Airbus gave cloud providers a test that went beyond uptime, scale, and price. It asked who could keep sensitive industrial data under European operational and legal control. Scaleway won.
The multi-year agreement covers selected applications used in aircraft design, engineering, manufacturing, and enterprise operations. Scaleway says Airbus evaluated providers on technical capability, operational resilience, and legal safeguards, including protection from non-European extraterritorial laws. Reuters reported that the review covered more than 150 technical and legal requirements.
That last category changes the shape of a cloud purchase. Jurisdiction is no longer fine print for the lawyers to review after engineering picks a platform. For Airbus, it was part of the product specification.
Seventy applications are the first flight
The initial move is substantial without pretending the whole estate changes overnight. Reuters reported that Airbus plans to migrate about 70 critical applications by the end of 2028. The broader program could reach as many as 900 applications over five to six years. The value of the contract was not disclosed.
That sequencing makes sense for an aerospace company. A design system, manufacturing application, or defence workload is not a generic web app that can be moved on a Friday and watched over the weekend. It has dependencies, certification concerns, intellectual property, and people whose work cannot stop because the cloud strategy changed.
Airbus is also keeping a multi-cloud model. That matters. Sovereignty here does not mean putting every workload in one European basket. It means matching each workload to the environment that fits its technical, operational, and regulatory risk. Some applications may stay where they are. The sensitive group gets a different boundary.
Catherine Jestin, Airbus executive vice president for digital, described the goal as a cloud environment that keeps critical data assets "shielded from foreign extraterritorial laws." That is unusually specific language for a technology contract. It tells suppliers that the legal identity of the operator can matter as much as the location of the server.
The Mistral connection makes the timing clearer
This cloud decision follows Airbus signing a separate agreement with Mistral AI in May. Airbus said that partnership could support technical-document production, engineering simulations, on-board systems, cyber investigations, and coding tools for military work. Those are useful applications, but they also touch the exact data a strategic manufacturer cannot afford to treat casually.
Sam C BarthThe bill shows up in your stack eventuallyI help operators keep HubSpot and RevOps simple enough that bigger shifts do not break the basics.Visit samcbarth.comScaleway already runs Mistral models on its infrastructure. Jestin told Reuters that this would let Airbus accelerate its AI approach. The cloud deal and the model deal are separate, but they fit together. One provides the intelligence layer. The other provides a European place to operate it.
That combination also shows why the sovereignty market is getting more concrete. A buyer does not need a vague promise that its data stays in Europe. It needs interoperable services, enough computing capacity, clear governance, continuity plans, and a legal structure that survives scrutiny. Damien Lucas, Scaleway's chief executive, said the infrastructure has to combine performance with "trust, openness and long-term control."
Long-term control is the difficult part. Cloud platforms become sticky because data, identity, security, and development practices grow around them. A sovereign option that cannot integrate with the rest of the estate only creates a new island. Airbus says Scaleway will connect to its existing technology ecosystem, which is a more meaningful promise than simply naming the country where the hardware sits.
A purchasing rule other companies can copy
Most companies do not build aircraft or military systems, but the buying method travels well. Decide which data and workflows are genuinely sensitive. Write jurisdiction, continuity, interoperability, and operating control into the requirements. Then make providers compete against the full list instead of letting legal risk arrive after the shortlist is finished.
That is especially useful for teams deciding where AI can touch customer, product, or company data. Drawing that boundary before the tool spreads is also where I would start a HubSpot AI rollout. Airbus has done the same thing at industrial scale. It did not ban outside clouds or declare one platform safe for everything. It separated the workloads that need another level of control.
The next proof will be quieter than the announcement. It will be application 12, application 38, and application 70 moving without slowing an engineering team or weakening a security boundary. If Airbus reaches that point by 2028, European cloud sovereignty will have moved from a policy phrase into the daily machinery of building aircraft.
