Digital sovereignty is not a yes-or-no label that comes with a European data-centre address. For CIOs, it is a set of workload-specific questions about legal exposure, operational control, technology dependencies, security, resilience and the ability to switch providers. Europe’s approach is moving toward common assessment criteria and procurement requirements, giving organisations more concrete ways to evaluate those trade-offs—but not a universal verdict on which cloud to use.
What digital sovereignty means for CIOs
The European Commission defines tech sovereignty as “Europe’s ability to act independently in the digital world by developing and controlling key technologies, data, and infrastructure, while reducing reliance on non-EU providers.” That is a broad policy goal, not a synonym for data residency or a guarantee that every technology will be developed inside Europe. The definition appears on the Commission’s Strengthening Europe’s Tech Sovereignty page.
For a CIO, the practical question is what control an organisation needs over a particular workload—and what dependencies or legal exposures remain after choosing a provider. A service may store data in Europe yet rely on software, infrastructure, ownership or support arrangements that matter to the organisation’s risk assessment. Conversely, not every workload has the same sensitivity or needs the same level of control.
What Europe’s new policy approach changes
On 3 June 2026, the Commission presented a technological sovereignty package spanning semiconductors, cloud and AI, open source, and the digitalisation of energy systems. The package included the EU Open Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy, as well as two legislative proposals: Chips Act 2.0 and the Cloud and AI Development Act (CADA). The presentation of the package does not mean the proposed legislation has been enacted.
#1 Best Overall
CADA’s proposed aims
CADA proposes action on three fronts: research, development and innovation in cutting-edge, sustainable cloud and AI; capacity to accelerate conditions for deploying EU data centres, including for essential public functions; and greater autonomy through a single EU-wide cloud and AI sovereignty assessment framework with a public-sector adoption mechanism.
The Commission’s cloud policy page describes a proposal aim to at least triple EU data-centre capacity within five to seven years and to meet the needs of EU businesses and public administrations by 2035. These are targets stated by the Commission, not evidence that capacity has already tripled or a guarantee that the targets will be delivered.
Rank #2
How the Commission is measuring cloud sovereignty
The Commission describes its Cloud Sovereignty Framework as an assessment using 48 criteria grouped into eight categories, alongside sovereignty assurance levels called SEALs. Its 1 June 2026 explanation associates SEAL-2 with data sovereignty, SEAL-3 with technological autonomy and SEAL-4 with full sovereignty. The criteria cover strategic, legal and jurisdictional, data and AI, operational, supply-chain, technological, security and compliance, and environmental sustainability matters.
This approach treats sovereignty as a combination of factors rather than a single hosting-location test. A SEAL result is therefore an assessment under the Commission’s framework; it should not be read as a general assurance that a provider meets every organisation’s requirements, or that a particular service has identical characteristics across all its offerings.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat the Commission’s cloud procurement shows
The Commission announced that Union entities can procure sovereign cloud services through contracts with a maximum value of EUR 180 million over six years. It selected four providers or consortia. The Commission said the four-contract approach was intended to diversify provision and reduce lock-in risk.
| Provider or consortium named by the Commission | Commission-reported SEAL result | Scope note |
|---|---|---|
| Luxembourgish-French partnership led by Post Telecom, with OVHcloud and CleverCloud | SEAL-3 | Result reported for this procurement by the Commission. |
| Germany’s STACKIT | SEAL-3 | Result reported for this procurement by the Commission. |
| France’s Scaleway | SEAL-3 | Result reported for this procurement by the Commission. |
| Belgian-French-Luxembourgish partnership led by Proximus, using services from S3NS, Clarence and Mistral | SEAL-2 | The Commission said this offer included a Google Cloud technology base operated exclusively by EU companies. |
These results describe the Commission’s evaluation within this procurement, not a universal ranking of providers or a finding about every service they sell. The Commission also considered service capability, including managed services, developer experience, automation and performance. CIOs should assess those practical requirements alongside sovereignty criteria: stronger control is not useful if a service cannot support the workload’s needs.
Rank #4
How CIOs can assign controls by workload
Start by classifying workloads, then match the level of assurance and operational safeguards to their sensitivity and criticality. The Commission’s categories provide a useful assessment structure, but each organisation must determine its own risk tolerance, regulatory obligations and service requirements.
- Classify the workload. Identify regulated, safety-critical, national-infrastructure and commercially sensitive uses, and distinguish them from workloads with lower consequences if a provider or service becomes unavailable.
- Map legal and jurisdictional exposure. Establish which entities control the provider and which laws may apply to access requests. Data location is relevant, but it does not by itself establish who may compel access or what other jurisdictional ties exist.
- Check operational control. Find out who administers the systems, who holds privileged access, and who can keep the service operating during a disruption. Match the answers to the workload’s continuity requirements.
- Trace technology and supply-chain dependencies. Examine dependencies in software, infrastructure and support, including whether a third party could interrupt service. Consider how those dependencies affect your ability to maintain or recover the workload.
- Request evidence suited to the use case. Evaluate security, compliance and sustainability evidence against the workload’s actual requirements rather than relying on broad sovereignty claims.
- Test service fit. Compare the managed services, developer experience, automation and performance the workload needs with the provider’s controls. The Commission considered capability factors in its own tender; a CIO should not treat them as separate from procurement suitability.
- Make exit a tested control. The Commission says the Data Act seeks fast, free and technologically fluid cloud switching, interoperability and safeguards for international transfers. Translate those policy aims into contract rights, usable data formats, clear migration responsibilities and a tested exit plan. The stated aims do not make switching effortless.
The result may be different control designs for different workloads: for example, stricter requirements for a highly sensitive system and a different balance of cost, capability and control for a less critical service. The evidence supports segmentation; it does not establish that every workload should leave a hyperscaler or that every European provider will satisfy every organisation’s requirements.
Is a European cloud automatically protected from foreign laws?
No. A European data centre answers where data is stored; it does not, on its own, settle which entities control the service, what jurisdictional obligations may apply, who has operational access or how the service depends on other companies’ technology. Those questions should be evaluated for the provider, service and workload in question rather than inferred from a location label.
A 26 November 2025 feature by Christine Horton in IT Pro describes Gaia-X as a rules and trust-framework initiative for areas including identity, compliance automation, service labelling, policy enforcement and interoperability—not as a cloud provider. Horton reports Airbus Chairwoman of the Gaia-X Board and EVP Digital Catherine Jestin saying she valued working with AWS, Google and Microsoft, but not for the most critical applications and services. That is an example of one company’s workload distinction, not a general rule for all organisations.
The same article reports a Gaia-X-related interviewee’s warning that services can remain subject to US legislation even when operated in Europe by European employees. Because the article excerpt does not establish that interviewee’s full name and role, the point is best treated as a reported concern rather than as a fully identified expert’s legal conclusion. For procurement, CIOs should obtain advice on the applicable facts and laws instead of treating either location or a general sovereignty label as a legal answer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
