Episode 14: Whose Supply Chain Is It Anyway? | Europe Built a Ruler for Sovereignty — and Nobody Scored Full Marks The data didn't leak from the sovereign cloud. It leaked from a vendor. That single fact organises everything else in this episode: a patent sale to Texas, a wobbly week in Neckarsulm, a new European scoring system nobody has topped, and a €30 billion tender that turns "buy compute" into "apply by November." Two hosts, two readings, and a conclusion that is uncomfortable for both of them. In this episode: 00:00–03:19: Cold Open & A File at a Vendor. Sarah corrects Markus's prep notes before the jingle even plays — UpCloud is Finnish, not Swedish, and she read forty sources while he made coffee. Then the story: early July, Lidl informs online shop customers in Germany, Belgium and the Netherlands about an incident at an external IT service provider. Names, phone numbers, email addresses, dates of birth, customer numbers. No passwords, no payment data, no delivery addresses. The shop itself wasn't breached. Why this is a sovereignty story: Lidl belongs to the Schwarz Group, which runs Schwarz Digits, which runs STACKIT — Germany's loudest sovereign cloud. And the data walked out through the supply chain, not through the cloud. Whether that vendor is itself part of the group is speculation from comment sections; the hosts flag it as an open question and leave it open. This is a podcast, not an indictment. 03:19–05:49: The Deal. 16 July: CrowdStrike signs a binding agreement for the intellectual property of XM Cyber — more than 45 patents plus source code. Schwarz had acquired the company in 2021 for roughly 700 million dollars as the security brain of its sovereign cloud. Now the brain is sold, but the structure is unusual: customers and revenue stay with Schwarz, only the technology goes to Texas. In return, CrowdStrike's Falcon platform moves onto STACKIT, with telemetry processed in Europe. Zscaler makes the same move. Sarah signs the deal as a CFO — security products are brutally expensive, the market leader does it better, the racks get filled. Markus asks the other question, and cites the sharpest German critique: a sovereign solution that depends on a US vendor isn't one. Where they land: Schwarz didn't fail at sovereignty, Schwarz redefined it. From "we build everything" to "we own the ground it runs on." The landlord model. 05:49–07:53: One Wobbly Week. A deliberate attempt at fairness rather than a pile-on. In the same stretch of days: the data incident, a disruption at the STACKIT cloud, and the departure of co-CEO Rolf Schumann after seven years, leaving Christian Müller in sole charge — all around the opening of the new campus. Underneath the headlines, the quieter and more serious problem reported by the trade press: moving Lidl's own merchandise management into STACKIT is taking longer than planned, and customers are still waiting for SAP migration. Sarah's three levels: location works, operations are unproven, value creation was deliberately given up. Which is why "sovereignty fake" is the wrong accusation — and why the household version lands better. The basement is built and they own it. The furniture is rented. Their own belongings are still in the old apartment. 07:53–10:52: Europe Builds a Ruler. Until this year, "sovereign" was a marketing word anyone could print on a slide. The Commission's Cloud Sovereignty Framework scores eight objectives — strategic control, legal control, security, supply chain — and weights supply chain heaviest at twenty percent. The scale is SEAL, Sovereignty Effectiveness Assurance Level, 0 to 4, where 4 demands a full European supply chain from chips to software. In April it was used for real money: contracts for the EU institutions themselves, up to 180 million euros over six years, deliberately awarded to four providers so no single dependency emerges. Post Telecom with OVHcloud and Clever Cloud: SEAL-3. STACKIT: SEAL-3. Scaleway: SEAL-3. Proximus with S3NS, Clarence and Mistral: SEAL-2 — because the underlying stack is built on a US hyperscaler's technology, even though EU companies own and operate it. Owning the company is necessary; it is not sufficient. On this ruler Schwarz looks good, which retires the word "fake" and replaces it with a harder question: how do you hold SEAL-3 while inviting Falcon and Google services onto the platform? And the loose thread for later: nobody reached SEAL-4. 