Digital sovereignty in Europe is moving from policy ambition toward something much more concrete: a framework that can determine how cloud services are assessed, procured, and ultimately regulated.
The European Commission has already tested this approach through its Cloud Sovereignty Framework, in a €180 million cloud tender awarded in April 2026. On June 3, 2026, the Commission took the next step by proposing the Cloud and AI Development Act (CADA), which would make a stricter version of this framework mandatory across the EU.
Together, these developments signal a shift in how the EU approaches cloud sovereignty from a broad policy objective to measurable requirements around legal jurisdiction, data control, operational resilience, supply chains, technology, and security.
Here’s what organizations need to know.
Why Digital Sovereignty Has Become an EU Priority
Europe’s dependence on non-EU cloud and AI infrastructure has become more than a technology issue; it is increasingly viewed as a strategic dependency.
Three non-EU hyperscalers control more than 70% of the European cloud market. Meanwhile, the share held by EU providers fell from 29% in 2017 to 15% in 2022 and has remained flat since.
The challenge extends beyond market concentration. Large non-EU providers can also be subject to third-country laws with extraterritorial reach, such as the US CLOUD Act. This means EU authorities cannot always guarantee that data stored within Europe is fully protected from foreign legal demands.
The issue was highlighted in Mario Draghi’s 2024 competitiveness report, which called on the EU to regain and retain control over data and cloud computing services while reducing reliance on foreign infrastructure. This subsequently became part of the European AI Continent Action Plan.
The Commission has since pursued that objective in two stages: first by testing sovereignty scoring through an actual cloud procurement, and now by proposing to turn the underlying concept into law.
From Digital Sovereignty to a Measurable Framework
Between October 2025 and April 2026, the European Commission ran the Cloud III Dynamic Purchasing System, using its voluntary Cloud Sovereignty Framework to assess bidders based on their independence from non-EU control.
The result was a €180 million, six-year contract awarded across four providers, deliberately divided to prevent a single vendor from becoming a point of failure.
But what makes the Framework particularly significant is its attempt to make “sovereignty” measurable.
Rather than treating sovereignty as a single requirement, the Framework evaluates cloud providers against eight weighted Sovereignty Objectives (SOV-1 to SOV-8):
- Strategic Sovereignty (15%) – Ownership, governance influence, EU-source financing, and resilience against forced service suspension.
- Legal & Jurisdictional Sovereignty (10%) – Exposure to non-EU laws with cross-border reach and channels for compelled access.
- Data & AI Sovereignty (10%) – Customer control over encryption keys, auditability of data and AI model access, and EU confinement of processing.
- Operational Sovereignty (15%) – Vendor lock-in and whether EU-based talent can operate and sustain services independently.
- Supply Chain Sovereignty (20%) – Geographic origin of hardware and firmware and auditability across suppliers and sub-suppliers.
- Technology Sovereignty (15%) – Use of open APIs and protocols, architectural transparency, and independence from locked-in technology stacks.
- Security & Compliance (10%) – Alignment with GDPR, NIS2, DORA, EU cybersecurity certification, and EU jurisdiction breach reporting.
- Environmental Sustainability (5%) – Energy efficiency, circular-economy hardware practices, and carbon and water disclosures.
Providers are then rated using a five-tier Sovereignty Effectiveness Assurance Level (SEAL) scale, ranging from SEAL-0, representing no sovereignty, through SEAL-4, representing full EU control with no critical non-EU dependencies.
The Weakest Link Determines the Outcome
One feature that makes the Cloud Sovereignty Framework particularly stringent is that providers are not simply given an average score across all eight objectives.
Instead, their overall SEAL rating is determined by their weakest-scoring objective. This means strong performance in seven areas cannot compensate for falling below the required threshold in the eighth. If one objective fails to meet the minimum requirement, the bidder is disqualified. Only providers that clear this threshold are then ranked using a separate weighted Sovereignty Score.
In the April 2026 procurement, three of the four selected service providers: Post Telecom/OVHcloud/CleverCloud, STACKIT, and Scaleway reached SEAL-3, or Digital Resilience.
Proximus, together with S3NS, Clarence and Mistral, reached SEAL-2, or Data Sovereignty, which was the minimum requirement for the tender.
