{"id":29869,"date":"2026-07-09T11:53:29","date_gmt":"2026-07-09T11:53:29","guid":{"rendered":"https:\/\/www.nlighten.com\/?post_type=blog&p=29869"},"modified":"2026-07-10T14:52:19","modified_gmt":"2026-07-10T14:52:19","slug":"the-eu-cloud-sovereignty-framework-explained-seal-levels-sovereignty-objectives-and-the-sovereignty-score","status":"publish","type":"blog","link":"https:\/\/www.nlighten.com\/en\/blog\/the-eu-cloud-sovereignty-framework-explained-seal-levels-sovereignty-objectives-and-the-sovereignty-score\/","title":{"rendered":"The EU Cloud Sovereignty Framework Explained: SEAL Levels, Sovereignty Objectives, and the Sovereignty Score"},"content":{"rendered":"\n

The EU Cloud Sovereignty Framework is the European Commission\u2019s method for assessing how sovereign a cloud service actually is.<\/strong> It scores providers against eight Sovereignty Objectives using a five-level scale called SEAL (Sovereignty Effectiveness Assurance Level, 0 to 4), and combines the results into a weighted Sovereignty Score used in public procurement. Published by the Commission\u2019s Directorate-General for Digital Services (version 1.2.1, October 2025), it is fast becoming the common language for sovereignty claims across the European cloud and infrastructure market.<\/p>\n

This guide explains how the framework works, how the scoring logic behaves in a real tender, and how buyers can use it to evaluate any provider. It also corrects the most common misunderstandings, because sovereignty claims are about to get noisy. This article is based on the official Cloud Sovereignty Framework, Version 1.2.1 (European Commission, 20 October 2025)<\/a>.<\/p>\n

What is the EU Cloud Sovereignty Framework?<\/h2>\n

The framework defines what sovereignty means in practical, assessable terms for cloud services procured by EU institutions. It draws on existing European initiatives including CIGREF\u2019s Trusted Cloud referential, Gaia-X policy rules, and the EU cybersecurity certification landscape (ENISA, NIS2, DORA), as well as national strategies such as France\u2019s Cloud de Confiance and Germany\u2019s Souver\u00e4ner Cloud.<\/p>\n

Its core insight: sovereignty is not one thing. A provider can be strong on operational independence and weak on ownership structure, or strong on data control and weak on supply chain. The framework breaks sovereignty into eight measurable objectives and scores each one separately.<\/p>\n

The eight Sovereignty Objectives<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n
#<\/th>\nObjective<\/th>\nWhat it measures<\/th>\nWeight<\/th>\n<\/tr>\n<\/thead>\n
SOV-1<\/td>\nStrategic Sovereignty<\/td>\nWhere decisive authority, ownership, and financing sit, and how stable that is<\/td>\n15%<\/td>\n<\/tr>\n
SOV-2<\/td>\nLegal & Jurisdictional Sovereignty<\/td>\nExposure to non-EU laws with cross-border reach, such as the US CLOUD Act, and whether foreign authorities could compel access<\/td>\n10%<\/td>\n<\/tr>\n
SOV-3<\/td>\nData & AI Sovereignty<\/td>\nWho controls cryptographic access to data, where processing runs, and how independent AI capabilities are<\/td>\n10%<\/td>\n<\/tr>\n
SOV-4<\/td>\nOperational Sovereignty<\/td>\nWhether EU actors can run, support, and evolve the service without non-EU involvement<\/td>\n15%<\/td>\n<\/tr>\n
SOV-5<\/td>\nSupply Chain Sovereignty<\/td>\nWhere hardware and software are designed, built, packaged, and distributed, and how transparent the supplier chain is<\/td>\n20%<\/td>\n<\/tr>\n
SOV-6<\/td>\nTechnology Sovereignty<\/td>\nOpenness of the stack: standards, open licensing, auditability, and freedom from vendor lock-in<\/td>\n15%<\/td>\n<\/tr>\n
SOV-7<\/td>\nSecurity & Compliance Sovereignty<\/td>\nEU-controlled security operations, certifications, and alignment with GDPR, NIS2, and DORA<\/td>\n10%<\/td>\n<\/tr>\n
SOV-8<\/td>\nEnvironmental Sustainability<\/td>\nEnergy efficiency, renewable sourcing, circularity, and transparent sustainability reporting<\/td>\n5%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Supply chain carries the heaviest weight at 20%, a signal that the Commission considers hardware and software provenance the hardest and most consequential sovereignty problem.<\/p>\n

