SecureCloud Blog

Cloud Sovereignty Framework: How the EU is finally making cloud sovereignty measurable

Written by Thomas Ens | Mar 24, 2026 11:41:37 AM

Cloud sovereignty is a term that has appeared in tenders, strategy papers and press releases for years. Often without a clear definition. The EU has now changed that. With the new Cloud Sovereignty Framework, for the first time there is a structured, verifiable framework for what a cloud service must provide in order to be considered sovereign. This has concrete consequences for providers, operators and anyone who selects cloud infrastructure for regulated use cases.

What has been missing so far and why the framework is coming now

Anyone looking for a sovereign cloud in recent years was faced with a problem: every provider called itself sovereign, but no one had to prove it. European subsidiaries of American hyperscalers marketed their data centers in Frankfurt or Dublin as "EU-sovereign", even though the parent company is based in the USA and falls under the scope of the CLOUD Act of 2018.

The US CLOUD Act obliges American companies to grant US authorities access to stored data upon request, even if this data is physically located in Europe. This is not a theoretical risk, but a structural problem that is not solved by a European branch.

At the same time, regulatory pressure has increased. NIS2, DORA, the Cyber Resilience Act and, for public authorities, the GDPR-compliant processing of data with increased protection requirements. In this environment, the lack of clear, verifiable criteria has increasingly become an obstacle to procurement decisions.

This is precisely where the new EU framework comes in. It builds on the EUCS (EU Cybersecurity Certification Scheme for Cloud Services), which was developed by ENISA, and defines cloud sovereignty as an independent concept with specific technical, organizational and legal requirements.

The three dimensions of cloud sovereignty according to the EU

The framework distinguishes between three dimensions, which are considered independently of each other, but all three must be fulfilled in order to achieve the highest level of sovereignty.

Data sovereignty

Data sovereignty means that the processed and stored data remains exclusively in the EU and can only be physically accessed by EU-based bodies. This sounds like a matter of course, but it is not. Replication in backup data centers outside the EU, automatic log forwarding to central monitoring systems of the parent company or support access by non-European personnel. All of this can break data sovereignty without it being visible at first glance.

Operational sovereignty

Operational sovereignty goes further: who operates the infrastructure, who has privileged access and where are the subcontractors located? The framework requires that operation, administration and support are carried out exclusively by EU-based and EU-controlled entities. A US group that runs its European operations via a subsidiary has a structural problem here, as group instructions, support processes and security response teams are often not completely decoupled.

Legal immunity

This is the toughest requirement: the cloud provider must not be subject to any non-European jurisdiction that could allow authorities to access customer data. This includes US, British or other third-country laws with extraterritorial scope. Only European-controlled companies without a US parent company or US stock exchange listing can structurally fulfill this requirement.

The EUCS and the Sovereign-SEAL. What is the difference?

The EUCS provides for three confidence levels: Basic, Substantial and High. These levels cover classic cybersecurity requirements. Availability, integrity, encryption, incident response. A provider at High level is technically well secured, but that says nothing about sovereignty.

The sovereign level, also known informally as SEAL, is an additional label that goes beyond the EUCS high level. It combines all three dimensions of sovereignty and requires that the provider:

  • has its headquarters and control in the EU
  • has no group dependencies outside the EU that could enable legal access
  • has implemented technical controls that do not allow access to data even in the event of a request from authorities in third countries, through encryption with keys managed exclusively within the EU

The SEAL label is therefore not a self-declaration, but a certification that can be verified by accredited bodies. In the future, this will become a prerequisite for public authorities and regulated industries when tendering for contracts.

EUCS levels and SEAL levels at a glance

A two-level picture helps to clearly separate the terms:

  • EUCS describes cybersecurity trust levels for cloud services (Basic → Substantial → High).
  • SEAL / Sovereign level describes sovereignty requirements (data sovereignty, operational sovereignty, legal immunity), typically in addition to a high EUCS level.

EUCS levels

  • EUCS Basic: Entry level with basic security requirements. Focus on basic controls and minimum measures. Suitable for workloads with low protection requirements where a standard security level is sufficient.
  • EUCS Substantial: Intermediate level with significantly higher requirements for technical controls, organizational processes and their implementation. Fits typical company workloads with medium risk, where security must be operated reliably and repeatably.
  • EUCS High: Highest EUCS level for highly critical or heavily regulated scenarios. The focus here is on particularly strict controls, robust operating processes, auditability and verification.

Important: A service can fulfill EUCS High and still not be "sovereign" if, for example, there are non-European group or legal dependencies.

3) SEAL / Sovereign Level (more detailed)

The SEAL (Sovereignty Effectiveness Assurance Level) addresses precisely this gap and supplements EUCS (especially EUCS High) with sovereignty criteria. In the framework, a cloud service is not assessed "once overall", but along 8 sovereignty objectives (Sovereignty Objectives, often referred to as SOV-1 to SOV-8). A SEAL level (typically 0 to 4) is assigned for each of these objectives, which expresses the degree of maturity or effectiveness of the measures.

