EU’s cloud sovereignty plan gives more points to efficiency than independence

The European Fee launched a cloud sovereignty framework in October 2025 that critics say defeats its personal objective. The scoring system provides American cloud suppliers extra factors for operational effectivity than for being free from US authorities surveillance powers.

Entrepreneur Arnaud Bertrand called the framework “past parody” after analyzing how the mathematics works. The 6-page doc units up eight classes to guage cloud suppliers. Provide chain will get 20% of the rating. Authorized independence from overseas governments will get solely 10%.

This implies a US firm topic to American surveillance legal guidelines might beat a European supplier just by having higher expertise and operations. Microsoft, Amazon, and Google might theoretically rating increased than European opponents like OVH or Scaleway, although Microsoft executives admitted under oath they can not shield European knowledge from US authorities calls for.

How the scoring truly works

The framework judges suppliers on eight components. This is what each counts for within the last rating:

Provide chain sovereignty will get 20%. This measures the place {hardware} comes from and who controls it. Strategic sovereignty will get 15%. This checks if the corporate is managed by European house owners. Operational sovereignty receives 15%. This evaluates whether or not Europeans can run the programs independently. Know-how sovereignty will get 15%. This examines whether or not the expertise is open and auditable.

Authorized jurisdiction receives simply 10%. This supposedly measures safety from overseas authorities entry. Safety compliance will get 10%. This covers certifications and EU laws. Knowledge and AI sovereignty receives 10%. This addresses the place knowledge stays and who controls it. Environmental sustainability will get 5%. This measures vitality effectivity and carbon influence.

Add up the operational classes—provide chain, operations, and expertise—and also you get 50% of the full rating. Add up the sovereignty classes that truly shield towards overseas authorities entry—authorized jurisdiction, strategic management, and knowledge location—and also you get 35%.

One analyst put it bluntly: “the weighting selection creates a system the place operational excellence can mathematically compensate for overseas jurisdiction.” Translation: American corporations can win European authorities contracts by being good at their jobs, regardless that US courts can organize them handy over European knowledge.

The US surveillance drawback no person desires to debate

This issues due to what occurred in June 2025. Anton Carniaux, Microsoft France’s authorized director, testified to the French Senate about knowledge safety. Senators requested him immediately: are you able to assure French citizen knowledge won’t ever be transmitted to US authorities with out French authorization?

His reply: “No, I can’t assure it.”

Carniaux defined that Microsoft has inside procedures to problem unjustified requests. However he admitted that “a binding order from a U.S. court docket might prevail.” This is not theoretical. The US CLOUD Act provides American authorities the ability to demand knowledge from US corporations irrespective of the place that knowledge is saved.

Microsoft’s technical director tried to melt the blow. Pierre Lagarde emphasised that “since January 2025, underneath contractual assure, the info of our European purchasers doesn’t depart the EU, whether or not at relaxation, in transit, or being processed.” However knowledge location is meaningless when American courts can order American corporations to decrypt and ship it anyway.

European regulators know this. The European Knowledge Safety Supervisor closed its enforcement case towards Microsoft in July 2025 regardless of the corporate’s admission. They accepted contractual guarantees that Microsoft’s personal attorneys say can’t override US legislation.

Critics say the repair is in

The social media response to the framework revealed deep skepticism about how this technique got here to be. A former EU lobbyist defined the doubtless course of: “A draft with an honest system was leaked, then the varied tech lobbies jumped on it to water it down, adopted by EU nations captured by the US.”

One other commenter was extra direct: “It is on objective, the EU is totally contaminated with bureaucrats doing the US bidding on every little thing.” One observer recommended renaming it as a result of it features “extra of an operational functionality framework and fewer of a cloud sovereignty framework.”

The criticism focuses on a primary contradiction. The EU claims to need digital sovereignty—independence from overseas management of essential infrastructure. However the math on this framework rewards the alternative. Firms topic to overseas authorities surveillance powers can win contracts by excelling on the technical components that make up half the rating.

A programs analyst recognized the core problem: “This produces procurement outcomes that protect present vendor relationships underneath a sovereignty framework.” In different phrases, the system lets European governments declare they’re prioritizing sovereignty whereas persevering with to purchase from the identical American suppliers they’ve at all times used.

What Deutsche Telekom noticed coming

T-Systems appointed Christine Knackfuß-Nikolic as Chief Sovereignty Officer on September 1, 2025, weeks earlier than the framework’s launch. The Deutsche Telekom subsidiary created a whole government place devoted to sovereignty technique. They noticed a market alternative.

