{"id":100743,"date":"2025-10-27T09:30:56","date_gmt":"2025-10-27T08:30:56","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100743"},"modified":"2025-10-27T09:37:29","modified_gmt":"2025-10-27T08:37:29","slug":"what-is-the-cloud-sovereignty-framework","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/wat-is-het-cloud-sovereignty-framework\/","title":{"rendered":"What is the \u2018Cloud Sovereignty Framework?"},"content":{"rendered":"

The European Commission has published a new \u2018Cloud Sovereignty Framework\u2019 (Cloud Sovereignty Framework<\/a>), a document that transforms a vague political term - \u2018sovereignty\u2019 - into a concrete, measurable and enforceable set of rules. This framework is not just another policy paper; it is immediately applied in A \u20ac180 million procurement procedure for cloud services for all EU institutions<\/a>. This move is a clear signal: for the EU, digital sovereignty is no longer an abstract ideal, but a hard contractual requirement.<\/p>\n\n\n\n

Why a new framework for cloud sovereignty?<\/h3>\n\n\n\n

Until now, \u201csovereignty\u201d in the context of cloud services has been a catch-all term. It raised questions about data location, the impact of foreign laws (such as the U.S. Cloud Act<\/a>) and dependence on non-European technology suppliers.<\/p>\n\n\n\n

For governments and public institutions, this lack of clarity is a significant legal and strategic risk. The Commission's new framework, developed by the Directorate General of Digital Services<\/sup>, aims to eliminate this ambiguity. It provides a uniform yardstick to determine the extent to which a cloud service is actually under European control. <\/sup><\/sup><\/sup><\/sup><\/p>\n\n\n\n

The framework is based on existing European initiatives such as GAIA-X<\/a> and the ENISA<\/a>-cybersecurity framework. <\/p>\n\n\n\n

The 8 pillars of sovereignty<\/h3>\n\n\n\n

At the heart of the framework are eight Sovereignty Objectives. <\/sup> A vendor is no longer judged solely on data storage, but on a much broader and deeper spectrum:<\/p>\n\n\n\n

    \n
  1. Strategic Sovereignty (SOV-1):<\/strong> The extent to which the provider is anchored in the EU legal, financial and industrial ecosystem (e.g. ownership structure, governance). <\/li>\n\n\n\n
  2. Legal & jurisdictional sovereignty (SOV-2):<\/strong> Exposure to foreign legislation (such as the US Cloud Act) and the enforceability of European rights. <\/li>\n\n\n\n
  3. Data & AI Sovereignty (SOV-3):<\/strong> The degree of control customers have over their data and AI models, including where data is processed. <\/li>\n\n\n\n
  4. Operational Sovereignty (SOV-4):<\/strong> The practical ability to manage, support and maintain technology independent of foreign control. <\/li>\n\n\n\n
  5. Supply chain sovereignty (SOV-5):<\/strong> The transparency and origin of critical components (hardware and software) and the degree of EU control over them. <\/li>\n\n\n\n
  6. Technological Sovereignty (SOV-6):<\/strong> The independence of the underlying technology, focusing on open standards and avoiding \u2018vendor lock-in. <\/li>\n\n\n\n
  7. Security & Compliance Sovereignty (SOV-7):<\/strong> Ensuring that security operations (such as Security Operations Centers) and compliance controls are under EU jurisdiction only. <\/li>\n\n\n\n
  8. Ecological Sustainability (SOV-8):<\/strong> Long-term autonomy and resilience with respect to energy consumption and resource scarcity. <\/li>\n<\/ol>\n\n\n\n

    From \u201cnone\u201d to \u201cfull\u201d sovereignty: the 5 SEAL levels<\/h3>\n\n\n\n

    The framework then defines five \u2018Sovereignty Effectiveness Assurance Levels\u2019 (SEALs) to classify the degree of sovereignty. <\/sup> This shows that sovereignty is not a binary \u2018yes\/no\u2019 question, but a sliding scale:<\/p>\n\n\n\n