Cloud Sovereignty Framework — Assessment tool

0.0Sovereignty score

Offer rejected

Evaluation code· · · · · ·

Saved

The minimum required SEAL level is not computed by the framework — it is a procurement policy decision, set by the contracting authority in the tender documents according to the criticality of the data and systems hosted (art. 2 of the document). Choose an indicative risk profile below to pre-fill starting thresholds per objective, to be validated and adjusted by you.

Risk profile of the system to be hosted

Indicative thresholds offered as a starting point — not taken from the source document, to be confirmed by the contracting authority for each objective.

How to assess a SEAL level?

For each objective, tick the contributing factors where the provider's situation is favourable to EU sovereignty (EU control, no non-EU dependency or exposure) — every criterion is phrased that way, so ticking is never a negative.
The tool computes a suggested SEAL level from the proportion of ticked criteria — a starting point, not an automatic verdict.
Read the definition of the suggested level (shown under the SEAL buttons) and adjust manually if a material weakness on a single factor justifies a lower level, or if the context justifies a higher one.

SEAL-0No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

SEAL-1Jurisdictional Sovereignty — EU law formally applies with limited practical enforceability; service, technology or operations under exclusive control of non-EU third parties.

SEAL-2Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL-3Digital Resilience — EU law applicable and enforceable, EU actors exercising meaningful but not full influence; service, technology or operations under marginal control of non-EU third parties.

SEAL-4Full Digital Sovereignty — Technology and operations under complete EU control, subject only to EU law, with no critical non-EU dependencies.

The automatic level suggestion is not an official method of the framework: it is decision support added by this tool.

SOV-1

Strategic Sovereignty

weight 15%

The degree to which the provider's services are anchored within the European Union legal, financial and industrial ecosystem: ownership stability, governance influence and alignment with EU strategic priorities.

Contributing factors — tick what is favourable to EU sovereignty (6)

Bodies having decisive authority over the services are located within EU jurisdiction
Assurances are in place against a change of control of the provider
The provider relies on financing coming from EU sources
Investment, jobs and value creation take place within the EU
Involvement in EU initiatives and consistency with digital, green and industrial sovereignty objectives defined at EU level
Ability to sustain secure operations if the service is requested to cease or vendor support is withdrawn or disrupted

Ticked criteria : 0/6 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-2

Legal & Jurisdictional Sovereignty

weight 10%

The legal environment, exposure to foreign authority and enforceability of the rights that govern the provider's services.

Contributing factors — tick what is favourable to EU sovereignty (5)

Operations and contracts are governed by an EU national legal system
No material exposure to non-EU laws with cross-border reach (e.g. US CLOUD Act, Chinese Cybersecurity Law)
No legal, contractual or technical channel through which non-EU authorities could compel access to data or systems
No applicable international regime restricting usage or transfer of the service
Intellectual property is created, registered and developed within EU jurisdiction

Ticked criteria : 0/5 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-3

Data & AI Sovereignty

weight 10%

Protection, control and independence of data assets and AI services within the EU: how data is secured, where it is processed, and the customer's autonomy over AI capabilities.

Contributing factors — tick what is favourable to EU sovereignty (5)

Only the customer, not the provider, has effective control over cryptographic access to the data
Visibility into when, where and by whom data is accessed, including auditability of AI model usage
Mechanisms guarantee irreversible removal of data, with verifiable evidence
Strict confinement of storage and processing to European jurisdictions, with no fallback to third countries
AI models and data pipelines are developed, trained, hosted and governed under EU control

Ticked criteria : 0/5 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-4

Operational Sovereignty

weight 15%

The practical ability of European actors to operate, maintain and evolve the technology independently of any foreign control.

Contributing factors — tick what is favourable to EU sovereignty (6)

Workloads can be migrated or integrated with alternative EU-controlled solutions without vendor lock-in
EU operators can manage, maintain and support the technology without non-EU vendor involvement
An EU-based talent pool exists with the expertise to operate and sustain the service
Operational support is delivered from within the EU and subject exclusively to EU legal frameworks
Full technical documentation, source code and operational know-how are available
Critical suppliers and subcontractors are located in and legally controlled by the EU

Ticked criteria : 0/6 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-5

Supply Chain Sovereignty

weight 20%

Geographic origin, transparency and resilience of the technology supply chain, and exposure to non-EU dependencies.

