November 4, 2026

Newsletter

The European Post

Policy • Diplomacy • strategic insight

LATEST
Infringement Procedures Hit Ten Year High In Commission ReviewGreen Claims Directive Withdrawn After Three Years Of StalemateEU Customs Reform Puts Parcel Handling Fee On 1 November ClockEuro Area Inflation Hits 4.0 percent In October As Energy Costs Jump 20.8 percentBaltic Sea Fishing Opportunities Rise For Herring And Sprat In 2027Brussels Convenes Ukraine Reconstruction Talks Before Abu Dhabi RoundBeijing Consensus Points Leave EU China Trade Talks Short On DetailEhler Compromise Reshapes European Competitiveness FundRescuers Gather At European Civil Protection Forum 2026Political Advertising Regulation Faces Its First Year ReviewRibera Races To Finalise EU Merger Guidelines Before Year EndEDIP Call For Ukraine Closes 10 November With 180 Million EurosReturn Hubs Enter EU Law Under The EU Return Regulation 2026Condom Recall Tests Europe’s Single Market Safety NetT-MED Investment Platform Backs Mediterranean Clean PowerDrug Precursors Regulation Faces Key Committee VoteWorkers Rights Row Stalls EU Inc Ahead Of Pencilled 5 November VoteDigital Networks Act Draft Report Sets Up Fight Over Traffic FeesWestern Balkans Growth Plan Faces Test Before Brussels SummitEU Delegations Network Reform Thins Ten Missions Before Budget TalksInfringement Procedures Hit Ten Year High In Commission ReviewGreen Claims Directive Withdrawn After Three Years Of StalemateEU Customs Reform Puts Parcel Handling Fee On 1 November ClockEuro Area Inflation Hits 4.0 percent In October As Energy Costs Jump 20.8 percentBaltic Sea Fishing Opportunities Rise For Herring And Sprat In 2027Brussels Convenes Ukraine Reconstruction Talks Before Abu Dhabi RoundBeijing Consensus Points Leave EU China Trade Talks Short On DetailEhler Compromise Reshapes European Competitiveness FundRescuers Gather At European Civil Protection Forum 2026Political Advertising Regulation Faces Its First Year ReviewRibera Races To Finalise EU Merger Guidelines Before Year EndEDIP Call For Ukraine Closes 10 November With 180 Million EurosReturn Hubs Enter EU Law Under The EU Return Regulation 2026Condom Recall Tests Europe’s Single Market Safety NetT-MED Investment Platform Backs Mediterranean Clean PowerDrug Precursors Regulation Faces Key Committee VoteWorkers Rights Row Stalls EU Inc Ahead Of Pencilled 5 November VoteDigital Networks Act Draft Report Sets Up Fight Over Traffic FeesWestern Balkans Growth Plan Faces Test Before Brussels SummitEU Delegations Network Reform Thins Ten Missions Before Budget Talks
November 4, 2026

Newsletter

The European Post

Policy • Diplomacy • strategic insight

LATEST
Infringement Procedures Hit Ten Year High In Commission ReviewGreen Claims Directive Withdrawn After Three Years Of StalemateEU Customs Reform Puts Parcel Handling Fee On 1 November ClockEuro Area Inflation Hits 4.0 percent In October As Energy Costs Jump 20.8 percentBaltic Sea Fishing Opportunities Rise For Herring And Sprat In 2027Brussels Convenes Ukraine Reconstruction Talks Before Abu Dhabi RoundBeijing Consensus Points Leave EU China Trade Talks Short On DetailEhler Compromise Reshapes European Competitiveness FundRescuers Gather At European Civil Protection Forum 2026Political Advertising Regulation Faces Its First Year ReviewRibera Races To Finalise EU Merger Guidelines Before Year EndEDIP Call For Ukraine Closes 10 November With 180 Million EurosReturn Hubs Enter EU Law Under The EU Return Regulation 2026Condom Recall Tests Europe’s Single Market Safety NetT-MED Investment Platform Backs Mediterranean Clean PowerDrug Precursors Regulation Faces Key Committee VoteWorkers Rights Row Stalls EU Inc Ahead Of Pencilled 5 November VoteDigital Networks Act Draft Report Sets Up Fight Over Traffic FeesWestern Balkans Growth Plan Faces Test Before Brussels SummitEU Delegations Network Reform Thins Ten Missions Before Budget TalksInfringement Procedures Hit Ten Year High In Commission ReviewGreen Claims Directive Withdrawn After Three Years Of StalemateEU Customs Reform Puts Parcel Handling Fee On 1 November ClockEuro Area Inflation Hits 4.0 percent In October As Energy Costs Jump 20.8 percentBaltic Sea Fishing Opportunities Rise For Herring And Sprat In 2027Brussels Convenes Ukraine Reconstruction Talks Before Abu Dhabi RoundBeijing Consensus Points Leave EU China Trade Talks Short On DetailEhler Compromise Reshapes European Competitiveness FundRescuers Gather At European Civil Protection Forum 2026Political Advertising Regulation Faces Its First Year ReviewRibera Races To Finalise EU Merger Guidelines Before Year EndEDIP Call For Ukraine Closes 10 November With 180 Million EurosReturn Hubs Enter EU Law Under The EU Return Regulation 2026Condom Recall Tests Europe’s Single Market Safety NetT-MED Investment Platform Backs Mediterranean Clean PowerDrug Precursors Regulation Faces Key Committee VoteWorkers Rights Row Stalls EU Inc Ahead Of Pencilled 5 November VoteDigital Networks Act Draft Report Sets Up Fight Over Traffic FeesWestern Balkans Growth Plan Faces Test Before Brussels SummitEU Delegations Network Reform Thins Ten Missions Before Budget Talks