European cloud suppliers have struggled to compete with Amazon Internet Providers, Microsoft Azure, and Google Cloud. The American hyperscalers supply extra options, higher efficiency, and decrease costs. They’ve constructed ecosystems of instruments and companies that European options can’t simply match.

European suppliers like OVH and Scaleway argue they provide one thing the Individuals can’t: genuine protection from foreign surveillance. They don’t seem to be topic to the US CLOUD Act. French courts can’t organize them handy over knowledge to American intelligence companies. But when the procurement scoring system provides twice as a lot weight to produce chain administration as to authorized independence, that benefit disappears.

France’s SREN legislation requires delicate authorities knowledge to maneuver to SecNumCloud-certified suppliers. Implementation has been sluggish. Companies discover it simpler to maintain utilizing Microsoft and Amazon companies they already know. The brand new EU framework may make it mathematically justifiable to do precisely that.

The minimal requirements loophole

The framework does embrace minimal necessities. Suppliers should attain sure “Sovereignty Effectiveness Assurance Ranges” for every class. There are 5 ranges, from SEAL-0 to SEAL-4.

SEAL-0 means no sovereignty—full overseas management. SEAL-1 means EU legislation technically applies however can’t be enforced. SEAL-2 means EU legislation works however main overseas dependencies stay. SEAL-3 means EU actors have significant affect however not full management. SEAL-4 means full European management with no overseas dependencies.

Tender paperwork specify minimal SEAL ranges for every class. Suppliers who do not meet the minimums get disqualified. This theoretically prevents corporations with SEAL-0 or SEAL-1 scores from profitable contracts irrespective of how excessive they rating elsewhere.

However this is the issue. The framework does not outline what minimal SEAL stage procurement officers should require. A supplier might meet SEAL-2 minimums throughout all classes—which means they nonetheless have “materials non-EU dependencies” and function underneath “oblique management of non-EU third events”—after which compete on the weighted scoring method.

In the event that they excel at provide chain administration, operational capabilities, and expertise openness, they might beat a European supplier with SEAL-4 full sovereignty. The system permits precisely the result it supposedly prevents.

This framework impacts extra than simply authorities cloud contracts. It establishes how European authorities take into consideration digital sovereignty. These ideas stream into different laws.

The European Data Protection Board released guidelines in September 2025 about how the Digital Providers Act intersects with GDPR. Advertising platforms processing private knowledge should adjust to each frameworks. The strategy to sovereignty in procurement selections indicators regulatory priorities.

GDPR enforcement statistics present that only one.3% of instances between 2018 and 2023 resulted in fines. However Eire, the place American tech corporations base their European operations, imposed €475 million in annual common fines. Luxembourg averaged €124 million. The nations that host overseas suppliers additionally regulate them most aggressively.

The sovereignty framework’s strategy to authorized jurisdiction—acknowledging the issue whereas giving it minimal scoring weight—mirrors how regulators handled Microsoft’s data protection failures. They closed enforcement instances regardless of admitted incapacity to stop overseas authorities entry.

Advertising platforms constructed on American cloud infrastructure inherit these vulnerabilities. If an advertiser shops buyer knowledge in Microsoft Azure, that knowledge turns into accessible to US intelligence companies no matter contractual guarantees. The procurement framework’s weighted scoring strategy suggests European authorities contemplate this an appropriate tradeoff for operational effectivity.

The actual query no person’s answering

The framework attracts on a number of European initiatives. CIGREF’s Trusted Cloud Referential. Gaia-X coverage guidelines. The European Cybersecurity Certification Framework masking ENISA, NIS2, and DORA. Nationwide methods like France’s Cloud de Confiance and Germany’s Souveräner Cloud.

All these applications share a standard purpose: lowering European dependence on overseas expertise. But the precise implementation retains selecting overseas suppliers. French authorities contracts value €74-152 million went to Microsoft for academic software program regardless of European options. The French Senate listening to revealed that procurement selections “constantly favor non-EU options for essential infrastructure initiatives.”

One commenter requested the plain query: “Is there any EU cloud supplier?” The reply is sure—OVH, Scaleway, and others exist. However they lack the size and options of American hyperscalers. Constructing comparable infrastructure requires sustained funding that European markets have not delivered.

The framework acknowledges this actuality in its weighted scoring. Provide chain, operations, and expertise collectively symbolize 50% of the analysis as a result of these components decide whether or not programs truly work. A sovereignty resolution that does not perform is nugatory. However giving operational components twice the burden of authorized independence suggests the Fee believes European options can’t compete on technical benefit.