The SEAL scale: five levels of assurance<\/h2>\n

Each objective is scored on the Sovereignty Effectiveness Assurance Level scale:<\/p>\n\n\n\n\n\n\n\n\n\n
Level<\/th>\nName<\/th>\nWhat it means<\/th>\n<\/tr>\n<\/thead>\n
SEAL-0<\/td>\nNo Sovereignty<\/td>\nThe service is under exclusive non-EU control and governed entirely outside EU jurisdiction<\/td>\n<\/tr>\n
SEAL-1<\/td>\nJurisdictional Sovereignty<\/td>\nEU law formally applies, but enforceability is limited and control remains with non-EU parties<\/td>\n<\/tr>\n
SEAL-2<\/td>\nData Sovereignty<\/td>\nEU law applies and is enforceable, but material non-EU dependencies remain<\/td>\n<\/tr>\n
SEAL-3<\/td>\nDigital Resilience<\/td>\nEU actors exercise meaningful, though not full, influence, with only marginal non-EU control<\/td>\n<\/tr>\n
SEAL-4<\/td>\nFull Digital Sovereignty<\/td>\nComplete EU control, subject only to EU law, with no critical non-EU dependencies<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

A crucial nuance: a provider does not have one SEAL level. It has eight<\/strong>, one per objective, assessed in the context of a specific procurement.<\/p>\n

How the scoring works in a real tender<\/h2>\n

Two mechanisms operate together, and understanding the difference matters more than anything else on this page.<\/p>\n

First, SEAL levels act as minimum floors.<\/strong> The tender sets a required minimum level for each objective. A provider that falls below the floor on even one objective is rejected outright, regardless of how strong every other score is. The weakest objective, not the average, decides whether a bid survives.<\/p>\n

Second, the Sovereignty Score ranks the survivors.<\/strong> For bids that clear every floor, a weighted percentage is calculated across all eight objectives using the weights above. That score feeds into the tender\u2019s quality evaluation as an award criterion.<\/p>\n

The practical consequence: a headline percentage is meaningless on its own. A provider scoring 70% overall but failing one floor loses to a provider scoring 55% that clears them all.<\/p>\n

What the framework is not<\/h2>\n

This is where most early claims in the market go wrong.<\/p>\n

There is no SEAL certificate.<\/strong> No accreditation body issues SEAL ratings. An official assessment only exists when a contracting authority scores a provider inside a real procurement procedure.<\/p>\n

\u201cWe are SEAL-3\u201d is not a valid claim.<\/strong> Without naming the objective and the procurement context, a single-number SEAL claim has no defined meaning under the framework. Treat any vendor leading with one as a signal to ask harder questions.<\/p>\n

Geography is not sovereignty.<\/strong> The framework scores jurisdiction and control, not the location of servers or the branding on the building. Infrastructure in Frankfurt does not make a service sovereign if decisive authority over it sits outside the EU.<\/p>\n

Self-assessments are not assessments.<\/strong> They are useful preparation, for providers and buyers alike, but only an assessment by a contracting authority produces an official result.<\/p>\n

How buyers can use the framework outside public tenders<\/h2>\n

Although built for EU procurement, the framework is the most rigorous free tool available for evaluating any cloud or infrastructure provider\u2019s sovereignty posture. Enterprises in regulated sectors can apply the same logic:<\/p>\n