No assessed provider reached SEAL-4 or Full Digital Sovereignty.
CADA Could Turn the Model into a Binding Regime
The Cloud Sovereignty Framework was effectively a test. The proposed Cloud and AI Development Act would take its underlying logic and establish a formal legal regime.
One of the most significant proposed changes concerns how assurance is verified.
The pilot Framework relied on self-declared SEAL scores. The Commission’s review identified this approach as creating a substantial evaluation burden without an independent verification mechanism.
CADA proposes replacing the SEAL system with four Union Assurance Levels, from Level 1 to Level 4.
Level 1 would remain based on provider self-assessment. Levels 2 through 4, however, would require an independent third-party audit before a provider could be recognized.
Recognition would be granted by a single national competent authority and would then apply across all EU Member States. Recognized providers would also be included in a central public repository.
Compliance Would No Longer Be Optional for Public Bodies
CADA would also change who needs to assess sovereignty requirements.
Under the proposal, Member States and EU bodies would conduct formal risk assessments every two years to determine the appropriate level of assurance for a particular public activity.
The Regulation would establish minimum requirements:
Every public body would need at least Level 1, while activities involving defence, justice, law enforcement, or critical infrastructure would require Level 2, 3, or 4.
Private-sector organizations covered by NIS2 could conduct similar assessments voluntarily, although the Commission has left open the possibility of making this mandatory in the future.
CADA would also establish a “Euro Cloud Federation,” creating a shared platform through which public bodies could pool sovereign cloud capacity rather than negotiate separately.
What Happens Next?
CADA is still a proposal. As an EU Regulation, it must first be negotiated by the European Parliament and the Council, and adoption is not expected before 2027. Once adopted, its provisions would take effect one year later. That means binding enforcement is realistically expected from 2028 at the earliest.
Even so, the underlying approach is not purely theoretical. The Cloud Sovereignty Framework has already been used to determine the outcome of a €180 million procurement.
The proposed legislation, therefore, builds on a model that has already been implemented while introducing more formal mechanisms for verification, recognition, and enforcement.
What Could This Mean for Compliance Teams?
The emerging requirements overlap with areas organizations may already be tracking under existing EU compliance frameworks.
For example, GDPR breach-notification requirements cover much of the same territory as the EU-jurisdiction reporting requirements assessed under SOV-7. This means some of the evidence organizations need to demonstrate sovereignty may already exist within their current compliance processes.
The bigger change is structural.
Rather than relying on a simple pass/fail compliance model, the proposed approach introduces tiered assurance levels and requires the management and tracking of third-party audit evidence for higher levels.
This creates a need to bring together evidence across areas such as jurisdiction, data and AI controls, operational dependencies, supply chains, security, and compliance, and translate it into an assurance-level assessment.
From Sovereignty Principles to Operational Requirements
The direction of travel is becoming clearer.
The EU’s approach to digital sovereignty is moving beyond broad questions about where data is stored. The Cloud Sovereignty Framework evaluates everything from corporate control and foreign legal exposure to encryption keys, operational independence, supply chains, technology architecture, security, and sustainability.
CADA would take this further by moving from voluntary, self-declared assessments toward independently audited assurance levels and mandatory requirements for public-sector use cases.
While the legislation still needs to move through the EU legislative process, organizations operating in or selling cloud services into the European market now have a clearer indication of how the EU may define and measure digital sovereignty in practice.
Operationalizing Digital Sovereignty with Securiti
As EU digital sovereignty requirements evolve, organizations will need a more structured way to bring together the compliance evidence needed to support sovereignty assessments.
The Securiti DataAI Command Platform can help organizations build on compliance information they already track rather than approaching emerging sovereignty requirements entirely from scratch. For example, GDPR breach-notification requirements already cover much of the evidence relevant to SOV-7’s EU-jurisdiction reporting standard.
This existing overlap provides a foundation for organizations preparing for a model based on tiered sovereignty assessments. As the requirements evolve, the focus will increasingly be on structuring existing compliance evidence by assurance level and maintaining the third-party audit evidence required for higher tiers.
With Securiti, organizations can build on their existing compliance efforts as they prepare for the EU’s evolving approach to digital sovereignty.
Request a demo to learn more.
