Airbus Scores Cloud Providers on Extraterritorial Law Protection

{ "title": "Airbus picks Scaleway as sovereign cloud partner, puts extraterritorial law protection on the scorecard", "body": "Airbus has selected French cloud provider Scaleway as its sovereign cloud partner after a competitive tender that included protection from non-European extraterritorial legislation as a scored criterion. The aerospace and defence group assessed providers across three dimensions: technical capabilities, operational excellence, and legal and governance safeguards. The legal and governance dimension specified European jurisdiction, data protection, and protection against non-European extraterritorial legislation. Airbus operates across 180 locations worldwide and manages a complex supply chain that spans dozens of countries, making the legal dimension of cloud procurement unusually consequential for the company. The selection process evaluated multiple providers before Scaleway emerged as the chosen partner, though neither company disclosed the full list of bidders.\n\n## The tender that changed the scorecard\n\nThe announcement is notable less for the vendor selected than for what the selection criteria reveal. Protection against non-European extraterritorial legislation is now something a major industrial buyer scores providers against, not something it raises in a policy discussion. The US CLOUD Act permits American authorities to compel US-headquartered providers to produce data held anywhere in the world, including EU facilities operated by EU subsidiaries. No amount of regional datacenter placement resolves extraterritorial law exposure while the provider remains subject to US jurisdiction. The US Foreign Intelligence Surveillance Act (FISA) adds another layer of legal exposure for European enterprises that store data with US-headquartered cloud providers, as it allows intelligence collection without individual warrants in certain circumstances. European data protection officers have increasingly flagged these statutes as material risks in data protection impact assessments, particularly for organisations handling defence-related or critical infrastructure data.\n\nTwo recent events underscore the risk. In 2025, the ICC chief prosecutor lost access to his Microsoft email after being sanctioned by executive order. In June, export controls briefly suspended access to Claude Fable 5 and Mythos 5. European practitioners have been blocked from adopting Claude models on Microsoft Foundry for the reason Airbus names. A Dutch bank declined approval for Claude models on Microsoft Foundry. An oncology IT architect required guaranteed EU-hosted inference. These incidents have circulated widely among European procurement teams, reinforcing the view that extraterritorial law exposure is not a theoretical concern but an operational one that can disrupt access to critical tools at any time. The Dutch bank's decision is particularly telling because financial institutions operate under strict regulatory oversight and cannot afford even temporary service interruptions caused by legal actions originating outside the EU.\n\nCatherine Jestin, executive vice president digital at Airbus, said: "each workload is deployed in the environment best suited to its technical, operational and regulatory requirements." Airbus frames the arrangement as complementing its existing multi-cloud approach, not as repatriation. The pattern most European enterprises evaluating sovereignty are likely to land on: a sovereign tier for jurisdictionally exposed data, hyperscaler capacity for everything else. Jestin's framing suggests that Airbus does not intend to move all workloads to Scaleway but rather to create a bifurcated architecture where sensitive data and applications sit on infrastructure that is legally insulated from non-European authorities. This hybrid model is becoming the default approach among large European organisations that cannot afford the latency or cost penalties of full repatriation but also cannot accept the legal risks of a single-provider hyperscaler strategy.\n\n## What Scaleway brings\n\nScaleway will provide infrastructure built on European technology with open technologies and interoperability with Airbus' existing systems. Scaleway is the cloud arm of French telecoms group iliad. Damien Lucas, CEO of Scaleway, said: "happy with the product but management wants EU supplier." Scaleway was selected in April as one of four providers under the European Commission's €180 million Cloud III framework for EU institutions. In July, Scaleway acquired HPC provider Qarnot, justifying that deal partly on both companies being governed by European jurisdiction. The Cloud III framework is designed to give EU bodies access to cloud services that meet strict sovereignty and security requirements, and Scaleway's inclusion signals that the provider has passed the Commission's own vetting process for legal and governance safeguards. The Qarnot acquisition added high-performance computing capabilities to Scaleway's portfolio, which could be relevant for Airbus's aerospace simulation and design workloads that require significant computational power.