By Michał Puchała · 2026-09-11 · 3 min read
EU cloud news, week of 2026-09-11
EU product-security reporting duties begin, Google plans more Finnish infrastructure, and Sweden opens new research computing capacity. We also revisit OVHcloud's portable backup announcement and Switzerland's workplace trials for practical lessons in control and continuity.
Europe's cloud decisions became more concrete this week, with product-security reporting duties taking effect, new computing capacity opening in Sweden and further infrastructure planned in Finland. Alongside those developments, two announcements from early September offer practical lessons in keeping control of backups and testing alternatives before committing to a migration.
Cyber Resilience Act reporting duties begin on 11 September Manufacturers of products covered by the Cyber Resilience Act must now report vulnerabilities being actively exploited and severe incidents affecting product security, with an early warning within 24 hours of awareness and a fuller notification within 72 hours. Reports go through the Single Reporting Platform to the relevant national incident-response team and the EU cybersecurity agency, ENISA, subject to limited exceptions on sharing. The Commission's guidance announcement distinguishes this deadline from the main obligations applying in December 2027. Our practical takeaway for affected manufacturers: give someone explicit responsibility for reporting and rehearse how engineering, management and suppliers will exchange information quickly enough to meet the deadline.
Google plans further data centre and energy infrastructure in Finland Google's 9 September announcement covers investment during 2027 and 2028 in Hamina, Kajaani, Muhos and Vaala, alongside energy projects supporting its expansion. It includes a 22-year power purchase agreement with Fortum intended to support the life extension of the Loviisa nuclear plant. For boards, our reading is that infrastructure location, electricity supply and supplier control deserve separate questions in a cloud review: this announcement describes Google's expansion in Europe and does not establish a European-controlled alternative. Buyers should assess the services and contractual protections available for their actual applications today, while treating the construction programme as future capacity.
Sweden inaugurates the Arrhenius supercomputer On 8 September, the EU's high-performance computing partnership and Sweden's National Academic Infrastructure for Supercomputing inaugurated Arrhenius at Linköping University. Designed for demanding simulations and AI applications, it serves research, industry and public-sector users, with access available through European application calls, including routes for benchmarking and development. For a manufacturer exploring materials simulation or a life-sciences company evaluating research computing, this is a concrete option to investigate with the Swedish organisations helping industry gain access. We would begin with a defined research task, then confirm eligibility, data-handling conditions and allocation timelines before making it part of a delivery plan.
OVHcloud and Plakar announce integrated, portable backups In a 3 September announcement worth catching up on, OVHcloud and French open-source backup company Plakar described native backup integration across OVHcloud Public Cloud products. They say customers retain their encryption keys, backup copies remain in Europe and data can be restored elsewhere, including outside OVHcloud. That combination makes the announcement relevant to both recovery planning and a future change of provider. Our operational takeaway is to test a complete application restore into a second environment, including access to keys and the time required to resume work. The release states the intended capabilities, but leaves buyers to confirm coverage and availability for their particular services.
Switzerland publishes the results of its open-source workplace trial Another early-September development, the Federal Chancellery's findings published on 2 September describe testing with 172 participants across government departments. The browser-based workplace, built on Germany's openDesk software, was judged suitable in principle for key standard processes, while technical, operational and organisational obstacles remain before widespread production use. Document editing, file storage, collaboration, email and calendar functions received particularly positive assessments. For leaders planning a cloud exit, our takeaway is the method: involve the people doing the work, test defined business processes and record what still fails before setting a wider migration date.
The useful test across these stories is whether a decision improves something you can demonstrate: timely reporting, suitable computing access or dependable recovery.
Thinking about migration? Book a free consultation to discuss your situation.