Bundeswehr deal with Google: How much sovereignty is Germany really giving up for the Google Cloud?

Why does the Bundeswehr use Google instead of German alternatives?

### Billions for Google instead of German companies: Why the Bundeswehr is relying on US technology ### Despite the espionage threat: The Bundeswehr's controversial Google pact explained ### A dangerous illusion: Is Google's Bundeswehr cloud really secure? ### Separated from the internet, but not from the USA? The dilemma of the new Bundeswehr cloud ### A 10-year technological lag: Why the Bundeswehr has little choice when it comes to the cloud ###

The German Armed Forces (Bundeswehr) have opted for a multi-billion dollar cloud project with Google – and are causing heated debate. But why? What are the pros and cons of this decision? These questions are not only troubling IT experts, but also politicians and citizens who are wondering about the state of Germany's digital independence.

At the end of May 2025, BWI, the German Armed Forces' IT service provider, signed a framework agreement with Google Cloud Public Sector Deutschland GmbH. Two physically separate "Google Distributed Cloud Air-Gapped" instances are to be deployed by the end of 2027. The technology will be installed in BWI's own data centers and will be completely isolated from the public internet and other Google systems. Frank Leidenberger, CEO of BWI, emphasizes that the "Google platform is part of our multi-cloud approach" and is intended to reduce one-sided dependencies.

At first glance, this sounds reasonable. The Bundeswehr is pursuing a "cloud-first strategy" and requires a modern, secure IT infrastructure for its complex requirements. SAP-supported logistics and future AI services are to be accelerated by this new cloud infrastructure. The SAP Business Technology Platform (BTP) requires specific system environments that are not compatible with all cloud solutions. Google can meet these technical requirements.

Suitable for:

• Europe's future: Between US dominance and sovereign innovation

But is this really digital sovereignty?

This is where things get controversial. German cloud providers like Codesphere founder Elias Schneider warn against a false sense of sovereignty. Their criticism: Even though the hardware is located in German data centers and separated from Google networks, the underlying software and technology remain in American hands.

True digital sovereignty means more than just physical control over servers. It's about the ability to make technological decisions independently and not be dependent on third-party manufacturers. If the Bundeswehr builds its critical IT infrastructure on Google's technology, it creates a long-term dependency.

The critics have some valid points. The US CLOUD Act of 2018 requires US companies to hand over data to US authorities – regardless of where the data is physically stored. The Foreign Intelligence Surveillance Act (FISA) also grants US authorities extensive access. These laws are in direct conflict with the European General Data Protection Regulation.

Are there realistic alternatives?

That's the crucial question. Germany and Europe have certainly developed cloud providers and IT companies. Companies like IONOS, Scaleway, OVHcloud, and Exoscale offer European cloud solutions. German providers like SecureCloud, luckycloud, and leitzcloud by vBoxx explicitly advertise GDPR compliance and German data sovereignty.

But can these providers meet the Bundeswehr's complex requirements? The reality is sobering. Claudia Plattner, President of the Federal Office for Information Security (BSI), admits: "US technology companies have a ten-year head start." We "have technological dependencies in many areas," and it is "unrealistic to believe we can handle everything in the short term."

The German startup ecosystem certainly demonstrates innovative strength. Codesphere, the company of Elias Schneider, who criticized the Google decision, received a €16.5 million financing round in 2024. The Karlsruhe-based company aims to compete with the major cloud providers with its platform-as-a-service solution. But even successful German startups are still a long way from being able to handle the infrastructure for the entire Bundeswehr.

What do the figures say about Germany's IT spending?

The dimensions are enormous. BWI plans to award contracts worth around €6 billion by 2029. In 2021 alone, it awarded contracts worth €1.85 billion. These sums will largely go to international, often American, tech companies.

By comparison, the Bundeswehr's entire €100 billion special fund allocates €20 billion for digitalization and communications. A significant portion of these funds will flow to Silicon Valley instead of strengthening the domestic IT industry.

German IT service providers certainly have potential, but are often limited to niche markets. German cloud providers such as SecureCloud or luckycloud primarily offer storage solutions for small and medium-sized businesses. They often lack the capacity and technical depth to meet the complex requirements of a modern armed forces.

How justified is the concern about US access?

The legal concerns are undeniable. The CLOUD Act allows US authorities to access data from US companies, even if it is stored outside the US. Section 702 of FISA allows for virtually unlimited surveillance of electronic communications outside the US.

