A Gartner VP analyst told a room full of enterprise buyers that sovereign cloud can't exist outside America or China. He's wrong — and it's useful to understand why he said it.

An American analyst, employed by an American firm, whose largest clients are American cloud providers, stood on stage in Sydney this week and told a room of non-American enterprise buyers that independence from American technology is impossible. Douglas Toombs, a VP analyst at Gartner, declared that sovereign cloud can only exist if you're Chinese or American — because only those two countries manufacture the entire technology stack. Everyone else, he said, is stuck.^[1]

It's the kind of claim that deserves to be examined not just for what it says, but for what it does. A VP analyst at the most influential technology advisory firm in the world just told enterprise decision-makers that infrastructure independence is a fantasy. That's not a neutral observation. It's a market signal. And the first question you should ask of any market signal is: who benefits?

The Narrow Truth and the Wide Lie

Toombs isn't fabricating from thin air. The narrow claim — that no country outside the US and China manufactures every component in the cloud stack, from silicon to hypervisor — is factually correct. He's also right that on-premises appliances like AWS Outposts, Azure Local, and Oracle's Dedicated Cloud Regions phone home to their parent companies. If your threat model includes extraterritorial legal compulsion under the US CLOUD Act or FISA Section 702, then a "sovereign" label on an American-owned product doesn't resolve your exposure.

But this is where the argument stops being honest and starts being useful to Gartner's clients — the vendor kind, not the buyer kind.

Toombs is conflating two completely different things: hardware supply chain sovereignty and operational data sovereignty. Almost nobody pursuing sovereign cloud is trying to fabricate their own CPUs. They're trying to ensure that their data, at rest and in transit, isn't subject to foreign jurisdiction compulsion, and that their operational continuity doesn't depend on a vendor's geopolitical alignment. Those are achievable goals. They're being achieved right now, today, by organisations running open-source software on commodity hardware.

The European Capability Nobody Mentioned

Toombs dismissed European sovereignty efforts by referencing failed French projects — Andromeda, Numergy, Gaia-X — and said they produced "nice white papers." This is the kind of line that gets a laugh at a conference and goes unchallenged because nobody in the room has an incentive to challenge it.

But the dismissal is lazy, and it ignores the actual state of European technology capability.

Start with the most important fact in the global semiconductor industry: ASML, headquartered in Veldhoven, Netherlands, is the sole manufacturer of extreme ultraviolet lithography machines on Earth. Every advanced chip fab in the world — TSMC, Samsung, Intel — depends on Dutch equipment to produce leading-edge silicon.^[2] That's not a European dependency on foreign technology. That's a dependency every other nation has on Europe. It's an extraordinary piece of leverage that Brussels has barely begun to use strategically, though the export controls on China suggest they're waking up.

On the design side, SiPearl is building Rhea, an ARM-based high-performance processor for the European Processor Initiative, targeting exascale computing.^[3] NXP and STMicroelectronics are major ARM licensees with deep engineering teams across the continent. And RISC-V — an open instruction set architecture with no single foreign licensor — is under active development at the Barcelona Supercomputing Centre and across multiple EU-funded initiatives.^[4]

The fabrication gap is real but narrowing. You don't need 2nm for server workloads. Reliable 5nm and 7nm processes cover the vast majority of cloud and inference use cases. GlobalFoundries has a fab in Dresden. TSMC is building in Dresden. The EU Chips Act committed €43 billion to semiconductor capacity.^[5]

The stack exists. What's been lacking is the political will to treat cloud as strategic infrastructure — the way the EU treats aerospace (Airbus), satellite navigation (Galileo), or defence procurement. That's a policy choice, not a physics constraint. Toombs is treating a political failure as a technical impossibility, which is a very convenient confusion if your job is advising people to buy from the incumbents.

The Repatriation Economics Are Already Proven

Even if you set aside sovereignty entirely, the pure financial case for owning your own infrastructure is getting harder to argue against — and it gets stronger the larger the organisation.

