Airbus Chose Scaleway Partly Because of Jurisdiction

Companies buy cloud services for even their most critical systems, and server location alone no longer answers the security question. What matters is which country’s laws govern the provider itself.

Why is Airbus moving its systems to Scaleway?

A fresh example comes from European aircraft manufacturer Airbus. The Register reported in July that Airbus is moving about 70 critical applications from Amazon’s cloud to French provider Scaleway. The move is part of a broader programme, Minimum Viable Company: the core systems keeping Airbus running in a crisis. The first phase is due by 2028.

Airbus chose Scaleway on more than price or technical performance alone. According to the paper, Airbus weighed bids on technical performance, operational resilience, and legal safeguards, with the jurisdiction question falling under the last of these. Scaleway’s bid was commercially competitive against the industry’s cloud giants.

What does jurisdiction mean in practice?

This is an ordinary risk assessment. Server location shows where data physically sits, not who can access it by administrative order. That is determined by which country’s laws govern the provider. The US CLOUD Act requires US companies to hand over data they hold to the authorities, even if physically in Europe. That is why jurisdiction belongs among the other procurement criteria, such as delivery reliability, data security, and price. It is one line in the risk assessment, not a special case.

Is a European version of the cloud enough?

Large cloud providers now offer European versions of their services, keeping data within the EU with European staff. This does not, however, remove the underlying question. As long as the parent is American, the CLOUD Act likely reaches its European subsidiary too. Industry experts say ultimate control in practice usually rests where the company is legally domiciled.

What ultimately matters?

What matters is not the provider’s nationality. What matters is authority, whose laws govern data access. The same applies equally to an American, French, or Chinese provider. Building critical operations on a single provider’s cloud also builds path dependency.

Airbus did not make its decision on principle. It made it on a risk assessment. The same assessment can be made by anyone unwilling to wonder whose hands their data is in.