Omdia says EU cloud sovereignty policy is moving beyond data residency

The report, Digital Sovereignty: AI & cloud policies and regulatory frameworks, says policymakers increasingly accept that complete technological self-sufficiency is impossible because supply chains are global. The aim instead is strategic agency and informed decision-making, Omdia said. The proposed Cloud and AI Development Act, announced in June 2026, focuses on giving the EU the capacity, infrastructure and governance mechanisms needed to maintain technological autonomy.

What CADA would change

CADA would establish a four-level sovereignty framework for cloud services used by EU institutions and public-sector organizations, InfoWorld reported. The most sensitive workloads, including justice and law enforcement, would have to run on services at higher assurance levels. The proposal is not a blanket ban: it carves out exceptions where compliant services do not exist, InfoWorld reported.

Google Cloud said criteria at each of the four Union Assurance Levels "would limit or exclude global providers, regardless of the security mitigations they offer". In a blog post, the company argued that regulations should leave room for technical controls instead of rigid geographic criteria.

The scoring model already in use

The European Commission's Cloud Sovereignty Framework already gives procurement teams a scoring model, Startup Fortune reported. It assesses providers across categories including legal and jurisdictional sovereignty, data and AI sovereignty, operational sovereignty, supply chains, technology, security and compliance, and strategic considerations, according to Cloud Computing News. The framework separates where data is stored from whether EU-based operators can manage, maintain and support a service without non-EU vendor involvement.

The framework uses Sovereignty Effectiveness Assurance Levels, or SEALs. SEAL-2 is treated as a minimum data sovereignty level and SEAL-3 points to stronger digital resilience, Startup Fortune reported. In the Commission's April 2026 sovereign cloud tender, most winning providers reached SEAL-3, while the Proximus consortium reached SEAL-2 through a structure that uses Google Cloud technology in an environment operated by European companies, Startup Fortune reported.

The Commission awarded sovereign cloud contracts worth up to EUR 180 million over six years in April 2026 to providers including a Post Telecom partnership with OVHcloud and CleverCloud, Germany's STACKIT, Scaleway and a Proximus-led consortium, Startup Fortune reported. Proximus said it was selected alongside three other suppliers for a six-year framework covering the Commission, Parliament, Council, the External Action Service and 70 European agencies. Its bid lists S3NS, Clarence, Mistral and Thales.

Google Cloud cited that partner stack in its blog post. It said the S3NS offering in France has been qualified to SecNumCloud 3.2, and that Clarence and S3NS, together with Mistral, have been approved by the Commission's Directorate-General for Digital Services for EU institutions with sovereign cloud needs.

AWS, Microsoft and Google control roughly 70% of Europe's cloud infrastructure market, leaving the public sector exposed to overseas laws, mostly American ones, InfoWorld reported.

What happens next

Omdia said clear guidance on AI and cloud sovereignty requirements is largely absent, even as sovereignty appears on more government agendas. Google Cloud has asked the Commission to change elements of CADA to avoid what it called "unintended market isolation".