37Signals documented their cloud exit publicly. David Heinemeier Hansson initially estimated savings of $7 million over five years after leaving AWS; a year into the transition, actual savings were running at $2 million per year, putting the revised five-year figure closer to $10 million — for a company with around 80 employees running relatively straightforward web applications.^[6]

But 37Signals is the small example. Dropbox is the large one. When Dropbox migrated the majority of its data from AWS to custom infrastructure in colocation facilities between 2015 and 2017, it saved $74.6 million in operating expenses over two years — a figure the company disclosed in its S-1 filing ahead of IPO. That $74.6 million represented 15 percent of the $500 million Dropbox planned to raise in its public offering.^[8] GEICO tells a similar story at even greater scale: by 2021, the insurer was spending over $300 million annually on cloud providers and began repatriating workloads after concluding the costs were unsustainable.^[9]

These aren't outliers. Andreessen Horowitz analysed cloud spend across 50 of the top public software companies and estimated that the decision to run on public cloud rather than owned infrastructure was destroying approximately $100 billion in market capitalisation across those companies alone, through margin compression that repatriation could recover.^[10] A hundred billion dollars. Not a rounding error. Not a niche concern. A structural wealth transfer from the companies that build software to the companies that rent them the machines to run it on.

The savings compound with scale. Predictable workloads — internal systems, databases, CI/CD, email, and now AI inference — don't benefit from elasticity pricing. Volume purchasing delivers better rates on hardware, power, and colocation. And staffing amortises: the operations team for 500 servers isn't ten times larger than the team for 50.

AI Makes This Inescapable

AI workloads change the calculus entirely. As of mid-2026, on-demand H100 GPU pricing on the hyperscalers runs from roughly $3.90 per hour on AWS (after a 44% price cut in June 2025) to $6.98–$12.29 per hour on Azure, depending on configuration.^[11] A team running a four-GPU inference endpoint at Azure's rates is spending upwards of $28 per hour — over $20,000 per month — and owns nothing at the end of it. Over a three-year hardware lifecycle, that spend would purchase and operate the equivalent owned hardware several times over, with break-even typically occurring within months, not years.^[12] And those headline rates don't include the storage costs and data egress fees that can add 20–40% to a monthly hyperscaler bill.

The economics are stark enough that even venture capital is sounding the alarm. Andreessen Horowitz's "Trillion Dollar Paradox" analysis found that cloud infrastructure costs are compressing margins so severely across the top 50 public software companies that repatriation could recover roughly $100 billion in market capitalisation — and that was before the current wave of AI inference spending.^[10]

But cost is only half the story. When you're running retrieval-augmented generation over proprietary data, every byte that leaves your network is a liability — regulatory, competitive, and operational. A model running on your metal, querying your corpus, with no external API calls, is not just cheaper. It's the only architecture that offers genuine data control. No cloud provider terms of service to parse for training-data clauses. No third-party subprocessor chain to audit. No CLOUD Act exposure. Just your data, on your hardware, under your jurisdiction.

Follow the Incentive

Gartner's revenue comes from two streams: vendors pay to appear in Magic Quadrants; enterprises pay for advisory that helps them choose between those vendors. If the answer to "which cloud should I use?" becomes "your own," both streams dry up. The same incentive runs through the consultancy ecosystem — Accenture, Deloitte, Capgemini — all of which have built enormous practices around one repeatable playbook: migrate to a hyperscaler, Terraform everything, bolt a React frontend onto managed services, bill monthly. Gartner provides the market map, the consultancy executes the migration, the cloud provider collects the rent. Everyone in the loop gets paid except the customer, who gets locked in.

Toombs cited the BCG Rule of Three and Four — a 1976 framework asserting that stable markets consolidate around three major competitors — as evidence that the cloud market has permanently settled around AWS, Google, and Microsoft.^[7] This is a consulting framework about consumer market dynamics being applied as if it's a natural law. Markets consolidate around three players until they don't. Ask IBM mainframes. Ask Sun Microsystems. Ask Nokia. And when Gartner tells every enterprise CTO that the only safe choice is one of the big three, it's actively producing the consolidation it claims to merely observe.

But the strongest evidence that this framing is crumbling didn't come from outside the conference. It came from the next talk on the same stage.

