Europe Proposes 48-Criteria Cloud Sovereignty Framework to Reduce Dependence on US Tech Giants

The European Union is taking steps to reduce its dependence on foreign cloud providers, as governments increasingly rely on digital infrastructure to manage public services, sensitive information and critical operations.

The European Commission’s proposed Cloud and AI Development Act (CADA) aims to strengthen Europe’s cloud and artificial intelligence ecosystem while improving technological sovereignty. A central element is a common framework for evaluating how much control European organisations retain over the cloud services they use.

The initiative reflects a concern that storing data in European data centres does not necessarily guarantee complete independence. A service may operate within the EU while remaining subject to decisions, legal obligations or corporate control originating outside the region.

For governments and organisations responsible for critical services, the question is therefore broader than where information is stored. It also concerns who controls the technology, who can access the data, who operates the infrastructure and whether a provider could restrict access to essential services.

What Is the 48-Criteria Cloud Sovereignty Framework?

The European Commission’s Cloud Sovereignty Framework evaluates providers using 48 specific criteria grouped into eight categories. These cover strategic considerations, legal and jurisdictional control, data and AI, operations, supply chains, technology, security and compliance, and environmental sustainability.

The framework is designed to give organisations a more structured way to assess whether a cloud service meets their sovereignty requirements.

For example, an assessment may consider whether customer data remains within the European Union, whether the provider is exposed to foreign legal obligations, how much operational control is retained within Europe, and whether the technology supply chain creates dependencies that could affect service continuity.

The framework also considers the provider’s ability to maintain services independently and the extent to which external parties can influence critical operations.

Importantly, the 48 criteria do not simply determine whether a company is European or American. They provide a broader assessment of the legal, technical and operational conditions under which a service is delivered.

Four Levels of Cloud Sovereignty

The proposed Cloud and AI Development Act introduces four assurance levels to reflect different degrees of sovereignty.

At the lower end, the emphasis is on infrastructure and data being located within the European Union. Higher levels introduce stronger requirements concerning independence from third-country jurisdictions, corporate control, personnel and technology supply chains.

The highest level is intended to provide the greatest degree of control and protection against interference from outside the EU.

This tiered approach recognises that not every organisation needs the same level of protection. A routine business application may have different requirements from a system handling sensitive government information or supporting essential public services.

The framework is intended to help public authorities match the level of sovereignty to the sensitivity and operational importance of the service involved.

Why American Cloud Providers Are Under Scrutiny

Major US technology companies, including Amazon, Microsoft and Google, play significant roles in Europe’s cloud computing market. Their platforms provide computing power, data storage, software services and infrastructure for businesses and public institutions.

However, foreign ownership and legal jurisdiction can create concerns even when data centres are physically located in Europe. Certain US laws can, under specified circumstances, require American companies to provide data to US authorities, including data held abroad.

European policymakers are concerned that these legal and corporate dependencies could create risks for sensitive information or the continuity of critical services.

The proposed framework does not automatically ban American cloud companies from operating in Europe. Instead, it seeks to establish common criteria for assessing sovereignty and determining which services are appropriate for particular public-sector uses.

Providers may need to demonstrate that they meet the relevant requirements to qualify for specific public-sector contracts or assurance levels.

What Could the Act Mean for European Technology Companies?

The initiative could create opportunities for European cloud providers by giving public authorities a more consistent way to identify services that meet stringent sovereignty requirements.

European technology companies have argued for greater opportunities to compete with global hyperscalers. A common assessment framework could make it easier for buyers to compare providers on factors beyond price, including operational independence, data governance and supply-chain resilience.

The broader act also aims to increase European computing capacity, accelerate data-centre development and support innovation in cloud and AI technologies. The Commission has proposed tripling the EU’s data-centre capacity over the next five to seven years.

However, European providers will still need to deliver competitive performance, reliability, security and pricing. Meeting sovereignty requirements alone will not eliminate the technical and financial advantages of established global cloud platforms.

For businesses, the practical outcome will depend on how the rules are implemented and which requirements apply to their particular services and contracts.

What Happens Next?

The Cloud and AI Development Act was proposed by the European Commission in June 2026. It must progress through the EU’s legislative process before it can become law.

The sovereignty framework is part of a broader effort to strengthen Europe’s technological autonomy without closing its market to international partners. Its eventual impact will depend on the final legislation, detailed implementation rules and how public authorities apply the assurance levels.

The initiative signals a shift in how governments assess cloud infrastructure. Cost and technical performance remain important, but legal control, operational continuity and the ability to maintain essential services are receiving greater attention.

As cloud computing and AI become more central to public administration and economic activity, Europe’s challenge will be to strengthen its digital independence while preserving competition, innovation and access to global technology.

Frequently Asked Questions

1. What is the EU Cloud and AI Development Act?

It is a proposed EU regulation designed to strengthen Europe’s cloud and AI ecosystem, expand computing capacity and reduce strategic dependence on non-European providers.

2. What does the 48-criteria Cloud Sovereignty Framework assess?

It assesses cloud services across areas including legal jurisdiction, data and AI, operations, supply chains, technology, security, compliance and environmental sustainability.

3. Will the framework ban US cloud providers in Europe?

No. The proposal does not establish a blanket ban on US providers. It aims to assess services against sovereignty requirements, particularly for public-sector use.

4. Why is data storage within Europe not enough?

A data centre may be located in Europe while its provider remains subject to foreign laws or external corporate control. Sovereignty assessments therefore consider more than physical data location.

5. Has the Cloud and AI Development Act become law?

No. The European Commission proposed the act in June 2026. It must proceed through the EU legislative process before becoming law.