10:52–14:30: The Omnibus — Right Answer, Wrong Question. State of play on both buses. The AI omnibus is done: Regulation (EU) 2026/1744, in force since 27 July, five days before the original deadline. The trade inside it — industry got time, with high-risk obligations moved to December 2027 and August 2028, while civil society got new prohibitions on nudifier applications and child abuse material from December 2026. Transparency was left untouched: Article 50 has applied since 2 August, which is why this show discloses its synthetic host in every episode. The data omnibus is still in the shop, and two of its proposals read as if written for the Lidl incident: breach notification in 96 hours instead of 72, and a Single Entry Point replacing parallel filings under GDPR, NIS2 and DORA. Both make reporting cheaper. Neither makes the incident less likely. And the counter-example: Article 88b, the one measure that helped users rather than companies, was struck in a Council compromise published by noyb in June — then the vote was postponed, leaving the Council position to the Irish presidency. Parked, not dead. Plus the detail worth savouring: in the Commission's own draft, media service providers were exempt from honouring the very signals users would set. 14:30–19:17: The Billionaire Test. Markus's thought experiment: a European billionaire, patriotic about it, with a mountain of clean data, who wants to train a serious model here. Can he? Route one is the science route — JUPITER in Jülich, Alice Recoque in France, nineteen AI Factories and thirteen antennas, accessible through EuroHPC calls. Remarkably open, and a gift for a startup, but it means an allocation, not a building. Route two is commercial: OVHcloud is the only European provider listed as a Challenger in Gartner's July ranking for cloud AI infrastructure, with Scaleway and UpCloud serving fine-tuning and mid-sized runs. But nobody hands you tens of thousands of accelerators on one network on a credit card. Which leaves route three, and it isn't a purchase — it's an application. On 30 July, EuroHPC opened the tender for AI Gigafactories: up to seven facilities in at least seven member states, ten billion euros of public money as anchor demand, more than twenty billion expected privately. Deadline 12 November 2026, selection early 2027, operations within eighteen months. An informal call for interest already produced 77 proposals from 16 member states across 60 sites. What the money buys beyond GPU racks: local packaging, server assembly, an on-shore chip design ecosystem — the only route on the map that attacks the SEAL-4 gap instead of sailing around it. What it costs: purity. You wanted to be a sovereign patriot; you end up a public-private partnership, with tax money in the foundation. And the loose thread resolves: nobody reached SEAL-4 because every route runs on the same accelerators, designed in California and fabricated in Taiwan. Sovereignty ends where physics begins. 19:17–22:25: The Verdict. The honest scorecard, and deliberately from the buyer's side rather than the vendor's. Politically it worked: Europe turned a buzzword into a procurement criterion, and for a purchasing company that means real money saved on due diligence — the score does the work. Demand is real, with analysts expecting European sovereign cloud infrastructure to grow more than eighty percent this year and nearly double again next. But note the driver: not price, not features. The CLOUD Act, geopolitics, and America becoming legally unpredictable. Companies aren't buying a better product, they're buying insurance. Economically it's half a success. For standard workloads — virtual machines, storage, Kubernetes, databases — European providers deliver, often cheaper. Perhaps seventy percent of a mid-sized company's estate could move today without heroics. The other thirty is where it hurts: ERP, AI services, the hard cases. Plus the software layer, where sovereign infrastructure running American software moves the jurisdiction risk up rather than removing it, and the certification patchwork that makes cross-border operators pay compliance more than once. What a rational company therefore does: tier it. Sensitive and regulated workloads go sovereign; everything else stays put. Sovereignty in 2026 is an insurance premium, not a savings plan. Two things would change that — SAP-class workloads running properly on European platforms, and gigafactories delivering training you don't have to shop for in California. 22:25–24:08: Let's Land This. One closing thought each. Sarah: this year sovereignty stopped being a vibe and became a score, and marketing can survive an argument but not a number. Markus: the strangest fact in the whole story is that Europe's biggest single bet on digital independence — the eleven-billion-euro data center, the two-billion-euro digital division, the SEAL-3 badge — is financed by a discount supermarket. Not a tech giant, not the state, not the stock market. Which is the strength: patient family money, no quarterly earnings call, no activist investor demanding the data centers be sold. And the weakness: a private partnership company owes the public no accounts, and on that infrastructure now run government platforms and, since April, the institutions of the European Union. The question is left open on purpose — a problem to fix, or simply Europe's way of doing it? Ordoliberalism with a loyalty card. 24:08–28:12: Outro Song. "Sarah'
