Sovereign cloud: the eight dimensions that finally make sovereignty measurable

“The data is hosted in Europe.”

That sentence is often used to justify calling a cloud offering sovereign.

It does not, however, describe the sovereignty of a digital service on its own.

A platform may host data inside the European Union while still depending heavily on technology, supply chains, operational control or suppliers outside the EU.

In 2026, the European Commission started making this concept far more measurable.

Its Cloud Sovereignty Framework turns digital sovereignty into structured assessment criteria and introduces several assurance levels: the Sovereignty Effectiveness Assurance Levels — SEAL.1

The framework matters beyond European public procurement.

It helps organizations ask a better question when choosing cloud services: what does this service really depend on, and who retains the power to keep it running?

Data location is only one dimension

Data sovereignty remains important.

Organizations need to know where data is stored, where it is processed, who can technically access it, which jurisdiction applies and how cryptographic keys are managed.

But the Cloud Sovereignty Framework goes further.

The Commission assesses sovereignty across eight objectives, covering strategic, legal and jurisdictional, data and AI, operational, supply-chain, technological, security and compliance, and environmental dimensions.1

Sovereignty therefore becomes a property of the architecture as a whole.

1. Strategic sovereignty

The first question concerns long-term control.

Who owns the technology? Where are intellectual-property rights held? Who controls major evolution decisions?

A service may be operated in Europe while depending entirely on technology controlled elsewhere.

That does not automatically make it unsuitable, but the strategic dependency should be understood.

The relevant question is not only “where is the supplier located?”, but “who controls the technology assets without which the service cannot evolve?”

2. Legal and jurisdictional sovereignty

The physical location of a datacenter and the jurisdiction applying to its provider are different subjects.

A company may operate infrastructure located in France while still being subject to legal obligations originating in another country.

Assessment should therefore include the contracting entity, group structure, applicable jurisdictions, possible data-access obligations and legal safeguards.

Legal sovereignty cannot be inferred from the datacenter address alone.

3. Data and AI sovereignty

The European framework looks at effective control over data, storage, processing, cryptographic mechanisms and dependencies linked to AI models and pipelines.1

Important customer questions include: who controls encryption keys? can the provider access data without customer intervention? can data move outside the intended jurisdiction? do AI services use or retain data? can deletion be demonstrated?

Two offerings hosting data in the same country can answer these questions very differently.

4. Operational sovereignty

A service can be hosted and legally framed in Europe while depending on operational teams or components located elsewhere.

Organizations therefore need to understand who actually administers the platform, who holds the highest privileges, which teams can intervene, where critical operations take place and what happens if certain teams or technologies become unavailable.

Operational sovereignty is, in effect, the ability to keep the service running when some external dependencies disappear.

5. Supply-chain sovereignty

This is one of the least visible dimensions.

A cloud provider has suppliers of its own: servers, electronic components, hypervisors, software, network services, security tools and orchestration technologies.

An offering can appear European commercially while relying heavily on an external supply chain.

The highest SEAL level is associated with very strong European supply-chain requirements extending deep into the technology stack.2

Sovereignty here becomes a dependency map, not a label.

6. Technological sovereignty

One simple question helps test this dimension: what would happen if the main technology supplier stopped providing updates or licenses tomorrow?

A cloud can be operated in Europe while depending heavily on a proprietary hypervisor, database, external software platform or specific hardware architecture.

The ability to maintain, evolve or replace those components determines part of the organization's technological autonomy.

Portability therefore matters, but it has to be measured in practice.

Exporting a virtual machine is not the same as migrating an application that relies on fifteen proprietary managed services.

7. Security and compliance

Sovereignty and cybersecurity are not synonyms.

A service can be sovereign and poorly secured. A service can also have strong certifications without offering a high level of sovereignty.

The Commission framework therefore treats security and compliance as separate dimensions.1

This avoids a common shortcut: certified = sovereign.

Certification addresses a defined control framework. It does not necessarily describe every geopolitical, technological or operational dependency.

8. Environmental dimension

The Commission also includes an environmental dimension in its assessment framework.1

This can seem surprising, but it reflects a broader view of sovereignty: durable control over digital infrastructure also depends on efficiency, energy supply and the sustainability of operations.

For many organizations this will be less decisive than jurisdiction or technology, but it completes the picture.

SEAL levels avoid a binary sovereign/non-sovereign debate

One of the framework's most useful features is that it avoids the simplistic classification sovereign / non-sovereign.

The Commission uses several SEAL levels, from SEAL-0 to SEAL-4.2

In the cloud procurement awarded in April 2026, suppliers had to reach at least SEAL-2, associated with data sovereignty.

Most selected offers reached SEAL-3, which the Commission links to stronger digital resilience against disruptions originating from non-European suppliers.2

This approach is more realistic.

Sovereignty becomes a level of control, not an absolute property.

Constructed case: three clouds, three sovereignty profiles

Consider three fictional providers.

Cloud A hosts data in France and is operated by a French company, but the full platform relies on proprietary technology controlled by a non-European company. Data sovereignty may be strong while technological sovereignty is weaker.

Cloud B develops its own stack and keeps operations and data inside the EU, but some critical hardware and software components come from suppliers outside the EU. Its technological autonomy is stronger, but the supply chain is not entirely European.

Cloud C also stores data in Europe, relies heavily on open technologies and offers strong portability, but some administrative functions depend on a group subject to an external jurisdiction.

All three can market themselves as sovereign. Their profiles are nevertheless different.

Sovereignty therefore needs to be mapped

A practical representation can be: cloud service → data → jurisdiction → operations → technologies → critical components → suppliers → external dependencies → alternatives.

For each relationship, the organization can assess location, control, interruption risk, replacement difficulty, exposure to foreign jurisdiction and migration lead time.

The discussion then moves from marketing claims to architecture analysis.

The Commission has already used the framework in a €180 million procurement

The framework is not purely theoretical.

In April 2026, the Commission awarded four sovereign cloud contracts worth up to €180 million over six years.2

The selected providers were assessed using the framework.

The Commission explicitly described the objective as turning digital sovereignty into measurable and standardized criteria.2

Sovereignty is therefore becoming something that can be compared, documented and audited.

A simple exercise before the next cloud decision

Before choosing a provider, take one critical service and answer eight questions: who controls the technology? which jurisdiction really applies? who controls data and keys? who operates the service? which suppliers does it depend on? can the underlying technologies be replaced? what is its real security and compliance level? which environmental factors affect operations?

If an answer depends only on a marketing brochure, the analysis is probably incomplete.

The main contribution of the Cloud Sovereignty Framework may be exactly this: sovereignty is no longer only something a provider claims. It can become something a customer verifies.