SOVEREIGNTY
Sovereignty is turning into a procurement requirement
The European Commission has put sovereignty into a cloud procurement framework with scored criteria across jurisdiction, technology, operations, supply chain, data and AI. The term is moving from positioning into evaluation.
What is verified
In 2026 the European Commission used a Cloud Sovereignty Framework in a procurement that awarded a reported €180 million contract to four providers. The framework scores 48 criteria across eight objectives: strategic, legal and jurisdictional, data and AI, operational, supply chain, technological, security and compliance, and environmental sustainability.
It also defines assurance levels intended to distinguish data sovereignty, technological autonomy, and fuller operational control. Whatever one thinks of the scoring method, sovereignty is no longer only language on a product page. It is part of how a major public buyer evaluates bids.
Why it matters
Data residency answers where data is stored. Procurement teams increasingly need answers to a wider set of questions:
- Which jurisdiction can compel access to the service or its operators?
- Who controls encryption keys, identity, updates, and incident response?
- Can workloads and data be exported in usable formats?
- Which critical components depend on a single foreign supplier?
- Can the organisation continue operating through a provider or network failure?
Those questions reach beyond cloud hosting into model weights, inference APIs, training data, orchestration, and the hardware supply chain.
What we are watching
The Commission’s framework is one public-sector instrument, not a universal definition. The next signal is whether private buyers translate the same concerns into contractual exit tests, architecture reviews, and evidence that a system can continue operating when a dependency is removed.