Cloud Sovereignty Framework: Making Digital Sovereignty Measurable

TL;DR

• The EU’s Cloud Sovereignty Framework makes digital sovereignty precisely measurable for the first time – through eight sovereignty objectives (SOV-1 to SOV-8) and five assurance levels (SEAL-1 to SEAL-5).
• The SEAL levels allow procurement agencies to set clear minimum requirements for cloud services and objectively compare offers – especially in the regulated and public sector.
• SEAL-4 represents practically complete digital sovereignty: EU jurisdiction, technical and operational control by European actors, exit capability, and verifiable evidence across all eight sovereignty objectives.
• For organizations, the framework offers a pragmatic roadmap: define target levels per SOV objective, identify gaps, prioritize measures, and align procurement processes and contracts with the model.
• ayedo supports you in building SEAL-4 capable platforms – with EU-only infrastructure, BYOK, open standards, exit scenarios, ISO-certified processes, and a structured Cloud Sovereignty Assessment.

What the Cloud Sovereignty Framework Achieves

Digital sovereignty has long been an abstract concept. This changes with the European Commission’s Cloud Sovereignty Framework. It translates the political demand for European control over digital infrastructures into an operational model that can be measured, audited, and embedded in tenders.

The core of the framework consists of:

• eight sovereignty objectives (SOV-1 to SOV-8) that define what must be sovereign,
• and five Sovereignty Effective Assurance Levels (SEAL-1 to SEAL-5) that determine to what extent sovereignty is effectively achieved.

Public procurers – and increasingly regulated companies – can thereby bindingly determine which SEAL level is at least required per sovereignty objective. Offers that do not meet the minimum levels are excluded. Higher levels can be included as award criteria in the evaluation.

This turns digital sovereignty from a declaration of intent into a verifiable quality feature – comparable to information security or sustainability standards.

A compact introduction can also be found in our overview of the Cloud Sovereignty Framework.

Overview of the Eight Sovereignty Objectives

The eight sovereignty objectives cover the entire value chain of a cloud service – from ownership structures to the energy supply of the data center. Important: No objective can fully compensate for the weaknesses of another. A provider with high technical sovereignty but weak legal shielding remains vulnerable overall.

SOV-1: Strategic Sovereignty

Strategic sovereignty describes the structural anchoring of the provider in the EU:

• Location and control of decision-making bodies in the EU
• Protection against takeover or dominant influence by non-EU actors
• Value creation (development, operation, support) predominantly in the EU
• Ability to maintain operations even under external political or economic pressure

In short: In a crisis, those who decide over your platform must not be outside the European legal order.

SOV-2: Legal & Jurisdictional Sovereignty

This is about the question: Which legal order applies bindingly, and who can legitimately access data and systems?

• Predominant application of EU law, legal venue in the EU
• Shielding against extraterritorial access rights like the CLOUD Act or FISA
• No contractual, technical, or organizational channels through which non-EU authorities can directly or indirectly access

For many organizations, SOV-2 is the core of digital sovereignty – without legal control, all technical measures are only partially effective.

SOV-3: Data & AI Sovereignty

Sovereignty over data and artificial intelligence means:

• Customer control over cryptographic keys (BYOK/HSM), without escrow constructs
• Complete and reliable access logging
• Consistent data localization in the EU, without “fallback” regions
• Control over training data, models, pipelines, and AI platforms
• Verifiable deletion proofs – especially for sensitive and personal data

Particularly in light of the GDPR (effective since May 25, 2018) and upcoming AI regulation, SOV-3 is a central component of modern Compliance.

SOV-4: Operational Sovereignty

Operational sovereignty means being able to continue operating or migrating a service without the original provider:

• Exit capability through documented runbooks, standardized exports, and open interfaces
• EU-based teams for operation and support with the necessary skills
• Complete technical documentation, from architecture to runbooks
• Transparency over critical subcontractors and their jurisdiction

Operational sovereignty creates the decision-making freedom needed in long-term platform partnerships.

SOV-5: Supply Chain Sovereignty

This focuses on the supply chain:

• Traceability of the origin of hardware, firmware, and embedded code
• Complete SBOMs and clear update paths under EU control
• Minimization of critical non-EU dependencies, documented alternatives
• Auditability along the entire supply chain

SOV-5 links digital sovereignty with classic supply chain resilience.

SOV-6: Technology Sovereignty

Technological sovereignty addresses openness and interoperability:

• Use of open, standardized APIs and protocols
• Open-source components with audit, modification, and redistribution rights
• Transparency over architecture, data flows, and dependencies
• Portability of workloads and data with minimal lock-in

Especially for modern platform strategies around Kubernetes, data platforms, or AI stacks, SOV-6 is crucial.