In 2025, Microsoft publicly confirmed that it could not rule out access by US authorities. This underscores the legitimacy of concerns about data sovereignty. Even air-gapped systems are not completely secure if the underlying technology is subject to US law.

At the same time, practical realities must be considered. Google emphasizes that with the air-gapped solution, "all data remains under the complete control of the Bundeswehr." The systems are physically separated from the internet and operated exclusively by BWI personnel. Software updates are carried out via physical storage devices, not network connections.

Suitable for:

• Microsoft confirms under oath: US authorities can access European data despite EU clouds

How do other countries view the problem?

Germany isn't alone in this dilemma. Singapore also signed an agreement for Google's air-gapped solution. Many European countries are grappling with similar challenges between technological requirements and sovereignty claims.

The European GAIA-X project was originally intended to create a sovereign European cloud infrastructure. However, American corporations like Google and Microsoft are also involved here. The vision of purely European cloud sovereignty proved to be too complex and costly.

Under President Macron, France is pursuing a more active sovereignty policy, but is also focusing on partnerships with American tech companies. The balance between technological progress and political independence remains an unresolved challenge.

Suitable for:

• Defense and security risk Microsoft: Technicians from China supervised cloud of the US Department of Defense

Independent AI platforms as a strategic alternative for European companies – Image: Xpert.Digital

Ki-Gamechanger: The most flexible AI platform – tailor-made solutions that reduce costs, improve their decisions and increase efficiency

Independent AI platform: Integrates all relevant company data sources

• Fast AI integration: tailor-made AI solutions for companies in hours or days instead of months
• Flexible infrastructure: cloud-based or hosting in your own data center (Germany, Europe, free choice of location)

• Highest data security: Use in law firms is the safe evidence
• Use across a wide variety of company data sources
• Choice of your own or various AI models (DE, EU, USA, CN)

More about it here:

• Independent AI platforms vs. hyperscalers: Which solution is right for you?

What is the multi-cloud strategy really worth?

The Bundeswehr Institute of Information Technology (BWI) is promoting its multi-cloud strategy as a solution to the sovereignty problem. Instead of relying on a single provider, it intends to combine various cloud services. Google is already the second provider for the "Private Cloud of the Bundeswehr" (pCloudBw). Open-source software is also intended to contribute to "digital sovereignty."

This strategy sounds reasonable, but it has limitations. If the major cloud providers – Microsoft, Google, Amazon – are all subject to American law, then even a multi-cloud strategy won't reduce the fundamental dependency. The Bundeswehr is merely diversifying its American dependencies.

True diversification would require European or German alternatives. This is where the problem of the technological gap comes into play. German and European providers often cannot offer the same performance, scalability, and integration as the American hyperscalers.

How big is the technological gap really?

The numbers are sobering. US companies have invested hundreds of billions of dollars in cloud infrastructure over the years. Amazon Web Services generated revenues of over $90 billion in 2024. Google Cloud is growing by 35 percent annually. These investment volumes are unattainable for European providers.

The gap isn't limited to pure computing power. American cloud providers have developed comprehensive ecosystems: artificial intelligence, machine learning, data analytics, and security tools. This integration is crucial for complex applications like the Bundeswehr's IT.

German providers like Codesphere certainly demonstrate innovative strength, but are still far from the scale required for government infrastructure. The Karlsruhe-based company has over 60,000 registered users – a fraction of what the Bundeswehr needs.

What does this mean for the German IT industry?

The Google decision sends a problematic signal to the domestic IT industry. Instead of strengthening German companies and building an independent technology base, billions are flowing into Silicon Valley. These funds are missing from the development of European alternatives.

At the same time, the decision highlights the realities of the market. German IT companies must honestly ask themselves whether they can meet the technical requirements of modern armed forces. The switch to German providers must not come at the expense of the Bundeswehr's operational capability.

The German startup scene is certainly vibrant. 36 German startups are on the list of the "Top 100 Rising European Startups." Companies like 1KOMMA5°, Aily Labs, and Black Forest Labs demonstrate innovative strength in various technology areas. But the leap from successful startups to critical infrastructure providers is enormous.

What lessons can be learned?

The Bundeswehr's decision reflects a fundamental dilemma: There's a huge gap between the desire for digital sovereignty and the practical requirements of modern IT. Rhetoric alone is of no use – long-term investments in European technologies are needed.

Thorsten Thiel, an expert on digital sovereignty, warns against overly simplistic approaches to solutions. "Digital sovereignty is never absolute," he says. Complete self-sufficiency is neither realistic nor desirable. It is more important to avoid one-sided dependencies and develop alternatives.

