security Blog, index page, checked Oct 27, 2026. Link
[14] About Amazon Europe, AWS news page, checked Oct 27, 2026. Link
