Menu
SEAL · EU Cloud Sovereignty Framework

Digital sovereignty

More and more organisations need to know which systems stay under European control, and how far that control has to go. clouds & more turns that question into a measurable architecture requirement instead of a debate.

The EU Cloud Sovereignty Framework

The European Commission’s framework (October 2025) scores cloud services on eight sovereignty objectives and places them on a Sovereignty Effective Assurance Level, from SEAL-0 to SEAL-4.

SEAL-0No sovereigntyExclusive non-EU control.
SEAL-1JurisdictionalEU law applies on paper; non-EU control remains.
SEAL-2Data sovereigntyEU law enforceable; indirect non-EU control.
SEAL-3Digital resilienceEU actors have real influence; marginal non-EU control.
SEAL-4Full digital sovereigntyComplete EU control, no critical non-EU dependencies.

Eight objectives

  • SOV-1 · Strategic
  • SOV-2 · Legal & jurisdictional
  • SOV-3 · Data & AI
  • SOV-4 · Operational
  • SOV-5 · Supply chain
  • SOV-6 · Technology
  • SOV-7 · Security & compliance
  • SOV-8 · Environmental sustainability

The approach

  1. Set the required level per system

    Business criticality and data classification set the minimum SEAL. A critical system or secret data needs SEAL-4.

  2. Test first, then compare

    The required SEAL is a pass-or-fail threshold. Only suppliers that pass are ranked on a weighted sovereignty score.

  3. As high as reasonably practicable

    Where full sovereignty cannot be reached today, such as chips and hardware supply, the gap is accepted formally, with compensating controls and an exit path.

  4. Into architecture and tenders

    The levels become concrete requirements, for example a security operations centre at SEAL-3 with a binding roadmap to SEAL-4.

Current engagement

  • Aug 2026 – presentEnergy · critical infrastructure
    Current

    IT Foundation Architect

    Dutch nuclear organisation

    • Defines the architecture of the new IT Foundation: workplace, datacenter, platform and network, plus a highly secure workplace and encryption services based on HSMs.
    • Translates the architecture into requirements for a five-lot tender: colocation, managed network, HSM, SOC/SIEM, and integrated IT services including AI infrastructure.
    • Builds in digital sovereignty from the start, based on the EU Cloud Sovereignty Framework. Each system’s required SEAL level follows from its business criticality and data classification, and suppliers must meet it.
    • IT Foundation
    • Digital sovereignty
    • SEAL
    • HSM
    • Tendering