SAP to run a sovereign cloud for the Dutch Ministry of Defense from 2028

The Dutch armed forces are handing maintenance, updates and key aspects of operations to one commercial vendor. SAP has not said what the deal is worth. The ministry's most sensitive workloads stay in separate environments.

What the Dutch signed

The agreement covers development and management of a sovereign cloud environment in the Netherlands.

The environment sits inside a wider multicloud strategy. That strategy mixes sovereign cloud, private cloud and separate environments for highly classified information. Spreading workloads across providers aims to cut dependence on any single technology or supplier. The aim is also to keep critical services running through disruptions, cyberattacks included. Thomas Saueressig, SAP's chief customer officer and an executive board member, said the ministry wants modern technology. He said it also wants to keep control over the security and sovereignty of its critical systems.

Why sovereignty is being bought, not declared

Bart Van der Biest is managing director of SAP Benelux. He framed the contract in operational terms. With a sovereign cloud, he said, the question is not just where data sits. It is who has access to systems and who runs cloud operations. Those decisions must stay with the ministry, he argued, however technology or geopolitics change.

Brussels is writing the same idea into procurement rules. The European Tech Sovereignty Package came out in June 2026. It includes the Cloud and AI Development Act. That bill would introduce four levels of sovereignty assurance for public buyers, according to a report from NEC's IISE unit. France already limits sensitive state data to clouds certified under ANSSI's SecNumCloud scheme. Germany's BSI published its C3A criteria on 27 April 2026. The criteria assess legal jurisdiction, operations, supply chain and emergency disconnection.

The same week, the same pitch

The Dutch contract landed in a week of parallel announcements. Schools in six German states can now use IONOS-hosted file storage and collaboration tools. Gov Digital awarded the hosting contract.

The platform is available in Berlin, Bremen, Hamburg, Hesse, North Rhine-Westphalia and Rhineland-Palatinate. It runs only in IONOS data centers in Germany. IONOS already supplies software to France's Ministry of Education. That ministry provides it to 500,000 users and plans to extend it to 1.2 million employees. Achim Weiß is IONOS chief executive. He said the cloud solution was developed in Germany. He said it stands for security, reliability and digital sovereignty.

On 3 November, Bull and Schwarz Digits signed a memorandum of understanding. They plan to build what they called an independent European AI and cloud infrastructure ecosystem. The plan puts the BullSequana AI platform on the STACKIT Marketplace. It also covers co-designed servers built to Open Compute Project standards. Financial terms were not disclosed. The announcement carried no launch dates.

The counterargument: a local vendor is still a lock

Not everyone treats a European supplier as the answer. A British invoice does not guarantee resilience, THINK Digital Partners argued on 3 November. A domestic supplier can still lock customers in. It can raise prices once they cannot leave.

The code underneath is a harder problem. Two critical flaws in PHP on 21 October pulled government services offline across Europe. One was the Netherlands' DigiD login.

PHP is estimated to underpin 70 percent of websites. The PHP Foundation's executive director said the project has one full-time employee. Open source carries the same single-vendor risk at the protocol layer. The European Commission rolled Matrix out to staff laptops between July and September 2026. The Schengen Cloud Alliance, including OVHcloud, hosted it. Element underwrites most of the Matrix Foundation's operations. Chief executive Matthew Hodgson wants governments that depend on the protocol to pay into it.

What happens next

SAP says the agreement could serve as a basis for other eligible Dutch government entities. Those entities would need comparable security and sovereignty requirements. Whether the four assurance levels in the CADA proposal survive negotiation will decide how many of those follow.