Europe Sovereign Cloud Scorecard With Jurisdiction and Exit Checks for AI
Europe sovereign cloud providers mostly describe their own sovereignty when they compete for a contract. Government agencies and companies send cloud providers a request for proposal (RFP). Each provider answers with a written offer called a bid, and the buyer scores the answers.
The European Commission's Cloud Sovereignty Framework gives buyers a way to score those bids. It asks providers about vendor lock-in and their exposure to the US CLOUD Act, a law that lets US authorities demand data from companies under US jurisdiction. Providers answer these questions themselves, and the Commission's implementation guidance says checking their answers takes significant effort.
The framework grades each bid with a Sovereignty Effectiveness Assurance Level (SEAL), from SEAL-0 to SEAL-4, where a higher level means more EU control over the service. A bid's SEAL equals its lowest grade across the framework's eight categories, so one weak area caps the result.
This scorecard adds two checks to the framework score:
- Written jurisdiction answer: each provider states in writing whether US authorities can make its parent company hand over your data.
- Dated exit terms: each provider gives dated terms for leaving its service under the EU Data Act, which sets rules for switching cloud providers.
The scorecard runs in four steps:
| Step | What to request from each provider | What the scorecard holds at the end |
|---|---|---|
| 1. Set a minimum sovereignty level per workload | The buyer writes this requirement into the RFP before the bid deadline | One minimum level for each type of workload |
| 2. Score the eight categories | An answer per category naming the provider's method | An eight-row table of scores per provider |
| 3. Get a written jurisdiction answer | A written legal position on US jurisdiction | A jurisdiction column kept outside the framework score |
| 4. Add Data Act exit terms | Dated answers on notice period, migration timeline, export formats and switching charges | Four dated exit answers per provider |
How the Commission's Sovereignty Framework Scores a Bid
The Commission's explainer describes two complementary scores:
- SEAL: the pass mark. The buyer sets a minimum level, and bids below it drop out of the comparison.
- Overall sovereignty score: a weighted score built from 48 criteria in eight categories, used to compare bids that reach the minimum level.
The implementation guidance describes the eight categories:
- Strategic: the EU or EEA anchoring of the provider's ownership, decision-making and financing.
- Legal and jurisdictional: the legal system governing the provider and its exposure to non-EU laws such as the US CLOUD Act.
- Data and AI: control of encryption keys, the location of data processing and the governance of AI models and pipelines.
- Operational: whether EU staff can run and support the service, and how easily workloads move to another provider.
- Supply chain: the origin of hardware, firmware and software, and the buyer's right to audit suppliers.
- Technology: open APIs, open standards, open licensing and European independence in high-performance computing.
- Security and compliance: certifications, EU-based security operations and the buyer's audit rights.
- Environmental sustainability: energy efficiency, hardware reuse, emissions disclosure and low-carbon power.
1. Set a Minimum Sovereignty Level for Each Workload in the RFP
The Commission's implementation guidance has the buyer fix a minimum level first and then compare qualifying bids on the sovereignty score. Its own tender set SEAL-2 as that minimum. Choose a minimum for each type of workload, such as citizen records or model training, from the framework's upper levels:
- SEAL-2, Data Sovereignty: EU law applies, and non-EU parties keep indirect control of the service, technology or operations.
- SEAL-3, Technological Sovereignty: EU actors hold meaningful influence, with marginal non-EU control.
- SEAL-4, Full Digital Sovereignty: the technology and operations stay under EU control and EU jurisdiction alone.
The same guidance calls SEAL-4 not relevant today, because the EU still depends on non-EU chips and hardware. Data center GPUs come from outside the EU. A SEAL-4 minimum would likely leave an AI tender without a qualifying bid.
2. Score Each Provider's Sovereignty Answers in the Eight Categories
Give each provider one row per category. An answer scores above zero when it says how the provider delivers the claim, by naming a specific control, contract, architecture or process. "Encryption keys stay in a hardware security module the customer owns" counts as that kind of answer.
