What is a sovereign cloud?

How it works

Cloud computing, in the NIST definition, is a model in which users reach a shared pool of computing resources over a network on demand. NIST's examples include servers, storage and applications. A sovereign cloud adds assurances about who controls those resources and which laws reach them. In January 2026 the European Parliament called for a definition of sovereign cloud.

One published yardstick is the European Commission's Cloud Sovereignty Framework, dated October 2025 and written for a cloud tender. It assesses a service against eight objectives: strategic, legal and jurisdictional, data and AI, operational, supply chain, technology, security and compliance, and environmental sustainability. Factors it weighs include:

• whether non-EU authorities could compel access to data
• whether only the customer controls the encryption keys
• whether EU operators can run the service without a non-EU vendor

Each objective gets a Sovereignty Effectiveness Assurance Level (SEAL). SEAL-0 means exclusive control by non-EU parties. SEAL-4 means complete EU control with no critical non-EU dependencies.

Why it matters

Amazon, Microsoft and Google together hold more than 60% of the global cloud market, Reuters reported in June 2026. Reuters attributed the EU's push for sovereignty requirements to concern about that dominance and about laws such as the US CLOUD Act. That law can require US-based providers to give authorities data stored abroad.

US providers have launched their own offerings. Amazon Web Services says its European Sovereign Cloud, generally available since January 15, 2026, is physically and logically separate from its other regions and operated only by EU residents.

Where things stand in 2026

In April 2026 the Commission awarded a sovereign cloud tender worth up to €180 million over six years to four providers or partnerships led by European companies. Bidders had to reach SEAL-2. Three reached SEAL-3. A Proximus-led partnership that draws on Google Cloud technology operated by EU companies reached SEAL-2. The Commission said an updated framework would follow.

On June 3, 2026, the Commission published its proposal for a Cloud and AI Development Act, according to Parliament's legislative tracker. The Commission's summary says the act would set four sovereignty assurance levels for use by public sector bodies. Level 1 covers services whose data is processed and stored on infrastructure in the EU. As of September 20, 2026, the tracker listed the proposal as awaiting a decision by Parliament's committees, so it was not yet law.