The Gartner Contradiction: Two Analysts, One Conference, Zero Coherence

Adrian Wong, a Gartner Director Analyst speaking at the same Sydney conference, warned that European organisations are worried US cloud providers might leave the continent. He said not having a cloud exit strategy is one of the top ten mistakes organisations make. He said customers are "very much locked in," especially when using cloud-native or platform-as-a-service offerings. He warned that exiting takes at least two years of significant planning and investment. And he noted that exit plans are "largely swept under the rug."

Now hold Toombs' position and Wong's position side by side:

These two positions cannot both be true. If Toombs is right that sovereignty is impossible and no alternatives to the big three can exist, then Wong's exit strategy advice is meaningless — there's nowhere to exit to. If Wong is right that exit risk is real and organisations need a plan, then Toombs is wrong — because the plan has to involve non-hyperscaler infrastructure that actually works.

What they can both do is generate billable advisory engagements. Toombs fills the room with fear about sovereignty being unachievable. Wong fills the room with fear about lock-in and geopolitical risk. The enterprise buyer leaves the conference terrified in two incompatible directions and books a Gartner engagement to "navigate the complexity." The contradiction isn't a bug in the analysis — it's the product. Anxiety with no resolution is the ideal state for a firm that sells resolution by the hour.

What Sovereignty Actually Looks Like

Real sovereignty isn't about fabricating every chip in your stack. It's about architectural decisions that keep your options open and your data under your control.

The strongest version of Toombs' argument — the one he gestured at but didn't fully develop — is the legal one. The US CLOUD Act compels American-incorporated companies to produce data held anywhere in the world when served with a valid US warrant. FISA Section 702 permits warrantless surveillance of non-US persons' data held by US providers. These aren't theoretical risks; they're the law. And they apply regardless of where the data centre sits, because jurisdiction follows the company, not the server.

But here's what that argument actually proves: the threat is the US-incorporated entity in the chain, not the hardware. Remove the American company from the stack and the legal exposure disappears. An organisation running PostgreSQL on Linux, deployed as a single binary written in Go, hosted on European-owned hardware in a European colocation facility, with no management plane phoning home to Redmond or Seattle — that organisation has no US-incorporated entity in its infrastructure chain. The CLOUD Act has nothing to attach to. FISA 702 has no provider to compel. The sovereignty is real, it's operational, and it doesn't require fabricating a single chip.

This is already happening, and it's accelerating. OVHcloud and Hetzner host regulated European workloads on infrastructure they own and operate — Hetzner was the first provider to bring ARM-based cloud servers to Europe in 2023, running Ampere Altra processors, and is qualifying next-generation AmpereOne chips for 2026 deployment.^[13] Scaleway, one of the largest European cloud providers, now offers AmpereOne-powered instances across data centres in France and the Netherlands, optimised for both general cloud workloads and AI inference — all on European-owned infrastructure with no American management plane in the chain.^[14] In Sweden, Glesys is deploying AmpereOne-based infrastructure across the Nordics. These aren't aspirational projects. They're production services running regulated workloads for healthcare, financial services, and public sector customers who can't afford jurisdictional ambiguity.

The concrete pattern is boring in the best sense: PostgreSQL instead of Aurora. Linux and KVM instead of proprietary hypervisors. Single-binary deployments instead of twelve managed services stitched together with YAML. SQLite for workloads that don't need a network round-trip. Perpetual licensing models where you own your running instance regardless of whether you renew. Infrastructure that doesn't phone home. No vendor in the chain who answers to a foreign government's subpoena.

The real barrier has never been technical capability. It's been institutional confidence — a generation of CTOs told that self-hosting was legacy thinking, that they'd never hire the talent, that cloud was the only way to be "modern." 37Signals, Dropbox, and GEICO broke that spell by publishing the numbers. The larger the organisation, the more those numbers tilt in favour of ownership.

Remember who was in that room in Sydney. Enterprise buyers — the people Gartner claims to serve. And remember what they were told: that the infrastructure they need can only come from the country whose laws they're trying to escape. That's not analysis. That's a protection racket dressed in a lanyard. The technical capability exists. The economics are proven. The European providers are already running. The only thing standing between an organisation and genuine infrastructure independence is the confidence to ignore the people who profit from telling them it's impossible.