Whose Supply Chain Is It Anyway? | Europe Built a Ruler for Sovereignty — and Nobody Scored Full Marks

The data didn't leak from the sovereign cloud. It leaked from a vendor. That single fact organises everything else in this episode: a patent sale to Texas, a wobbly week in Neckarsulm, a new European scoring system nobody has topped, and a €30 billion tender that turns "buy compute" into "apply by November." Two hosts, two readings, and a conclusion that is uncomfortable for both of them.

In this episode:

• 00:00–03:19: Cold Open & A File at a Vendor. Sarah corrects Markus's prep notes before the jingle even plays — UpCloud is Finnish, not Swedish, and she read forty sources while he made coffee. Then the story: early July, Lidl informs online shop customers in Germany, Belgium and the Netherlands about an incident at an external IT service provider. Names, phone numbers, email addresses, dates of birth, customer numbers. No passwords, no payment data, no delivery addresses. The shop itself wasn't breached. Why this is a sovereignty story: Lidl belongs to the Schwarz Group, which runs Schwarz Digits, which runs STACKIT — Germany's loudest sovereign cloud. And the data walked out through the supply chain, not through the cloud. Whether that vendor is itself part of the group is speculation from comment sections; the hosts flag it as an open question and leave it open. This is a podcast, not an indictment.
• 03:19–05:49: The Deal. 16 July: CrowdStrike signs a binding agreement for the intellectual property of XM Cyber — more than 45 patents plus source code. Schwarz had acquired the company in 2021 for roughly 700 million dollars as the security brain of its sovereign cloud. Now the brain is sold, but the structure is unusual: customers and revenue stay with Schwarz, only the technology goes to Texas. In return, CrowdStrike's Falcon platform moves onto STACKIT, with telemetry processed in Europe. Zscaler makes the same move. Sarah signs the deal as a CFO — security products are brutally expensive, the market leader does it better, the racks get filled. Markus asks the other question, and cites the sharpest German critique: a sovereign solution that depends on a US vendor isn't one. Where they land: Schwarz didn't fail at sovereignty, Schwarz redefined it. From "we build everything" to "we own the ground it runs on." The landlord model.
• 05:49–07:53: One Wobbly Week. A deliberate attempt at fairness rather than a pile-on. In the same stretch of days: the data incident, a disruption at the STACKIT cloud, and the departure of co-CEO Rolf Schumann after seven years, leaving Christian Müller in sole charge — all around the opening of the new campus. Underneath the headlines, the quieter and more serious problem reported by the trade press: moving Lidl's own merchandise management into STACKIT is taking longer than planned, and customers are still waiting for SAP migration. Sarah's three levels: location works, operations are unproven, value creation was deliberately given up. Which is why "sovereignty fake" is the wrong accusation — and why the household version lands better. The basement is built and they own it. The furniture is rented. Their own belongings are still in the old apartment.
• 07:53–10:52: Europe Builds a Ruler. Until this year, "sovereign" was a marketing word anyone could print on a slide. The Commission's Cloud Sovereignty Framework scores eight objectives — strategic control, legal control, security, supply chain — and weights supply chain heaviest at twenty percent. The scale is SEAL, Sovereignty Effectiveness Assurance Level, 0 to 4, where 4 demands a full European supply chain from chips to software. In April it was used for real money: contracts for the EU institutions themselves, up to 180 million euros over six years, deliberately awarded to four providers so no single dependency emerges. Post Telecom with OVHcloud and Clever Cloud: SEAL-3. STACKIT: SEAL-3. Scaleway: SEAL-3. Proximus with S3NS, Clarence and Mistral: SEAL-2 — because the underlying stack is built on a US hyperscaler's technology, even though EU companies own and operate it. Owning the company is necessary; it is not sufficient. On this ruler Schwarz looks good, which retires the word "fake" and replaces it with a harder question: how do you hold SEAL-3 while inviting Falcon and Google services onto the platform? And the loose thread for later: nobody reached SEAL-4.
