How to assess your digital sovereignty

The European Commission's Cloud Sovereignty Framework (Version 1.2.1, October 2025) turns digital sovereignty into measurable criteria: eight sovereignty objectives, five assurance levels (SEAL-0 to SEAL-4), and a weighted Sovereignty Score.

The Commission's Directorate-General for Digital Services wrote it to assess cloud providers in its Sovereign Cloud tender. The Commission says all organisations wishing to adopt its approach are welcome to use it.

This Q&A answers the common questions using only two sources: the framework itself and the Commission's April 2026 announcement of the tender results.

What is digital sovereignty?

The European Commission defines digital sovereignty through measurable objectives, not a single sentence. Its framework says the objectives add sovereignty-specific safeguards to security requirements, defining clearly what sovereignty means.

In practice, digital sovereignty is assessed across eight dimensions: strategic, legal and jurisdictional, data and AI, operational, supply chain, technology, security and compliance, and environmental sustainability.

The highest level, Full Digital Sovereignty (SEAL-4), means technology and operations under complete EU control, subject only to EU law, with no critical non-EU dependencies. The Commission adds that it requires a full EU supply chain, from chips to software.

Digital sovereignty is broader than data sovereignty. In the framework, data sovereignty is SEAL-2, two levels below full digital sovereignty.

[VERIFY: an official one-sentence EU definition of "digital sovereignty". Neither source gives one.]

What is data sovereignty under the EU Cloud Sovereignty Framework?

In the framework, Data Sovereignty is a specific assurance level: SEAL-2. It means EU law is applicable and enforceable, but material non-EU dependencies remain, and the service, technology or operations are under indirect control of non-EU third parties.

The Commission's announcement puts SEAL-2 in practical terms: the provider abides by EU laws and regulations without the customer needing additional technical measures to protect its data.

The framework also has a related objective, SOV-3 Data & AI Sovereignty. It covers the protection, control and independence of data assets and AI services within the EU: how data is secured, where it is processed, and how much autonomy customers keep over AI capabilities.

One point matters for anyone writing about this: in the framework, data sovereignty is not the top level. SEAL-3 (Digital Resilience) and SEAL-4 (Full Digital Sovereignty) sit above it.

Why does digital sovereignty matter in EU cloud procurement?

Because sovereignty can now be measured, it can be required. The Commission states that before the framework, digital sovereignty could not be measured, which made it hard to set as a requirement in procurement.

The framework replaces abstract principles with concrete metrics. According to the Commission, it also gives companies a clear picture of what they should focus on.

It is already in use. The Commission used it to award its Sovereign Cloud tender, worth up to EUR 180 million over 6 years for EU institutions, bodies, offices and agencies. To be eligible, providers had to reach SEAL-2.

Why do EU public sector bodies and companies need digital sovereignty?

For EU public bodies, the Commission already requires a minimum level in its own cloud procurement. The Sovereign Cloud tender was part of the Commission's efforts to strengthen the digital sovereignty posture of Union entities. The Commission says it is now applying the same criteria to the digital services it provides to its own departments and other Union entities.

Sovereignty level also decides what can run where. The framework says assessment results may be used during the contract to decide which systems can be deployed at a given provider, because different risk profiles require different assurance levels.

For EU companies, the sources set no legal obligation. The framework is a procurement tool for this tender. The Commission invites any organisation to adopt its approach, and states a goal of encouraging the market to offer sovereign solutions that comply with EU laws and values.

‍

What are the risks of lacking digital sovereignty?

The framework does not list risks as such. It names the exposures it assesses, and each one is a risk a non-sovereign service carries. The table maps each risk to the objective that checks for it.

‍Risk

Objective that assesses it

Exposure to non-EU laws with cross-border reach (the framework cites the US CLOUD Act and the Chinese Cybersecurity Law)

SOV-2 Legal & Jurisdictional

Legal, contractual or technical channels through which non-EU authorities could compel access to data or systems

SOV-2 Legal & Jurisdictional

International regimes that may restrict usage or transfer

SOV-2 Legal & Jurisdictional

Requests to cease or suspend the service, or vendor support being withdrawn or disrupted

SOV-1 Strategic

The provider, not the customer, holding effective control over cryptographic access to data

SOV-3 Data & AI

Storage or processing falling back to third countries

SOV-3 Data & AI

Vendor lock-in that blocks migration to alternative EU-controlled solutions

SOV-4 Operational

Reliance on non-EU vendors, facilities or proprietary technologies in the supply chain

SOV-5 Supply Chain

Lock-in to foreign proprietary systems through closed APIs, protocols or licences

SOV-6 Technology

Security patches that depend on non-EU vendors

SOV-7 Security & Compliance

In procurement there is a direct consequence too. Tenders that do not reach the minimum SEAL consistently across all objectives are rejected.

What is the EU Cloud Sovereignty Framework for assessing digital sovereignty?

