Nobody reached the top of the EU's sovereignty scale and the Belgian winner came in at the floor.
The framework defines that floor as leaving material non-EU dependencies in place, with the service under indirect control of non-EU third parties. The press release calls it abiding by EU law.
The Commission has published the rubric it used to buy cloud, invited everybody else to use it, and the useful thing in it is not the part that made the news.
The verdict first, because that is what this column is for. If you are buying cloud in the next eighteen months, take the framework. It is six pages, it is free, it turns an argument you cannot win into a table you can put in a tender document, and the Commission has said in terms that any organisation wishing to adopt its approach is welcome to. I have read a great many sovereignty claims and this is the first instrument I have seen that makes a vendor answer them in a form you can score.
Then read the definitions yourself, because the press release is kinder than the document.
The scale, in the words of the thing that defines it
Five levels. The Commission's announcement describes SEAL-2, the level a bidder had to reach to be eligible at all, as meaning providers "abide by the EU laws and regulations without requiring additional technical measures by the customer to protect its data".
The framework defines the same level like this:
SEAL-2 Data Sovereignty: EU law applicable and enforceable, with material non-EU dependencies remaining; service, technology or operations under indirect control of non-EU third parties.
Those are not the same sentence. One describes a floor you would be content to sit on. The other says material non-EU dependencies remain and the thing is under indirect foreign control, which is a description of the problem, written as a passing grade.
SEAL-3, which three of the four winners reached, is "EU actors exercising meaningful but not full influence" with the service "under marginal control of non-EU third parties". SEAL-4 is complete EU control, no critical non-EU dependencies, chips upward.
Nobody got SEAL-4. Post Telecom with CleverCloud and OVHcloud reached SEAL-3. STACKIT reached SEAL-3. Scaleway reached SEAL-3. The Proximus consortium, with S3NS, Clarence and Mistral on a technical environment based on Google Cloud technology, reached SEAL-2.
That last one is the one a Belgian buyer is most likely to shortlist, and it is the one sitting on the floor of the scale.
To be fair to it, which the Commission is: the environment is exclusively operated by EU companies, and the announcement draws the honest conclusion that non-European technology under a strict enough framework can clear the minimum. That is a real finding and it is not nothing. It is also, precisely, the minimum.
The number nobody is arguing about is the one carrying the most weight
Here is the part I would print and hand to whoever writes your tender.
Supply chain is weighted at twice legal exposure. The entire public conversation about cloud sovereignty in this country is about the CLOUD Act, and the Commission's own instrument gives jurisdiction ten per cent.
The document says why, and the reasoning is procurement reasoning rather than politics:
The weighting considers that the procurement procedure already contains significant safeguards in certain domains such as SOV-2 (Legal and Jurisdictional) and SOV-7 (Security and Compliance).
Which is to say: the legal question is a contract problem, you are already solving it in the contract, so scoring it again double-counts. Where the firmware came from is not a contract problem. No clause fixes it, and on the day it matters you will not be reading the clause.
I have been in enough of these to recognise the moment that reasoning gets quietly reversed by somebody who wants a particular vendor to win, so if you lift the weights, lift the sentence explaining them too.
The thing almost everyone will get wrong
SEAL is not a badge. Section 4:
The tender specification defines the minimum Sovereignty Effective Assurance Level of each Sovereignty Objective required in the scope of the tender.
Per objective. Not one number for the provider — eight minimums, one for each of the eight. "Reached SEAL-3" is shorthand, and treating it as a certification a vendor holds is the error this framework exists to prevent.
So the useful version for your own tender is not "bidders must be SEAL-3". It is: SEAL-3 on supply chain and operational, SEAL-2 on environmental, and whatever you can defend on the rest. That is a procurement document. The single number is a press release.
Which minimums the Commission actually set per objective for this tender, I do not know. It is in the tender specification and I have not read it, and it is the first thing I would ask DG Digital Services for.
What I would actually do on Monday
Download the six pages. Read section 4, which lists the contributing factors under each objective — it is the best free vendor questionnaire I have seen, and it includes the one question procurement never remembers to ask, filed under strategic sovereignty: whether the provider can sustain secure operations against a request to cease or suspend the service.
That is the kill-switch question, written down by the buyer, in a scoring table. It took an EU procurement document to put it where a purchase order can reach it.
The Commission says an updated version is coming, based on lessons from this tender. Wait for it if you like. The weights will not get less interesting.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Cloud Sovereignty Framework, version 1.2.1, October 2025Downloaded and read in full, all six pages. Source for: the eight Sovereignty Objectives SOV-1 to SOV-8 and their descriptions, quoted here in the document's own words; the five SEAL definitions, likewise quoted rather than paraphrased, because the paraphrases in circulation are softer than the text; the statement that the tender specification defines the minimum assurance level of each objective rather than one level overall; the contributing factors listed under each objective, including the naming of the US CLOUD Act and the Chinese Cybersecurity Law under SOV-2 and the kill-switch factor under SOV-1; the full weighting table and its total; the stated reason for weighting SOV-2 and SOV-7 lower; and the scoring formula. The document also names its own antecedents — CIGREF's Trusted Cloud Referential v2, Gaia-X, ENISA, NIS2, DORA, France's Cloud de Confiance, Germany's Souveräner Cloud — which is the sentence that tells you what it is.
- Commission advances cloud sovereignty through strategic procurement, 17 April 2026Read in full. Source for: the tender's launch in October 2025; the four awards and the stated reason for making four; the named providers and consortium members, reproduced here exactly as the Commission spells them; the eligibility floor of SEAL-2; the attribution of SEAL-3 to Post Telecom with CleverCloud and OVHcloud, to STACKIT and to Scaleway, and of SEAL-2 to Proximus with S3NS; the sentence about Google Cloud technology exclusively operated by EU companies; the claim that non-European technologies operated within a strict framework can meet the minimum; the promise of an updated framework version; and the invitation to other organisations to use the approach. This page does not state a contract value, which is why no figure appears in the body.
- The contract value, and the per-objective minimums set for this tenderNeither established. The Commission's announcement gives no value for the four contracts and this desk did not find one in any Commission publication; a figure is in circulation in trade coverage and is not printed here. More useful and also missing: the framework says the tender specification sets a minimum assurance level per objective, but the tender specification itself was not read, so which objectives carried which minimum in this procedure is unknown here. A buyer copying the approach needs that document and not this article.