• 10:52–14:30: The Omnibus — Right Answer, Wrong Question. State of play on both buses. The AI omnibus is done: Regulation (EU) 2026/1744, in force since 27 July, five days before the original deadline. The trade inside it — industry got time, with high-risk obligations moved to December 2027 and August 2028, while civil society got new prohibitions on nudifier applications and child abuse material from December 2026. Transparency was left untouched: Article 50 has applied since 2 August, which is why this show discloses its synthetic host in every episode. The data omnibus is still in the shop, and two of its proposals read as if written for the Lidl incident: breach notification in 96 hours instead of 72, and a Single Entry Point replacing parallel filings under GDPR, NIS2 and DORA. Both make reporting cheaper. Neither makes the incident less likely. And the counter-example: Article 88b, the one measure that helped users rather than companies, was struck in a Council compromise published by noyb in June — then the vote was postponed, leaving the Council position to the Irish presidency. Parked, not dead. Plus the detail worth savouring: in the Commission's own draft, media service providers were exempt from honouring the very signals users would set.
• 14:30–19:17: The Billionaire Test. Markus's thought experiment: a European billionaire, patriotic about it, with a mountain of clean data, who wants to train a serious model here. Can he? Route one is the science route — JUPITER in Jülich, Alice Recoque in France, nineteen AI Factories and thirteen antennas, accessible through EuroHPC calls. Remarkably open, and a gift for a startup, but it means an allocation, not a building. Route two is commercial: OVHcloud is the only European provider listed as a Challenger in Gartner's July ranking for cloud AI infrastructure, with Scaleway and UpCloud serving fine-tuning and mid-sized runs. But nobody hands you tens of thousands of accelerators on one network on a credit card. Which leaves route three, and it isn't a purchase — it's an application. On 30 July, EuroHPC opened the tender for AI Gigafactories: up to seven facilities in at least seven member states, ten billion euros of public money as anchor demand, more than twenty billion expected privately. Deadline 12 November 2026, selection early 2027, operations within eighteen months. An informal call for interest already produced 77 proposals from 16 member states across 60 sites. What the money buys beyond GPU racks: local packaging, server assembly, an on-shore chip design ecosystem — the only route on the map that attacks the SEAL-4 gap instead of sailing around it. What it costs: purity. You wanted to be a sovereign patriot; you end up a public-private partnership, with tax money in the foundation. And the loose thread resolves: nobody reached SEAL-4 because every route runs on the same accelerators, designed in California and fabricated in Taiwan. Sovereignty ends where physics begins.
• 19:17–22:25: The Verdict. The honest scorecard, and deliberately from the buyer's side rather than the vendor's. Politically it worked: Europe turned a buzzword into a procurement criterion, and for a purchasing company that means real money saved on due diligence — the score does the work. Demand is real, with analysts expecting European sovereign cloud infrastructure to grow more than eighty percent this year and nearly double again next. But note the driver: not price, not features. The CLOUD Act, geopolitics, and America becoming legally unpredictable. Companies aren't buying a better product, they're buying insurance. Economically it's half a success. For standard workloads — virtual machines, storage, Kubernetes, databases — European providers deliver, often cheaper. Perhaps seventy percent of a mid-sized company's estate could move today without heroics. The other thirty is where it hurts: ERP, AI services, the hard cases. Plus the software layer, where sovereign infrastructure running American software moves the jurisdiction risk up rather than removing it, and the certification patchwork that makes cross-border operators pay compliance more than once. What a rational company therefore does: tier it. Sensitive and regulated workloads go sovereign; everything else stays put. Sovereignty in 2026 is an insurance premium, not a savings plan. Two things would change that — SAP-class workloads running properly on European platforms, and gigafactories delivering training you don't have to shop for in California.
• 22:25–24:08: Let's Land This. One closing thought each. Sarah: this year sovereignty stopped being a vibe and became a score, and marketing can survive an argument but not a number. Markus: the strangest fact in the whole story is that Europe's biggest single bet on digital independence — the eleven-billion-euro data center, the two-billion-euro digital division, the SEAL-3 badge — is financed by a discount supermarket. Not a tech giant, not the state, not the stock market. Which is the strength: patient family money, no quarterly earnings call, no activist investor demanding the data centers be sold. And the weakness: a private partnership company owes the public no accounts, and on that infrastructure now run government platforms and, since April, the institutions of the European Union. The question is left open on purpose — a problem to fix, or simply Europe's way of doing it? Ordoliberalism with a loyalty card.
• 24:08–28:12: Outro Song. "Sarah's Tech (Europe On The Wire)" — like the host, mainly synthetic: the track was produced primarily with AI.