The assessment has two parts: a SEAL level per objective, used as a pass/fail minimum, and a weighted Sovereignty Score, used to rank services. The objectives draw on CIGREF's Trusted Cloud Referential v2, Gaia-X policy rules and architecture, and the European Cybersecurity Certification Framework (ENISA, NIS2, DORA).

The eight sovereignty objectives

Objective

What it assesses

Weight in score

SOV-1 Strategic

How far the service is anchored in the EU legal, financial and industrial ecosystem: ownership stability, governance influence, alignment with EU priorities

15%

SOV-2 Legal & Jurisdictional

The legal environment, exposure to foreign authority, and enforceability of rights

10%

SOV-3 Data & AI

Protection, control and independence of data and AI services within the EU

10%

SOV-4 Operational

Whether EU actors can run, support and evolve the technology independently of foreign control

15%

SOV-5 Supply Chain

Geographic origin, transparency and resilience of the technology supply chain

20%

SOV-6 Technology

Openness, transparency and independence of the technology stack

15%

SOV-7 Security & Compliance

Whether security operations, compliance and resilience are controlled within the EU

10%

SOV-8 Environmental Sustainability

Long-term autonomy and resilience in energy use, dependency and raw material scarcity

5%

The framework explains the lower weights for SOV-2 and SOV-7: the procurement procedure already contains significant safeguards in those domains.

The five assurance levels (SEAL)

Level

Name

Definition

SEAL-0

No Sovereignty

Exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions

SEAL-1

Jurisdictional Sovereignty

EU law formally applies with limited practical enforceability; exclusive control of non-EU third parties

SEAL-2

Data Sovereignty

EU law applicable and enforceable; material non-EU dependencies remain; indirect control of non-EU third parties

SEAL-3

Digital Resilience

EU law applicable and enforceable; EU actors have meaningful but not full influence; marginal control of non-EU third parties

SEAL-4

Full Digital Sovereignty

Complete EU control, subject only to EU law, no critical non-EU dependencies

The Commission's announcement adds that SEAL-4 requires a full EU supply chain, from chips to software.

The Sovereignty Score

The score sums each objective's score as a share of its maximum, multiplied by that objective's weight:

\text{Sovereignty Score} = \sum_{n=1}^{8} \frac{\text{Score}(SOV_n)}{\text{Max. Score}(SOV_n)} \times \text{Weight}(SOV_n)\%

In the tender, the score counts toward the quality score as an award criterion.

How do you assess your organisation's digital sovereignty?

Use the framework's contributing factors as your checklist. The Commission assesses each objective against these factors, using the tenderer's answers, supporting documents and public information. You can run the same exercise on your own stack or on a provider.

1. Collect evidence. Gather documents and public information on ownership, contracts, data locations, suppliers, licences and certifications.
2. Work through each objective's factors (table below).
3. Assign a SEAL level per objective using the definitions in the previous section.
4. Lower the level for material weaknesses. The framework states that a material weakness in one or more factors lowers the overall level for that objective.
5. Check against the minimum you need. In the Commission tender, SEAL-2 was the eligibility minimum.
6. Compute a weighted score with the formula and weights above, if you need to compare options.

Objective

Factors to check

SOV-1 Strategic

Are bodies with decisive authority over the service in the EU? What protects against change of control? How much financing comes from EU sources? How much investment, jobs and value creation are in the EU? Is there involvement in EU initiatives? Can secure operations continue if asked to cease or suspend, or if vendor support stops?

SOV-2 Legal & Jurisdictional

Which national legal system governs operations and contracts? What is the exposure to non-EU laws with cross-border reach? Are there channels for non-EU authorities to compel access? Do international regimes restrict usage or transfer? Where is IP created, registered and developed?

SOV-3 Data & AI

Does only the customer control cryptographic access to data? Is there visibility into when, where and by whom data is accessed, including AI model usage? Can data be irreversibly removed, with evidence? Are storage and processing confined to European jurisdictions with no third-country fallback? Are AI models and pipelines developed, trained, hosted and governed under EU control?

SOV-4 Operational

How easily can workloads migrate to alternative EU-controlled solutions? Can EU operators run and support it without non-EU vendor involvement? Is there an EU talent pool? Is support delivered from the EU under EU law only? Are full documentation, source code and know-how available? Where are critical suppliers and subcontractors, and who controls them?

SOV-5 Supply Chain

Where is hardware manufactured or assembled? What is the jurisdiction and provenance of firmware? Where and by whom is software built, packaged, distributed and updated? How much reliance is there on non-EU vendors? Is there visibility and audit rights across the whole supplier chain?

SOV-6 Technology

Are APIs and protocols documented, non-proprietary and standards-based? Is software under open licences with rights to audit, modify and redistribute? Is there architectural documentation, data flows and dependencies? How independent is the EU in the compute capabilities used?