Contributing factors — tick what is favourable to EU sovereignty (5)

Key physical parts are manufactured or assembled in the EU, or have documented geographic traceability
Embedded code and firmware controlling hardware are developed under EU jurisdiction
Software is architected, programmed, packaged, distributed and updated under EU control
No material reliance on non-EU vendors, facilities or proprietary technologies
Full visibility into the supplier and sub-supplier chain, including audit rights

Ticked criteria : 0/5 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-6

Technology Sovereignty

weight 15%

Openness, transparency and independence of the underlying technology stack, enabling interoperability and audit without foreign proprietary lock-in.

Contributing factors — tick what is favourable to EU sovereignty (5)

Integration is possible through well-documented, non-proprietary APIs and protocols
The solution adheres to publicly governed and widely adopted standards
Software is accessible under open licenses, with rights to audit, modify and redistribute
Visibility into the design and functioning of the service, including architecture, data flows and dependencies
EU independence in high-performance computing, including processors, accelerators and software ecosystems

Ticked criteria : 0/5 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-7

Security & Compliance Sovereignty

weight 10%

The extent to which security operations, compliance obligations and resilience are governed within the EU.

Contributing factors — tick what is favourable to EU sovereignty (6)

EU and internationally recognised certifications are held (e.g. ISO, ENISA schemes)
Adherence to GDPR, NIS2, DORA and other EU frameworks
Security operations centres and response teams operate exclusively under EU jurisdiction
Transparent, timely and EU-compliant reporting of breaches and vulnerabilities
Security patches can be developed, tested and applied independently of non-EU vendors
EU entities can perform independent security and compliance audits with full access

Ticked criteria : 0/6 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

SOV-8

Environmental Sustainability

weight 5%

Long-term autonomy and resilience of cloud services regarding energy consumption, dependencies and raw material scarcity.

Contributing factors — tick what is favourable to EU sovereignty (4)

Energy-efficient infrastructure (e.g. low PUE) with measurable improvement targets
Circular economy practices: reuse, refurbishment and responsible end-of-life treatment of hardware
Transparent measurement and disclosure of carbon emissions, water usage and other sustainability indicators
Renewable or low-carbon energy powers the infrastructure and operations

Ticked criteria : 0/4 — suggested level : SEAL-0 (No Sovereignty)

Minimum required SEAL level

Data Sovereignty — EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.

SEAL level obtained (assessment)

No Sovereignty — Service, technology or operations under exclusive control of non-EU third parties, governed entirely in non-EU jurisdictions.

Score obtained (% of maximum — follows the ticked criteria, adjustable)

Below the required SEAL level

Summary

Objective	Required SEAL	Obtained SEAL	Score	Weight	Contribution
SOV-1 Strategic Sovereignty	SEAL-2	SEAL-0	0%	15%	0.0
SOV-2 Legal & Jurisdictional Sovereignty	SEAL-2	SEAL-0	0%	10%	0.0
SOV-3 Data & AI Sovereignty	SEAL-2	SEAL-0	0%	10%	0.0
SOV-4 Operational Sovereignty	SEAL-2	SEAL-0	0%	15%	0.0
SOV-5 Supply Chain Sovereignty	SEAL-2	SEAL-0	0%	20%	0.0
SOV-6 Technology Sovereignty	SEAL-2	SEAL-0	0%	15%	0.0
SOV-7 Security & Compliance Sovereignty	SEAL-2	SEAL-0	0%	10%	0.0
SOV-8 Environmental Sustainability	SEAL-2	SEAL-0	0%	5%	0.0
Overall sovereignty score					0.0%

The source document defines the 8 objectives, the SEAL levels, the contributing factors, the weights and the score formula. The checklist, the automatic level suggestion and the risk profiles are a decision-support layer added by this tool.