Politicians must honestly communicate what digital sovereignty means in practice. It's not about complete independence, but rather about options for action and alternatives. This requires substantial investment in European technologies – not just warm words.

Suitable for:

• Success with SME sales alliances in EU defense logistics: sales partnerships for large-scale projects with EU high-high tech

Is the criticism of Google's decision justified?

The criticism is certainly justified. The decision in favor of Google perpetuates Germany's dependence on American technology companies. It sends the signal that German and European alternatives are not being taken seriously. This is problematic for long-term technological sovereignty.

At the same time, one must acknowledge the constraints under which the Bundeswehr operates. The armed forces cannot be equipped with outdated or inadequate IT just to send a political signal. The country's security depends on functioning technology.

With its multi-cloud strategy and air-gapped architecture, BWI has at least attempted to minimize risks. This is more than many other government agencies and companies that unthinkingly rely on American cloud services.

What needs to change for true digital sovereignty?

Real progress requires a long-term strategy on multiple levels. Europe must invest massively in its own technology development. There is currently no European equivalent to Google's billion-dollar investments. Projects like GAIA-X must be implemented promptly, rather than disappearing into endless planning loops.

Public procurement must systematically favor European providers. The Center for Digital Sovereignty (ZenDiS) is already working to support governments in their transition to open source alternatives. But these efforts have so far remained a drop in the ocean.

Germany must honestly assess its technological standing. BSI President Claudia Plattner speaks plainly: A ten-year technological gap cannot be made up in just a few years. Digital sovereignty is a marathon, not a sprint.

How do experts assess the long-term risks?

Dependence on American tech companies brings with it various risks. Political tensions can lead to sanctions and technology embargoes. The case of Microsoft, which blocked the email accounts of the chief prosecutor at the International Criminal Court, demonstrates how quickly digital dependencies can become political leverage.

Economic risks are also undeniable. American providers can raise their prices because they hold de facto monopolies. License costs in the federal government rose from €700 million to over €1.2 billion annually – with barely any growth in the user base.

Technological dependencies also create strategic vulnerabilities. When critical infrastructures are based on the technologies of a potential adversary, opportunities for attack arise. Cyberwarfare is increasingly becoming a factor in international conflicts.

Suitable for:

• Without civilian industry, no logistics in the event of a disaster and civil-military cooperation (CMC)

What is the conclusion of this complex debate?

The Bundeswehr's decision to choose Google is symptomatic of a larger problem: Germany and Europe have failed for years to build their own digital capabilities. Now they face a choice between technological backwardness and American dependence.

The criticism of Google's decision is justified, but it comes too late. If Germany had invested heavily in its own cloud technologies ten or fifteen years ago, alternatives might be available today. Instead, the digital market was left to American corporations.

Google's air-gapped solution is a compromise – neither fully sovereign nor fully dependent. It highlights the limited options Germany currently has. True digital sovereignty will only be achieved if Europe is willing to make the necessary investments and take the long road to technological catch-up.

The Bundeswehr has taken a pragmatic approach and attempted to minimize the risks. Whether this will be sufficient remains to be seen. One thing is clear: without massive investments in European technologies, dependence on Silicon Valley will continue to grow – despite all political declarations of digital sovereignty.

Hub for security and defense – Image: Xpert.digital

The hub for security and defense offers well-founded advice and current information in order to effectively support companies and organizations in strengthening their role in European security and defense policy. In close connection to the SME Connect working group, he promotes small and medium -sized companies (SMEs) in particular that want to further expand their innovative strength and competitiveness in the field of defense. As a central point of contact, the hub creates a decisive bridge between SME and European defense strategy.

Suitable for:

• The Working Group Defense of the SME Connect – Strengthening SMEs in European defense

☑️ SME support in strategy, consulting, planning and implementation

☑️ Creation or realignment of the AI ​​strategy

☑️ Pioneer Business Development

Konrad Wolfenstein

I would be happy to serve as your personal advisor.

You can contact me by filling out the contact form below or simply call me on +49 89 89 674 804 (Munich) .

I'm looking forward to our joint project.

Xpert.Digital is a hub for industry with a focus on digitalization, mechanical engineering, logistics/intralogistics and photovoltaics.

With our 360° business development solution, we support well-known companies from new business to after sales.

Market intelligence, smarketing, marketing automation, content development, PR, mail campaigns, personalized social media and lead nurturing are part of our digital tools.

You can find more at: www.xpert.digital – www.xpert.solar – www.xpert.plus