SOV-7: Security & Compliance Sovereignty

Security and compliance are viewed here from a sovereignty perspective:

• Relevant EU certifications (such as ISO 27001, future ENISA schemes)
• Implementation of GDPR, NIS2 (effective October 18, 2024), and sector-specific regulations like DORA (applicable from January 17, 2025)
• Security operations and incident response teams in the EU
• Customer access to security logs, alerts, and reports
• Independent audits with transparent results

SOV-7 bridges the gap between cloud sovereignty and modern Compliance.

SOV-8: Environmental Sustainability

Sustainability is explicitly part of the sovereignty understanding:

• Energy-efficient data centers (PUE), use of renewable energies
• Concepts for circular economy in hardware
• Transparent metrics on emissions, water consumption, and energy
• Long-term operational viability under climate scenarios

The framework thus addresses the question of whether a service is not only secure today but also operationally sustainable tomorrow.

SEAL Levels: Sovereignty as Measurable Stages

The Sovereignty Effective Assurance Levels (SEAL) define how far a provider fulfills a sovereignty objective. They serve as a common “currency” between procurers and providers.

In practice, they can be interpreted as follows:

• SEAL-1 – Basic Transparency:
  Initial measures and documentation are present but still have significant gaps. Suitable for non-critical workloads.

• SEAL-2 – Basic Protection with EU Focus:
  Essential sovereignty aspects are implemented, extraterritorial risks partially addressed, processes are established but not yet fully auditable.

• SEAL-3 – High Sovereignty Level:
  Clear EU jurisdiction, largely EU-based operations, reliable evidence. Risks from non-EU dependencies are significantly reduced but still present.

• SEAL-4 – Complete Digital Sovereignty:
  Consistent sovereignty across all relevant contributing factors of an objective, including legal, technical, operational, and organizational measures. Evidence is auditable, processes are established and tested.

• SEAL-5 – Strategic Sovereignty at Ecosystem Level:
  Sovereignty is anchored not only at the service level but at the entire value chain and ecosystem level. This stage will be particularly relevant for especially critical infrastructures in the future.

Important: SEAL levels are awarded per sovereignty objective. A provider can, for example, achieve SOV-3 (Data & AI) at SEAL-4, while SOV-8 (Environmental) only fulfills SEAL-2.

SEAL-4: What Complete Digital Sovereignty Looks Like

SEAL-4 is the target state for many organizations – especially where sensitive or critical workloads are operated. From a technical and organizational perspective, this means:

• SOV-1 (Strategic):
  Ownership and control structures are EU-based, change-of-control risks from non-EU takeovers are addressed contractually and through corporate governance.

• SOV-2 (Legal):
  EU law is the exclusive jurisdiction for the service. There are no ties to extraterritorial legal regimes, neither through corporate structures nor critical subcontractors.

• SOV-3 (Data & AI):
  All productive data resides in the EU; keys are fully under customer control (BYOK/BYOHSM). AI models, pipelines, and training data are auditable; deletion is technically and organizationally verifiable.

• SOV-4 (Operational):
  Exit scenarios are not only contractually agreed but practically tested. Documentation, data exports, and migration paths are available and realistically implementable.

• SOV-5 (Supply Chain):
  Critical hardware and software components are transparently documented, SBOMs are available. Non-EU components are minimized and their criticality assessable.

• SOV-6 (Technology):
  The platform relies on open standards, interoperable interfaces, and widely used open-source components. Workloads can be migrated to other infrastructures without proprietary formats.

• SOV-7 (Security & Compliance):
  Relevant standards are certified, security operations teams are based in the EU, logs and incidents are traceable for customers, audits are conducted regularly.

• SOV-8 (Environmental):
  Measurable goals and metrics for energy efficiency and emissions are available, externally reviewed, and continuously improved.

SEAL-4 is thus not a label but the result of a consistent interplay of technology, organization, law, and governance.

Role in Public Procurement Processes

The Cloud Sovereignty Framework was developed to provide public procurement agencies with a unified tool. In tenders, it can be clearly formulated:

1. Minimum Requirements:
   A minimum SEAL is set for each sovereignty objective (e.g., SEAL-4 for SOV-2 and SOV-3, SEAL-3 for SOV-8). Providers who cannot demonstrate this level are not further considered.

2. Award Criteria:
   SEAL levels exceeding the minimum requirements are weighted in the evaluation. Example: A provider with SOV-5 at SEAL-4 receives more points than a provider with SEAL-3, provided the added value is relevant to the project.

3. Evidence-Based Evaluation:
   Instead of self-disclosures, concrete evidence is required: certificates, architecture documents, legal opinions, exit runbooks, SBOMs, audit reports.

For providers, this creates clarity regarding investments: Those who demonstrably achieve SEAL-4 across multiple objectives are systematically better positioned for future tenders in the EU.

Also