Sovereign cloud is becoming more than a claim about where data sits: European buyers are beginning to assess who controls and operates a service, which laws may reach it, how transparent its technology and supply chain are, and whether it can withstand disruption or outside pressure. The European Commission’s 2026 framework gives public-sector procurement a structured way to examine those questions, but a framework score or procurement award is not a blanket guarantee for every provider service or workload.
What does sovereign cloud mean?
The European Commission defines technology sovereignty as the ability to act independently in the digital world by developing and controlling key technologies, data, and infrastructure while reducing reliance on non-EU providers. Applied to cloud, that is a broader test than the location of a data centre.
As an Amazon Associate I earn from qualifying purchases.
Location still matters, particularly for data residency and legal obligations. But buyers also need to consider who holds administrative control, who can operate or update the service, which jurisdictions may apply, how much of the software and supply chain can be inspected, and whether the organization can keep operating during disruption or external pressure. An EU-hosted service may answer the location question without, by itself, answering all the others.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This is also why cloud sovereignty and digital autonomy are connected to AI. Cloud infrastructure provides a foundation for AI services, and autonomy depends on capabilities across the technology stack—not only on where data is stored.
#1 Best Overall
How is cloud sovereignty assessed?
The Commission’s framework and SEAL thresholds
The European Commission’s Cloud Sovereignty Framework, described on 1 June 2026, combines SEAL thresholds with an overall score based on 48 criteria across eight categories. Its criteria cover strategic considerations; legal and jurisdictional exposure; data and AI; operations; supply chain; technology; security and compliance; and environmental sustainability.
The framework’s short descriptions distinguish three thresholds: SEAL-2 corresponds to data sovereignty, SEAL-3 to technological autonomy, and SEAL-4 to full sovereignty. They are levels within the framework, not shorthand for a single data-location test. The eight-category assessment is meant to expose differences between services and their evidence, rather than reduce sovereignty to a vendor label.
Four assurance levels in the CADA policy framing
The Commission’s Cloud and AI Development Act (CADA) policy page, last updated 3 June 2026, also describes four assurance levels, from EU-located processing and storage at Level 1 to full software supply-chain transparency and no third-country interference at Level 4. These are linked concepts within the Commission’s broader framework, but they should not be casually equated with the framework’s shorter SEAL labels: the terminology and descriptions differ.
Rank #2
For procurement, the practical question is what evidence supports the level required for a particular service and workload. A label alone does not establish the service’s control arrangements, legal exposure, or supply-chain transparency.
Which providers were selected for the EU sovereign-cloud procurement?
In April 2026, the Commission awarded a sovereign-cloud procurement for EU institutions, bodies, offices, and agencies with a maximum value of €180 million over six years. The Commission’s framework explainer identifies four provider groups:
| Selected provider group | What the award establishes |
|---|---|
| Post Telecom with CleverCloud and OVHcloud | Selection in the Commission procurement |
| STACKIT | Selection in the Commission procurement |
| Scaleway | Selection in the Commission procurement |
| Proximus with S3NS, Clarence, and Mistral | Selection in the Commission procurement |
The award is evidence that the Commission is buying through a sovereignty-oriented assessment approach; it is not evidence that every service from each selected group reaches the same assurance level, or suits every workload. Buyers still need to inspect the specific service, its operating model, and the evidence applicable to their use case.
Rank #3
What trends are shaping sovereign cloud in Europe?
Procurement is turning broad claims into assessable controls
The framework gives public buyers a defined set of dimensions against which to request evidence. That changes the purchasing conversation from “Is this cloud sovereign?” to questions about jurisdiction, operations, supply chain, technology, and the required assurance for a particular workload. Private-sector buyers can use the same dimensions as a due-diligence checklist, while setting their own risk tolerance and procurement requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Infrastructure capacity and autonomy are being treated together
The Commission’s CADA policy framing links reducing dependency with expanding European cloud and AI infrastructure. It identifies permitting, energy, land, water, and financing as relevant constraints and sets a goal of at least tripling EU data-centre capacity within the next five to seven years. That is a policy target, not a completed expansion or proof that capacity has already been delivered.
The capacity question matters because sovereignty commitments depend on infrastructure that can actually support demand. The same constraints mean that expansion and environmental sustainability must be considered together; the Commission includes sustainability in its assessment frame and names resource availability in its policy discussion.
Competition policy is related, but it is not a sovereignty certification
On 25 June 2026, the Commission announced a preliminary view that AWS and Azure should be designated as gatekeepers for cloud services under the Digital Markets Act (DMA). The Commission said the companies could respond before final decisions, so this was not a final designation as of the announcement. The DMA process concerns competition and market contestability; it does not certify a cloud service as sovereign or determine its assurance level.
In the same release, Commission Executive Vice-President Henna Virkkunen said that over half of EU businesses rely on cloud computing services. This is the Commission’s attributed statement, not an independently validated statistic presented here as a separate measurement.
What should an organization compare when choosing a sovereign cloud?
Start with the workload rather than the provider’s headline claim. A workload containing regulated or highly sensitive information may need stronger jurisdictional, operational, or supply-chain controls than a low-risk public-facing service. Decide what must be protected, what disruption the organization can tolerate, and what assurance level its rules require before comparing offers.
Best Value
- Set the workload’s risk and required assurance. Identify the data involved, applicable obligations, criticality, and the consequences of service interruption or loss of control. Translate those factors into a required assurance level rather than assuming every workload needs the highest level.
- Check strategic and legal control. Ask who owns and controls the service, who can access administrative functions, where relevant entities operate, and which jurisdictions may have legal authority over the provider or service.
- Examine data and AI arrangements. Establish where data is processed and stored, how it is governed, and what cloud or AI components the workload depends on. Do not treat data residency as a substitute for understanding control of the wider stack.
- Verify operational arrangements. Determine who runs, supports, and can change the service, how the organization can maintain continuity, and what options exist if the provider or a dependency becomes unavailable.
- Trace the technology and supply chain. Seek evidence about software components, update mechanisms, dependencies, and the transparency available to the customer. The level of visibility should match the workload’s sensitivity and required assurance.
- Review security, compliance, and sustainability evidence. Compare the controls and compliance evidence relevant to the workload, along with the service’s environmental information where it is available and material to the decision.
- Match evidence to the exact offer. Confirm that assurances apply to the specific service, deployment, operating model, and contract under consideration—not merely to the provider group or a procurement award.
Record the evidence and unresolved trade-offs for each category. A comparison is useful only when it distinguishes documented controls from broad statements and makes clear which risks remain with the buyer.
What comes next?
The direction of travel in Europe is toward treating sovereign cloud as a procurement and infrastructure question with multiple measurable dimensions. The Commission’s framework provides a common vocabulary for assessment; CADA presents capacity growth as a policy objective; and the DMA process addresses competition in a market central to businesses and AI. These developments are related, but none alone establishes that Europe has achieved cloud autonomy.
For organizations, the near-term implication is straightforward: specify sovereignty requirements against workload risk, request evidence across the relevant framework dimensions, and assess the exact service being purchased. Neither an EU location nor a provider’s selection in a Commission procurement substitutes for that service-level review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
