The European Union recently introduced a new Cloud Sovereignty Framework that provides a standardized method for assessing cloud services, moving from abstract principles to concrete sovereignty metrics. The framework aims to solidify Europe’s digital autonomy and reduce reliance on non-EU technology giants, addressing long-standing concerns about extraterritorial laws such as the U.S. CLOUD Act.
The framework measures sovereignty across eight objectives, ranging from strategic and legal to supply chain and technological aspects, as well as compliance with EU laws. Moreover, this initiative builds on the strategic goals of previous projects, such as GAIA-X.
The framework is essentially a “scorecard” that ranks providers based on performance across eight defined Sovereignty Objectives (SOVs), with varying weights, and based on the total score, cloud services are assigned one of five SEAL rankings, ranging from SEAL-0 (no sovereignty) to SEAL-4 (‘full’ digital sovereignty). This ranking is intended to be a decisive factor in government and public sector cloud procurement tenders.
(Source: eProcurement news)
In an official EU news article, the authors emphasized the framework’s intent:
By setting minimum assurance levels for each, the Commission creates a level playing field where cloud providers active on the EU market can demonstrate their sovereignty strengths.
The launch of the framework formalizes a trend that major international providers have already begun to address through dedicated European solutions.
- AWS announced the creation of its EU Sovereign Cloud unit, reported earlier by InfoQ, explicitly structured to ensure data residency and operational autonomy within Europe. This unit focuses on satisfying the SOV-3 (Data & AI Sovereignty) criteria by creating physically and logically separated infrastructure and governance.
- InfoQ also reported that Microsoft has similarly restructured its offerings, emphasizing new compliance commitments and localized processing to address legal sovereignty concerns and reduce the risk exposure presented by foreign surveillance laws.
In addition, the regulatory push is mirrored by significant European-led strategic initiatives. Virt8ra, a major European initiative coordinated by OpenNebula Systems, recently announced a substantial expansion of its federated cloud infrastructure, aiming to establish a sovereign and interoperable cloud ecosystem as a direct alternative to non-EU vendors, as reported by InfoQ.
For European developers and cloud architects, the framework creates a complex decision-making landscape in which digital sovereignty is framed not as autarky but as resilience against specific scenarios.
Markus Ostertag, chief AWS technologist at adesso, as part of a podcast with Renato Losio and others, notes that digital sovereignty “doesn’t mean autarky. It’s more about how I am as an organization, resilient against specific scenarios.“
Harry Mylonas echoes this sentiment in a LinkedIn post, arguing that “True sovereignty isn’t about where your provider’s C-suite sits. It’s about your proven, auditable ability to govern your own digital estate.“
A core challenge remains the feature gap, as European providers often lack the “huge software suite” and “deep feature integration” of US hyperscalers, which can slow down rapid development and innovation. To manage this tension between velocity and architectural flexibility, practitioners recommend separating cloud-specific code or infrastructure code from the core business logic to maximize portability while still leveraging necessary cloud features.
Despite the Commission’s push for a level playing field, local European cloud providers and market analysts have expressed skepticism over the practical application of the scoring system. The concern is that the framework’s complexity and breadth may benefit global hyperscalers with larger compliance teams and budgets.
Aleksandar Hudic commented in a LinkedIn post:
This is definitely a very important publication for digital sovereignty. However, in practice, it is not very effective because it makes a binary decision by immediately eliminating non-EU companies. Further, the focus is more on the Quantitative model than on the qualitative, which will make it very difficult to differentiate between individual Sovereignty assurance levels. So it is a very promising start; I hope it will continue to evolve with the help of industry partners, becoming more practical and applicable to real-world industry cases.
And Stephan Geering, a Deputy General Counsel & Compliance, Trustworthy AI and Global Privacy Officer at Anthology, posted on Bluesky:
Sceptics: You can’t really define ‘sovereignty’
EU Commission: Hold my beer
The challenge for the industry now lies in how providers, both local and global, will translate the high-level SOV criteria into demonstrable and auditable technical realities to achieve the top SEAL rankings.