The 8 SEAL assessment areas (Sovereignty Objectives)

(Each area is assessed separately with a SEAL level)

  • SOV-1 Strategic Sovereignty: Control over governance, ownership, strategic direction, "who decides".
  • SOV-2 Legal sovereignty: Exposure to non-EU law and ability to prevent third country access.
  • SOV-3 Operational sovereignty: Operational and support capability within the EU, including emergency and escalation capability.
  • SOV-4 Data/control sovereignty: Demonstrable control over data location, data flows and processing (including secondary channels such as telemetry).
  • SOV-5 Supply chain sovereignty: Transparency and controllability of critical supply chain and sub-processor dependencies.
  • SOV-6 Technological sovereignty: Avoidance of critical technical lock-ins, traceability and interchangeability of central components.
  • SOV-7 Security and compliance sovereignty: Security controls, verifications, audits and EU-compliant implementation in practice.
  • SOV-8 Environmental/sustainability aspects: Energy efficiency, controlled footprint and measurable sustainability requirements.

What the SEAL levels express in practical terms (0-4)

  • SEAL-0: No evidence of relevant sovereignty.
  • SEAL-1: Basic compliance (EU law/regulations formally addressed), but strong non-EU dependencies.
  • SEAL-2: Material sovereignty measures in place, but still relevant external dependencies.
  • SEAL-3: High degree of EU control and operational independence, external influences very limited.
  • SEAL-4: Very high to complete digital sovereignty in this target area, with minimal critical non-EU dependencies.

Typical core elements that can be found in many SOV objectives are

  • Data sovereignty: data processing and storage in the EU. No covert data outflows via telemetry, support tools or subsystems.
  • Operational sovereignty: Operation, administration and support by EU-based, EU-controlled bodies. Subcontractor rules are strict and must be fully transparent.
  • Legal immunity: Minimization or exclusion of third country legal access (e.g. extraterritorial access laws). This is the reason why pure "EU region" offers from US hyperscalers are structurally limited.
  • Key sovereignty (practical leverage): Encryption is not enough. It is crucial that key management is implemented in such a way that third parties cannot force access because the keys are controlled by the EU.

What this means for hyperscalers

AWS, Microsoft Azure and Google Cloud have all announced or already introduced European data centers, European subsidiaries and in some cases dedicated "Sovereign Cloud" offerings. Nevertheless, they cannot structurally reach the sovereign level because the parent company is based in the USA, is subject to US stock exchange law and is therefore subject to the CLOUD Act.

Individual attempts to circumvent this, for example through joint ventures with European partners such as the project between Thales and Google or T-Systems and Microsoft, are technically costly and organizationally complex. They reduce the risk, but do not completely solve the structural problem. The framework sets the bar in such a way that genuine decoupling is necessary, not just contractual protection.

This is not hidden protectionism, but a factual consequence of the requirements. Anyone who has to prove legal immunity from the CLOUD Act can only do so if there is no US corporation in the background.

Technical requirements in detail

Anyone seeking certification must provide evidence of specific technical measures. The most important ones:

Encryption: Data must be encrypted both at-rest and in-transit. This is standard - but the decisive factor is who controls the keys.

Key management: Cryptographic keys may only be managed by EU-based bodies. An external key management service of the provider, to which only the customer has access (Bring Your Own Key / Hold Your Own Key), can fulfill this requirement - if it is operated by a sovereign entity.

Access controls: Privileged access to production systems must be fully logged, restricted to EU personnel and secured against unscheduled access by technical measures. Break-glass processes must be documented and auditable.

Subcontractors: Any subcontractor that could potentially have access to customer data must meet the same requirements as the main provider. No silent sub-processors from third countries.

Logging and auditing: Complete, tamper-proof logs of all data access - not just at application level, but right down to infrastructure level.

What cloud sovereignty is not. The distinction from the GDPR

A common misunderstanding: GDPR compliance is not the same as cloud sovereignty. The GDPR regulates how personal data may be processed. It says nothing about whether a provider is exposed to non-European legal access.

A service can be fully GDPR-compliant. processing agreement, data protection impact assessment, standard contractual clauses and still be structurally vulnerable to a US authority being able to demand access to the data on the basis of the CLOUD Act. The framework makes this difference explicit. Sovereignty is a separate dimension that goes beyond data protection law.

Relevance for Kubernetes PaaS platforms

The framework has direct consequences for operators and users of Kubernetes-based PaaS platforms. A platform that is operated on non-sovereign infrastructure inherits its weaknesses - regardless of how well its own application layer is secured. Sovereign by design means that the infrastructure layer on which the platform runs already fulfills the requirements of the framework.

This is the approach taken by lowcloud: a fully European-controlled platform that runs on infrastructure that is structurally suitable for the sovereign level. For development teams, this means that they can work cloud-natively. With the familiar Kubernetes workflows, without compromising sovereignty.

The EU Cloud Sovereignty Framework now also provides a formal framework for this approach. Instead of "we are hosted in Germany", in future there will be verifiable criteria against which providers must be measured.

Outlook: What comes next

The framework has initially been published as an orientation framework. The final adoption of the EUCS by the EU member states is still pending. There have been political tensions here in the past, particularly around the question of whether the sovereign level effectively excludes US hyperscalers. It does and this is not politically uncontroversial.

Nevertheless, the direction is clear. Authorities and companies in regulated industries will increasingly ask for certified sovereign cloud services in tenders. Those who rely on sovereign infrastructure now are prepared for these requirements - those who wait will have to migrate later under time pressure.