An emerging four-level framework could reshape cloud procurement by making ownership and exposure to foreign laws central to provider selection.
The European Commission has proposed grading cloud and AI providers by ownership and control rather than server location. The shift could redefine how organizations assess the sovereignty of their digital infrastructure. The Cloud and AI Development Act, proposed June 3 and still moving through the European Parliament, would initially apply to public bodies. Its implications extend beyond the public sector: data stored in Europe may still be subject to foreign legal authority if the provider can be compelled by another country's laws.
Why data location no longer guarantees sovereignty
Existing EU rules did not address that exposure. According to Hogan Lovells, instruments such as the NIS2 cybersecurity directive and the AI Act manage security and risk but do not directly cover a provider’s exposure to foreign government laws. The proposal seeks to address this gap amid Europe’s reliance on a limited number of non-EU cloud providers
For buyers, the gap matters because location answers only one of three questions about control: where data sits, who operates the service and whose law can compel the provider. The third is where location fails. The U.S. CLOUD Act lets American authorities compel disclosure of data held by U.S.-controlled providers, and the law firm William Fry notes that no volume of technical safeguards cures a control problem created by the provider’s incorporation.
A Four-Tier Framework for Cloud Sovereignty
The proposal turns those three questions into four assurance levels. According to law-firm analyses, Level 1 largely requires that infrastructure and customer data stay in the European Union, a condition William Fry says major U.S. providers operating in European regions can meet.
Level 2 adds EU-based operations, software supply-chain transparency and safeguards against third-country access. Level 3 requires EU ownership and control, with a narrow exception for providers from recognized countries. Level 4 goes further, restricting outside-country influence over software design and maintenance.
Public bodies would assess individual workloads and procure services at the corresponding level. This makes procurement requirements a central mechanism for shaping the market, rather than imposing a blanket ban on foreign providers. In April, the Commission awarded a €180 million sovereign-cloud contract to four providers, under a related but separate framework.
Geopolitical Pressures Reshape Europe’s Cloud Strategy
On June 12, nine days after the proposal, a U.S. export-control directive led Anthropic to suspend two of its most advanced AI models for all customers worldwide, because it could not verify users’ nationality in real time. The controls were lifted June 30 and access returned July 1.
The episode did not trigger the EU proposal, but it illustrated the risk behind its approach: services supplied by a foreign provider can become unavailable following a decision by another country's government, potentially without warning to European customers.
That risk matters only if buyers can respond to it. The EU Data Act’s switching rules have applied since Sept. 12, 2025, letting customers begin moving providers on two months’ notice, and all switching charges must be eliminated by Jan. 12, 2027. Moving a workload to a provider at a higher level therefore becomes legally easier and cheaper.
Ownership and Legal Control Challenge Cloud Providers
Provider responses test how far the ladder reaches. Amazon Web Services opened a European Sovereign Cloud in January, run by German entities, staffed by EU residents and physically and logically separate from its other regions. These measures address operational control and data separation, but do not necessarily satisfy the proposal’s higher ownership requirements.
William Fry concludes that U.S.-controlled providers cannot meet Levels 3 and 4 without significant restructuring. That is an interpretation of a draft, and the final text could change it.
The strain runs the other way too. CISPE, a trade group of European cloud providers, argues that most independent providers cannot meet the conditions and that dependence on U.S. technology could grow, while CCIA Europe calls the approach discriminatory. A Parliament committee is not expected to present a draft report until Dec. 1, with a vote planned for mid-March; therefore, the levels remain negotiable, and William Fry considers adoption unlikely before 2027.
What could buyers do next
The emerging framework points toward workload-based assessment rather than wholesale provider migration. William Fry concludes that most routine public-sector cloud demand remains open to incumbent providers, and Hogan Lovells notes that the proposal lets global hyperscalers keep participating under stricter obligations.
Gartner’s forecast is consistent: it expects about one-fifth of existing workloads to shift from global to local providers. Executives should therefore identify which workloads touch sensitive functions, ask which providers can legally be compelled to act on them, and confirm that contracts allow an exit before switching charges end.
“Sovereign enough” depends on ownership and legal exposure, judged workload by workload. The proposal may change, and Gartner’s forecast suggests most existing workloads will stay where they are. What has shifted is the question buyers will be expected to answer.