Score zero for an answer like "data is protected under European law," because it doesn't say which entity, contract or control provides the protection. Apply the same test to staff claims, and treat a security-clearance claim as evidence when the bid names the clearing authority and the clearance level.
This proof test sits on top of the Commission's assessment calculator, which scores each answer from a set of proposed responses. The control-dependency checklist applies the same test from operator access through data residency.
3. Get a Written US Jurisdiction Answer From Each Provider
The US Department of Justice explains the CLOUD Act this way: a company under US jurisdiction can be required to produce data it controls, regardless of the data's location. Courts apply that control test to the facts of each case, according to a Georgetown Law analysis of "possession, custody, or control".
Ask each provider to name its ultimate parent company, the entity that holds your data and its response to a US order for that data. Keep the answer in its own column, outside the framework score. A separate column keeps a weak legal answer in view, since the overall sovereignty score blends it with seven other categories.
French MP Philippe Latombe argues, in remarks reported by Eliatra, that a US-owned cloud can't be sovereign because of FISA and CLOUD Act exposure. We haven't found a published court ruling that tests the CLOUD Act against a European sovereign cloud with a US owner. The buyer works from the provider's written legal position until a court rules on that question.
A Worked Example From One Large Cloud Provider's Sovereignty Claims
AWS publishes enough about its European sovereignty offering to fill four rows of the scoring table, through its European digital sovereignty page and its European Sovereign Cloud launch announcement.
| Framework category | AWS mechanism | Open question for the buyer |
|---|---|---|
| Operational | Dedicated Local Zones in a customer-specified location, with an option to enforce security clearance on local AWS operating staff | Which authority grants the clearances, and at what level |
| Data and AI | AI Factories, where the customer supplies the data center and power and AWS deploys and manages the AI infrastructure | Who holds the encryption keys and administrator access |
| Security and compliance | More than 100 services certified under the CISPE Code of Conduct and more than 245 digital sovereignty controls in AWS Control Tower | Coverage of those services and controls in the bid |
| Legal and jurisdictional | A German parent company with three German subsidiaries led by EU citizens, plus commitments to redirect, notify and challenge government data requests | Whether those commitments hold against a US order to the US parent |
AWS earns a score in the legal and jurisdictional row. Its launch announcement names the German company structure, and DatacenterDynamics reported its commitments on government data requests from a November 2025 whitepaper. Record the open question in that row under Step 3.
4. Add Dated Data Act Exit Terms to the Sovereign Cloud RFP
Microsoft closed Microsoft Cloud Germany on 29 October 2021, three years after it stopped taking new customers. In that service, T-Systems controlled access to customer data as a German data trustee. Its customers had to move their workloads, and exit terms set the timeline and cost of that kind of move.
The EU Data Act has applied its cloud-switching rules since 12 September 2025. Ask each provider for a dated, written answer on four terms:
- Notice period: the Data Act caps the notice a contract can require at two months; get the figure from the provider's contract.
- Migration timeline: the Act sets a transitional period of 30 calendar days, extendable to seven months when the provider justifies technical unfeasibility; ask for the provider's commitment.
- Export formats: ask which formats the provider offers for exporting your data and digital assets.
- Switching charges: charges can't exceed the costs directly linked to the switch until 12 January 2027, then fall to zero. Request the provider's charges up to that date.
Treat a bid that leaves these terms blank as missing its exit plan, whatever its sovereignty grade.
When to Recheck the Sovereignty Scorecard
Recheck the scorecard at three points:
- Framework revision: the Commission's implementation guidance lists limits it plans to address in later versions, including the reliance on self-declared answers.
- First CLOUD Act ruling on a European sovereign cloud: a court decision would give the Step 3 answers a legal test.
- 12 January 2027: Data Act switching charges end, so bids priced with switching charges need new figures.
Providers that clear the scorecard go on to the next step for shortlisted providers, a head-to-head comparison.
Zettabyte runs its Sovereign AI Data Centers service on a Build-Operate-Train-Transfer (BOTT) model, which ends with a handover phase that trains local staff to take over the assets and operations. Zettabyte's bids go through the same scorecard as other providers' bids.