NATO clears AWS for NATO RESTRICTED data, highlighting Europe’s cloud dependence

Key facts

• AWS became the first cloud provider cleared by NATO to handle NATO RESTRICTED information across all member states.
• AWS says Spain’s National Cryptographic Centre (CCN) tested services against NATO security directives and shared findings alliance-wide.
• The development intersects with EU Data Act obligations to protect EU data from third-country government access, influencing cloud sovereignty architectures.

3 minute read

Amazon Web Services has received NATO-wide approval to handle information at the NATO RESTRICTED level, becoming the first cloud provider to secure a blanket clearance across all allies for that category of sensitive-but-unclassified data. While NATO RESTRICTED is not classified, it requires safeguarding controls that are increasingly relevant as NATO and European militaries industrialise rapid, cross-border data exchange for operational awareness and air defence, including the fusion of radar, satellite and acoustic inputs to detect and track Russian drones and other threats.

From a procurement and integration perspective, the move institutionalises commercial hyperscale cloud as a building block of NATO’s digital transformation agenda, aligning with the alliance’s stated push to incorporate commercial IT into coordination and planning. AWS’ position is reinforced by its existing footprint in Europe—reported as nine data-centre regions across Europe including the UK—and by the fact it already supports sensitive military and intelligence workloads for multiple NATO members. AWS says the certification pathway was enabled through testing against NATO security directives with Spain’s National Cryptographic Centre (CCN), with findings disseminated to all member states, effectively creating a reusable compliance artefact that may lower friction for multinational programmes adopting shared cloud services.

For Europe, the strategic implication is uncomfortable but actionable: even as EU institutions and several capitals press for greater digital sovereignty, NATO’s first alliance-wide clearance in this tier has been awarded to a US provider rather than a European alternative. This underscores that operational interoperability and time-to-field continue to pull European defence users toward US-origin platforms where scale, maturity and compliance engineering are already amortised. At the same time, the decision does not negate sovereignty concerns; it elevates them. The EU Data Act’s requirement to protect EU data from access by third-country governments, including the United States, is directly relevant to defence-adjacent cloud architectures, data residency decisions, and contract clauses around legal access, encryption key custody and operational control. The report notes that hyperscalers including AWS and Microsoft are investing in “European versions” of their cloud stacks to meet these requirements, suggesting a market equilibrium in which US firms remain dominant but must package offerings in EU-compliant, Europe-hosted configurations.

Politically, the announcement also signals that EU regulatory pressure on data handling is not currently preventing US cloud companies from winning sensitive NATO-related business, complicating US domestic claims that European regulation amounts to an exclusionary barrier. For European procurement officers, the near-term question is how to extract enforceable sovereignty guarantees—technical and legal—while leveraging NATO-certified commercial cloud to accelerate multinational data sharing.

Source: Defense One