Key Takeaways:

• Location Is the Easiest Question and the Least Informative: The Lidl data left through a vendor, not through the cloud. Where the servers stand was never the risk; who else touches the file is. Sovereignty is a supply chain question.
• Owning the Company Is Necessary, Not Sufficient: A European provider with European staff and European data centers still caps at SEAL-2 if the stack underneath belongs to a US hyperscaler. The technology itself has to be free of critical dependencies — which is precisely what the CrowdStrike deal trades away.
• Nobody Reached SEAL-4: Not one of the four winners has a full European supply chain from chip to software. Every route to training a model in Europe — public supercomputers, commercial clouds, future gigafactories — runs on the same imported accelerators.
• The Omnibus Lowers the Cost of Compliance, Not of Dependency: 96 hours instead of 72, one reporting portal instead of four. Both make an incident cheaper to report. Neither makes it less likely, and neither touches who your vendors are.
• To Train at Scale in Europe, You Apply — You Don't Buy: The AI Gigafactories tender closes 12 November 2026 with operations roughly eighteen months after selection. Until then, capacity means renting from OVHcloud, Scaleway or comparable providers, with limited sovereignty either way.
• For the Buyer, Sovereignty Is an Insurance Premium: Fewer features, equal or higher price, plus migration cost. Which is why the rational corporate answer is tiering, not switching — and why demand is driven by legal risk rather than by product quality.
• Europe's Biggest Sovereignty Bet Is Retail-Financed: Patient capital with no quarterly pressure, and no obligation to explain itself to the public whose administrations now run on it. Both halves of that sentence matter.

Sources & Further Reading

The Digital Omnibus, both halves

• European Commission — Digital Omnibus Regulation proposal: the original text and the Commission's own reasoning.
• Bird & Bird — Introduction to the European Commission's Digital Omnibus Package: the clearest structural overview of what the package actually contains.
• White & Case — EU agrees Digital Omnibus deal to simplify AI rules: the trilogue outcome behind Regulation (EU) 2026/1744.
• Gleiss Lutz — the AI Act simplification proposal: the deadline shifts, article by article.
• Usercentrics — what the AI Act deal means for transparency and consent infrastructure: useful on why Article 50 survived untouched while high-risk obligations moved.
• EDRi — The Digital Omnibus is going on summer break. Your rights are not.: the civil society reading of the postponement, including Article 88b.
• LYDnews — Digital Omnibus: Streit um Cookie-Einwilligung: the state of the fight over consent signals.
• Bitkom — Stellungnahme Digital Omnibus (GDPR): the industry position, worth reading alongside the critics rather than instead of them.

Sovereignty, measured

• European Commission, 17 April 2026 — Commission advances cloud sovereignty through strategic procurement: the Cloud Sovereignty Framework, the eight objectives and the SEAL levels, including what SEAL-4 actually requires.
• European Commission, 17 April 2026 — the €180 million award for sovereign cloud services: the four winning consortia and their assurance levels.
• EuroHPC Joint Undertaking, 30 July 2026 — launch of the AI Gigafactories call: scope, budget and the co-investment model behind the €30 billion figure.
• EuroHPC Joint Undertaking — call for tenders: selection of AI Gigafactory consortia: the tender itself, including the 12 November deadline and the selection criteria.
• OVHcloud, July 2026 — Gartner Magic Quadrant for Cloud AI Infrastructure: the ranking in which OVHcloud appears as the only European Challenger.

Schwarz Digits, XM Cyber and the wobbly week

• CrowdStrike, 16 July 2026 — CrowdStrike and Schwarz Digits expand strategic partnership: the binding agreement for the XM Cyber intellectual property, in the companies' own framing.
• Lebensmittel Zeitung — "Dämpfer für Digits": the STACKIT disruption, the data incident and Rolf Schumann's departure, reported together.
• Borns IT- und Windows-Blog, 21 July 2026 — "Verraten und verkauft?": the sharpest German critique, and the source of the "oxymoron" argument.
• heise online — "Kundendaten bei Dienstleister abgeflossen: Datenschutzvorfall beim Lidl-Shop": the incident at the external IT service provider and the data fields affected.

Related episodes: Episode 13, A Ritual Without a Religion — how Europe almost killed the cookie banner, and why Article 88b matters here too. Plus Three Lost Platforms — why Europe keeps winning the device and losing the layer, and The Imaginary ETF — where European tech is actually owned.

Disclosure: Sarah Vailby is a synthetic host. Her voice is AI-generated and disclosed in every episode, in line with the AI Act's transparency obligations. Markus works in the web hosting industry. This show uses no tracking pixels.

Feedback: If you buy cloud services for a company: has a sovereignty score ever changed a purchasing decision you made — or is it a box that gets ticked after the vendor was already chosen? And what's still stuck on a hyperscaler because there's no European equivalent? Be specific; we're more interested in your migration list than in your position. Send your view — anonymously if you prefer — to feedback@experten-system.de. The best responses make it into a future episode.