Oracle and Vodafone announced a jointly operated cloud region in Milan on Wednesday, structured so that Vodafone Italia holds operational control and Oracle supplies the technology stack under license. The arrangement means no Oracle employee outside Italy can access customer data or the physical infrastructure, and the operating entity is Italian, which places it outside the reach of the US CLOUD Act by design. The first phase covers roughly 40 megawatts across two availability domains and opens for customers in November. Target buyers are Italian public administration, regional health authorities, and defense suppliers, all of which have procurement rules that hyperscaler contracts have struggled to satisfy.
The legal structure is the product
Every sovereign cloud arrangement is a story about jurisdiction rather than technology. The US CLOUD Act permits American authorities to compel a US company to produce data it controls regardless of where that data sits, and European legal opinions have consistently held that a European subsidiary of a US parent does not escape that reach. The workaround that satisfies European counsel is for the operator to be a European company with no US parent, licensing technology rather than acting as an agent.
That is what this deal does. Vodafone Italia operates the region, employs the staff with physical and logical access, holds the encryption keys through a hardware security module infrastructure it controls, and contracts directly with customers. Oracle supplies software, hardware designs, and remote support that requires Vodafone approval for each session and produces an audit record. The question European regulators will examine is whether the technology dependency amounts to control in substance, which is the same question raised about Microsoft's Bleu joint venture in France and SAP's Delos offering in Germany.
What customers actually get
The region runs a subset of Oracle Cloud Infrastructure services rather than the full catalog. Compute, block and object storage, virtual networking, Kubernetes through OKE, Autonomous Database, and the identity service are in the first phase. Notably absent are most of the AI services, since those depend on model hosting Oracle has not yet arranged to run under this structure. Oracle says generative AI services arrive in the second phase during 2027, which is a long wait for customers who consider that the point.
Pricing carries a premium of roughly 22 percent over Oracle's standard EU rates according to a price list two prospective customers shared with us. That gap reflects lower scale and the cost of duplicated operations, and it is smaller than the premium Microsoft charges for its French sovereign arrangement. For a public authority whose alternative is running its own data center, 22 percent above hyperscaler pricing is still substantially cheaper than the status quo.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
Italy's specific situation
Italy has pushed harder on cloud sovereignty than most European countries, driven by the Agenzia per la Cybersicurezza Nazionale and by a national strategy that classifies public data into tiers with different hosting requirements. The most sensitive tier effectively requires national operation, and the Polo Strategico Nazionale, a consortium including TIM and Leonardo, was built to serve it. That consortium has had a difficult few years with migration delays and cost overruns.
The Oracle and Vodafone region competes for the tier below that, where data is sensitive enough to require European control and not so sensitive as to require the national consortium. That is a large pool: regional health authorities alone run hundreds of systems that currently sit in aging on-premises facilities. Two health authority chief information officers we spoke with described the current options as expensive and unreliable and said a credible third choice changes their five year plans.
The competitive response
Amazon has committed EUR 7.8 billion to its European Sovereign Cloud, with the first region in Brandenburg operating under a German entity with German staff and an independent supervisory structure. That is a more complete implementation than most of the joint ventures and it is expensive enough that Amazon is unlikely to replicate it per country. Microsoft's approach relies on partner-operated deployments in France and Germany. Google has partnerships with T-Systems and Thales.
Oracle's differentiation is willingness to license its stack to an operator it does not control, which the other hyperscalers have resisted because it gives away the operational relationship. Oracle has less to lose in European public sector, where its cloud share is small, and more to gain. Whether the model works depends entirely on whether Vodafone can operate a cloud region competently, which is not a business Vodafone has been in, and which the company is addressing by hiring about 300 people in Milan and Turin.
The unresolved question
No European court has ruled on whether these arrangements actually place data beyond US reach. The legal opinions supporting them are careful and reasoned and have not been tested. If a US authority served an order on Oracle for data in the Milan region, Oracle would presumably argue it lacks the ability to comply, and a court would decide whether the licensing relationship gives it possession, custody, or control within the meaning of the statute.
Until that happens, buyers are purchasing a legal opinion rather than a certainty, and they know it. Several European procurement officers told us the calculation is about defensibility rather than guarantee: if a data protection authority asks why a hosting choice was made, pointing to a structure designed with counsel and approved by a national cybersecurity agency is an answer. That is a lower bar than actual immunity and it is the bar the market is currently clearing.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Kubernetes