SOV-7 Security & Compliance

Which EU and international certifications are held? Is there adherence to GDPR, NIS2, DORA and other EU frameworks? Do SOCs and response teams operate only under EU jurisdiction? Can the customer or an EU authority oversee logs and alerts? Is breach reporting EU-compliant? Can patches be applied independently of non-EU vendors? Can EU entities audit with full access?

SOV-8 Environmental

Is infrastructure energy-efficient (for example, low PUE), with improvement targets? Are there circular-economy practices for hardware? Are carbon, water and other indicators measured and disclosed? Is energy renewable or low-carbon?

A self-assessment is an approximation. The Commission's score uses points from questions in the tender questionnaire, which the framework does not publish. [VERIFY: whether the tender questionnaire and its point allocation are publicly available.]

Which digital sovereignty questions should you ask a cloud provider?

Vendor comparison tables often score providers on a handful of criteria. Each question below maps one of those common criteria to what the framework actually assesses, so you can test the claim against the official factors.

Does my data have to stay in the EU?

The framework assesses it as a contributing factor, not a stand-alone pass/fail rule. SOV-3 checks for strict confinement of storage and processing to European jurisdictions, with no fallback to third countries.

How does the framework treat CLOUD Act exposure?

As a legal and jurisdictional risk. SOV-2 assesses the degree of exposure to non-EU laws with cross-border reach, naming the US CLOUD Act and the Chinese Cybersecurity Law. It also checks for any legal, contractual or technical channel through which non-EU authorities could compel access.

Does the parent company matter?

Yes. SOV-1 checks whether the bodies with decisive authority over the service sit within EU jurisdiction, and what assurances exist against a change of control. SOV-4 checks the location and legal control of critical suppliers and subcontractors.

Does a provider need 100% EU shareholders?

The framework does not set a shareholding threshold. SOV-1 assesses ownership stability, governance influence, and how far the provider relies on financing from EU sources.

Does the framework require an open-source stack?

It assesses openness rather than requiring it. SOV-6 checks whether software is available under open licences with rights to audit, modify and redistribute, and whether APIs and protocols are documented, non-proprietary and standards-based.

What does the framework say about AI services?

SOV-3 assesses how far AI models and data pipelines are developed, trained, hosted and governed under EU control. It also checks auditability of AI model usage.

Can the service be run without the original vendor?

That is SOV-4 Operational Sovereignty. It checks whether EU operators can manage, maintain and support the technology without non-EU vendor involvement, and whether full documentation, source code and know-how are available.

Are NIS2 and DORA part of the assessment?

Yes. SOV-7 assesses adherence to GDPR, NIS2, DORA and other EU frameworks, plus EU and internationally recognised certifications such as ISO and ENISA schemes.

What does the framework expect for logs and audits?

SOV-7 checks whether the customer or an EU authority can oversee logs, alerts and monitoring directly, and whether EU entities can run independent security and compliance audits with full access. SOV-3 adds visibility into when, where and by whom data is accessed.

Is a provider built on US technology automatically non-sovereign?

Not under the framework. In the Commission tender, Proximus used an environment based on Google Cloud technology, operated exclusively by EU companies, and reached SEAL-2, the eligibility minimum. The Commission says this shows non-European technologies can meet the minimum level when operated within a strict framework.

Is "Schrems II proof" or "no data mining for ads" a framework criterion?

Neither term appears in the framework. [VERIFY: how Schrems II compliance and advertising data use relate to the SOV objectives, if at all.]

How does digital sovereignty affect your business?

Sovereignty now decides who can bid and who wins. In the Commission tender, SEAL-2 decided eligibility and the Sovereignty Score counted toward the award. The tender's results show what that looks like in practice.

Awarded provider

SEAL reached

Post Telecom with OVHcloud and CleverCloud (Luxembourg-France)

SEAL-3

STACKIT, Schwarz Group (Germany)

SEAL-3

Scaleway, Iliad Group (France)

SEAL-3

Proximus with S3NS, Clarence and Mistral (Belgium-France-Luxembourg)

SEAL-2

Three points from the Commission's announcement matter for any business:

• Non-EU technology is not automatically excluded. Proximus uses a technical environment based on Google Cloud technology, operated exclusively by EU companies, and reached the SEAL-2 minimum.
• Sovereignty alone did not win. Providers also had to show reliable, state-of-the-art services, with a strong focus on fully managed services (PaaS), developer experience and automation.
• The bar may move. The Commission will publish an updated framework based on lessons from this tender.

If you sell to EU institutions, expect to back each objective with evidence: answers, supporting documents and public information. If you buy, the framework's factors give you a structured way to question providers.

Sources

• European Commission, Directorate-General for Digital Services. Cloud Sovereignty Framework, Version 1.2.1, October 2025. Direct PDF.
• European Commission. Commission advances cloud sovereignty through strategic procurement, 17 April 2026.

‍