Cloud Sovereignty Framework Ranks Providers in Four Tiers

Erika Salumäe
Senior Analyst, Digital and Technology

The cloud sovereignty framework proposed by the Commission would sort every cloud provider that serves a public authority into one of four assurance levels, and it has become the most contested part of the new Cloud and AI Development Act. The Commission tabled the regulation on 3 June 2026 as part of its tech sovereignty package. Legal analysis published on 11 June expects the framework to dominate trilogue talks between the Council and the European Parliament.

How the cloud sovereignty framework works

Under the cloud sovereignty framework, Level 1 sets the baseline for almost every provider serving the public sector. Infrastructure, assets and customer data must sit in the EU, and a provider controlled from outside the Union must promise not to report unexploited vulnerabilities to third-country authorities.

Level 2 requires that all staff, infrastructure and assets that operate the service sit in the EU. It also relies on an EU cloud certification scheme that has not yet been finalised, and it demands a software bill of materials, source code audits of third-country components and a separation between EU parent companies and non-EU subsidiaries.

Level 3 requires EU ownership and control. The only exception would apply if the Commission recognises a third country that holds a GDPR adequacy decision, cannot compel providers to disrupt service and keeps its own market open to EU cloud firms. Level 4 goes further: no third-country control of any kind, a high-assurance European cybersecurity certificate, and no outside influence over the design, development or maintenance of the software.

Which public bodies face the strictest tiers

Higher levels would apply to providers that help preserve public order in sectors covered by the NIS2 Directive, such as energy, healthcare, transport and water, and to national security, border management, law enforcement and defence. Member states and EU bodies would run risk assessments, using a template from the Commission, and the Commission could set assurance levels for specific public activities through secondary legislation.

The cloud sovereignty framework hands governments real discretion. A hospital system could face a different tier from a ministry of culture, and two member states could classify the same service differently. Cloud customers will need clear guidance to avoid a patchwork that undermines the single market.

Procurement, data centres and open source

The cloud sovereignty framework does not stand on assurance levels alone. In cloud and AI tenders, contracting authorities must weigh a criterion called Union added value, which covers contributions to the EU digital supply chain, use of EU-developed technology and EU-designed hardware. Law firm analysis stresses that this criterion must stay ancillary rather than decisive, and that the recitals point to a ceiling of 15 out of 120 points.

Each member state must designate at least one data centre acceleration zone, with streamlined permitting and a 12-month limit for granting permits. The Commission may label some projects as strategic and give them preferential access to EU funding. The text favours brownfield over greenfield sites and attaches grid and sustainability conditions.

An open source requirement completes the package. EU bodies must encourage open standards and components, publicly developed software will enter a central EU catalogue, and a network of open source programme offices will support it. The Commission’s open source strategy states that the EU spends 264 billion euro a year on US proprietary IT products and services.

Why the cloud sovereignty framework divides the market

The Commission justifies the proposal by pointing to the shrinking share of EU-based providers, which fell from about 29% of the European cloud market in 2017 to around 15% by 2022. It also cites a growing shortage of data centre capacity that holds back AI deployment.

Those arguments carry weight, yet the trade-offs are sharp. Strict ownership rules under the cloud sovereignty framework could exclude hyperscalers that already serve European governments, raise prices for public buyers and slow digital projects. Looser rules could leave the sovereignty promise empty. Member states with large public cloud contracts will push for flexibility, while those with national champions will demand firmer tiers.

The practical test comes in the trilogue room. Negotiators must decide whether Level 3 and Level 4 become the default for sensitive services or remain exceptions, and whether certification arrives in time to give the cloud sovereignty framework credible teeth. Providers should map their ownership and control structures now, because the final assurance levels will define who can bid for Europe’s public cloud contracts.

Comments