EU Cloud Sovereignty: CADA Assurance Levels, EUCS, SecNumCloud and Where to Host Customer Data

The EU cloud sovereignty framework is the set of four Union assurance levels proposed in the Cloud and AI Development Act (CADA, COM(2026) 502, 3 June 2026), alongside a separate scoring framework the Commission uses in its own cloud procurement. CADA is a proposal, not law, and it binds mainly public-sector buyers. For anyone choosing where to host a customer data platform (CDP), it shows which controls Europe will treat as sovereign.

Who this is for: security, privacy, procurement and architecture leads in regulated organisations. Part of the regulation hub. Status below is as of mid-October 2026.

Two things are called the "EU cloud sovereignty framework"

SEAL and the score. The Commission document defines eight Sovereignty Objectives (SOV-1 strategic, SOV-2 legal and jurisdictional, SOV-3 data and AI, SOV-4 operational, SOV-5 supply chain, SOV-6 technology, SOV-7 security and compliance, SOV-8 environmental sustainability). SEAL-0 means no sovereignty; SEAL-1 jurisdictional, SEAL-2 data sovereignty, SEAL-3 digital resilience, SEAL-4 full digital sovereignty with no critical non-EU dependencies. Tenders below the required minimum on any objective are rejected. The Sovereignty Score weights the objectives at 15%, 10%, 10%, 15%, 20%, 15%, 10% and 5% respectively, so supply chain counts most 3.

CADA's four assurance levels

Annex II cites Article 19 for the level 3 derogation, but the third-country provisions are in Article 18; this looks like a drafting slip. Article 18 would let the Commission name third countries that have an adequacy decision, no conflicting access powers, no compelled disruption or sanctions measures, an open market and reciprocal procurement access. Recognition runs through the national authority of establishment: 60 days to assess, then a 60-day review by other Member States, with the Commission deciding disputes (Art. 17). The Commission keeps a central repository (Art. 22) and must review the annexes at least every 18 months (Art. 16).

Who must use which level

• Public bodies and EU institutions. Level 1 is the minimum (Art. 30(2)). Activities identified by a risk assessment as contributing to public order, in NIS2 Annex I and II sectors and in national security, internal security, border management, defence, justice and law enforcement, may only use levels 2, 3 or 4 (Art. 30(3)); the methodology must specify the highest level for the most critical activities, including defence (Art. 29(3)). Derogations exist where no recognised service is available or costs would be disproportionate (Art. 30(4)). Migration after a risk assessment may take up to 12 months (Art. 29(6)).
• Private sector. Entities in NIS2 Annex I sectors may run similar impact assessments (Art. 31(1)); the Commission may require them by delegated act in high-criticality sectors (Art. 31(3)). The Commission expects public procurement to set a market signal that regulated private buyers will mirror (recital 66) 2.

Legislative status

The proposal carries procedure number 2026/0138(COD). In the European Parliament the Industry, Research and Energy committee (ITRE) leads, with the Internal Market committee (IMCO) as joint committee; JURI and LIBE give opinions, and the budgets committee declined one. Rapporteurs were appointed between June and September 2026, and the Legislative Observatory shows referral announced on 17 September 2026 and the stage as awaiting committee decision. It records no Council events yet 4. If adopted, CADA enters into force on the twentieth day after publication and applies one year later; the first risk assessments fall due a year after entry into force 2. No date can be given, and amendments to the level definitions are plausible.

EUCS: why certification did not settle sovereignty

National schemes: SecNumCloud, C5 and ENS

| C5 | Germany, BSI | Cloud security criteria catalogue; auditors report against it. BSI says it was completely revised in 2025/26 and lists C5:2026 beside C5:2020 5 | BSI's page mentions no data-location or sovereignty criteria |

These are security or public-sector schemes; only SecNumCloud is widely described as carrying a sovereignty element.

Hyperscaler "sovereign" offers and the CLOUD Act debate

Whether any of these meets level 3 or 4 is untested because the framework is not law. The Commission's view in the proposal (recital 48) is that tailored sovereignty versions of existing offers do not, by themselves, address the extraterritorial reach of third-country laws or possible service disruption 2. The CLOUD Act requires US providers to disclose data in their possession, custody or control regardless of where it is located 10. GDPR Article 48 says third-country orders to disclose personal data are recognised only if based on an international agreement 11, and Data Act Article 32 obliges data processing providers to take adequate measures against unlawful foreign access to non-personal data 12 (see EU Data Act and cloud switching). The EU-US Data Privacy Framework still stands but is under appeal; see GDPR transfers after Latombe. Demand is following: Gartner forecasts sovereign cloud IaaS spending of US$80B in 2026, up 35.6%, with Europe up 83% 13, while the Commission says EU providers' market share fell from 29% in 2017 to 15% in 2022 2.

Sovereign cloud vs private cloud

A private cloud is about exclusivity and operation: infrastructure dedicated to one customer, run by you or a provider. A sovereign cloud is about jurisdiction and control: which law reaches the service, who staffs it and who can compel access. A private cloud in a US provider's EU region can be private without being sovereign; a customer-operated EU data centre is both. The IDC analysts note that vendors can label offers sovereign but customers decide what it requires 14. See residency vs sovereignty.

What it means for where you host a customer data platform

CADA does not bind a private company's CDP choice today. Use its logic as a risk lens:

PrivyCDP is one of the options for the customer-operated rows, in the customer's own VPC, on-premise, hybrid or sovereign and air-gapped environment 15; the complete guide to self-hosted platforms lists the alternatives.

Sovereign hosting checklist for a customer data platform

• Classify data by sensitivity and by the regimes that apply (GDPR, DORA, NIS2, sector rules).
• Decide whether you are, or sell to, a public body that CADA's procurement rules will reach.
• Identify the provider's legal entity, ultimate owner and any third-country control.
• Confirm where customer data, metadata, logs and telemetry are stored and processed.
• Confirm who can reach the environment for support, from where, and under which approvals.
• Hold the encryption keys yourself, or in an EU-controlled key service.
• Check certifications against your scheme of choice (SecNumCloud, C5, ENS, ISO 27001).
• Write exit and switching terms, including the Data Act dates (see the deadline tracker).
• Re-assess when CADA, EUCS or a national scheme changes.

---