Cloud sovereignty is no longer just a public sector checkbox. OpenNebula, an 18-year-old open-source virtualization platform, is seeing commercial enterprises add sovereignty requirements to RFPs that historically prioritized cost above all else.
"The private sector is more cost-driven, they don't consider sovereignty as a key thing," OpenNebula managing director Ignacio Llorente told The Register. "But if you go into the public sector, it is completely different. They say, 'OK, my first step, I'm going to keep only those solutions that are sovereign.'"
The gap is closing. OpenNebula reports "an exponential number of requests" from commercial organizations, though Llorente cautions the actual shift will take three to five years as multi-year hyperscaler contracts expire.
What sovereignty actually means
Definitions vary by geography and sector. In the US, sovereignty focuses on on-premises deployment and open source control. In the EU, it adds a requirement for European-developed technology. The lack of a common definition complicates procurement.
"One of the problems we have right now is that there is not a common definition for sovereignty," Llorente said. "Sovereignty is about who controls the platform, who owns the technology stack, who can make decisions about the infrastructure, and even who controls the energy."
The recent OpenNebula-OVHcloud partnership illustrates the European approach. Launched January 29, it achieves full compliance with the European Commission's Cloud Sovereignty Framework and operates within the €3 billion IPCEI-CIS semiconductor initiative. OVHcloud's 42 European datacentres provide the infrastructure foundation.
The enterprise calculation
Geopolitical uncertainty and vendor consolidation are changing enterprise risk assessments. The US CLOUD Act gives US law enforcement access to data held by US companies regardless of where it's stored. Post-Schrems II compliance requirements have made EU-US data transfers more complex. Sudden licensing changes have reminded organizations what vendor lock-in costs.
What hasn't changed: enterprises still buy on price first. Sovereign alternatives must prove operational viability at scale, not just regulatory compliance. OpenNebula's 18-year track record helps, but the platform competes against hyperscaler ecosystems offering broader services and proven performance.
The real question is whether sovereignty becomes a tie-breaker or a requirement. Based on current RFP trends, it's moving from the former to the latter, at least in regulated industries and organizations with European operations. We'll see if that holds when renewal decisions actually happen.