\n\nAirbus partnered with European model provider Mistral AI in May, pairing a European model provider with European infrastructure. Sovereignty questions increasingly arrive attached to AI workloads. Large vendors can answer the extraterritorial law objection by establishing an EU entity; small ones generally cannot. The Mistral AI partnership is significant because it creates a vertically integrated European stack for AI: European models running on European infrastructure, with no legal exposure to non-European authorities at either the application or infrastructure layer. This contrasts with the approach taken by many European enterprises that use US-headquartered AI model providers on US-headquartered cloud platforms, creating a double layer of extraterritorial law exposure. Airbus's choice to pair Mistral AI with Scaleway may serve as a template for other European organisations seeking to deploy AI workloads without ceding legal control over their data.\n\n## The commoditization argument\n\nOne commenter argued the sovereignty framing obscures a more mundane driver: cloud infrastructure is commoditizing, substrate-independence is becoming the default, and smaller providers now compete credibly on cost and support. Kubernetes, Terraform, and S3-compatible APIs have lowered switching costs enough that jurisdictional preference becomes actionable. A founder of a US-based SaaS company described losing long-term European customers to European competitors over the past year. Both readings (jurisdictional and commoditization) hold at once. The commoditization thesis suggests that even if extraterritorial law concerns were resolved tomorrow, European cloud providers would still gain market share because the technical barriers to switching have fallen dramatically. Containerisation and infrastructure-as-code mean that workloads can be moved between providers with far less re-engineering than was required five years ago. This dynamic benefits providers like Scaleway that offer standardised interfaces rather than proprietary lock-in.\n\nMarie-José P., a data compliance specialist and affiliated data protection officer, commented on LinkedIn about verifiable controls. Julien Raspopovitch, who works in legal, compliance and data privacy in healthcare, commented on LinkedIn about regulatory obligations. European hosting reduces exposure to the CLOUD Act and FISA but does not remove the obligation to run a data protection impact assessment or to verify Article 28 sub-processing clauses. These compliance professionals point out that switching to a European provider is not a silver bullet for data protection compliance. Organisations must still conduct thorough due diligence on sub-processors, ensure that data processing agreements meet GDPR standards, and maintain records of processing activities. The choice of provider changes the legal risk profile but does not eliminate the underlying compliance obligations that apply to all data controllers under EU law.\n\n## What the announcement does not describe\n\nNeither company disclosed the contract value, migration timeline, number of applications involved, or which workloads remain with existing providers. What the announcement does not describe is an exit. Migrating production ERP and manufacturing systems is a program that slips at any large manufacturer, and the announcement prices in none of that risk. Airbus runs SAP for its enterprise resource planning, and migrating an SAP environment of Airbus's scale would involve thousands of custom configurations, interfaces with suppliers and regulators, and complex data migration scripts. The absence of a timeline suggests that the migration will be phased over multiple years, with low-risk workloads moving first and core manufacturing systems remaining on existing infrastructure until the sovereign tier is proven stable and performant. The announcement also does not address how Airbus will handle data residency requirements for its non-European operations, which include manufacturing sites in the United States, China, and other jurisdictions outside the EU.\n\nThe signal for platform teams elsewhere in Europe is the tender structure rather than the outcome. When a buyer of this size publishes jurisdictional protection as a scored requirement, competing tenders tend to copy the scorecard. The phrase "foreign extraterritorial laws" is doing specific work. Procurement teams at other large European enterprises will now have a template they can point to when arguing that legal and governance criteria should be weighted equally with technical and operational criteria in cloud provider selection. The Airbus tender may accelerate a broader shift in European enterprise cloud procurement, where sovereignty moves from a nice-to-have consideration to a mandatory scored dimension alongside cost, performance, and security. This could reshape the competitive landscape for cloud providers in Europe, favouring those that can demonstrate genuine legal independence from non-European jurisdictions.\n\n## Related on Neura Market\n- Cloud Infrastructure\n- European Sovereign Cloud\n- AI Infrastructure" }