This creates a self-fulfilling prophecy. European suppliers wrestle to win contracts towards American opponents. With out contract income, they can not put money into matching American capabilities. The scoring system then continues to favor American suppliers based mostly on their superior operational efficiency.

What the framework truly accomplishes

The framework supplies political cowl for selections already made. European procurement officers wish to use Microsoft, Amazon, and Google as a result of these suppliers supply higher companies. However sovereignty considerations make it politically troublesome to justify these selections.

Enter the framework. Now procurement officers can doc their sovereignty evaluation. They will present they evaluated eight various factors utilizing a rigorous mathematical method. They will level to minimal SEAL necessities that suppliers should meet. And so they can justify selecting American suppliers as a result of these corporations scored increased on operational excellence.

The system transforms a political drawback right into a technical resolution. As an alternative of confronting the coverage query—ought to European governments rely on American expertise infrastructure topic to US surveillance powers—the framework converts it right into a scoring train that allows the specified consequence.

A critic described this as “enhancing the effectivity with which Washington can handle its vassals.” That is harsh however captures the frustration. The EU spent sources creating a sovereignty framework that mathematically favors non-sovereign options. One observer characterised it as Europe’s “attempt of being the primary world producer of empty meaningless insurance policies.”

The environmental sustainability distraction

Environmental sustainability receives 5% of the scoring—half the burden of authorized jurisdiction. This measures vitality effectivity, carbon emissions, round economic system practices for {hardware} disposal, and renewable vitality utilization.

These components matter for local weather coverage. However together with them in a sovereignty framework whereas giving them minimal weight suggests priorities. If defending European knowledge from overseas authorities entry deserves solely 10%, and environmental practices benefit 5%, what does that say in regards to the Fee’s precise considerations?

The framework states that environmental sustainability “assesses autonomy and resilience of cloud companies over the long run in relation to vitality utilization, dependency and uncooked materials shortage.” This connects sustainability to sovereignty by way of useful resource independence. However the connection is tenuous in comparison with the direct sovereignty points round authorized jurisdiction.

Together with environmental components seems like box-checking. The Fee can declare it thought of local weather influence. The 5% weight ensures sustainability components can’t decide outcomes. American cloud suppliers can level to their renewable vitality investments and earn these factors whereas sustaining surveillance vulnerabilities that the framework treats as much less necessary.

What occurs subsequent

The framework takes impact instantly for EU procurement procedures. Contracting authorities should apply the weighted scoring method and minimal SEAL necessities when evaluating cloud service proposals. Outcomes could also be used throughout contract efficiency to find out what varieties of programs may be deployed with particular suppliers.

T-Systems’ new Chief Sovereignty Officer will try to place the Deutsche Telekom subsidiary for contracts underneath these guidelines. European suppliers will emphasize their SEAL-4 full sovereignty credentials. They will argue their authorized independence from overseas governments justifies premium pricing regardless of operational gaps.

American suppliers will spotlight their operational excellence, provide chain transparency, and expertise openness. They will meet minimal SEAL necessities—in all probability SEAL-2 or SEAL-3—after which compete on the 50% of scoring tied to efficiency components. They will win contracts by being higher on the issues that depend most within the weighted method.

European authorities will approve these outcomes as a result of the framework supplies justification. They will inform residents they prioritized sovereignty by requiring complete assessments throughout eight components. They will clarify that profitable suppliers met all minimal necessities and scored highest on the target mathematical method.

And European knowledge will proceed flowing by way of infrastructure topic to American surveillance powers that Microsoft executives admit they can not resist.

Timeline

Abstract

Who: European Fee’s digital companies directorate created the framework affecting authorities procurement throughout 27 member states, with quick criticism from entrepreneurs and coverage analysts who examined the weighted scoring arithmetic.

What: Scoring system assigns 20% weight to produce chain, 15% every to strategic management, operations, and expertise, however solely 10% to authorized jurisdiction, permitting suppliers topic to overseas authorities surveillance to outscore European options by way of operational excellence.

When: Launched October 2025 for quick implementation in procurement procedures, following growth based mostly on French and German nationwide sovereignty methods which have struggled with related tradeoffs between independence and functionality.

The place: Brussels headquarters issued framework for implementation throughout European Union, affecting authorities cloud contracts, delicate knowledge infrastructure, and procurement selections that critics say proceed favoring American suppliers regardless of sovereignty rhetoric.

Why: Framework makes an attempt to steadiness sovereignty objectives with operational necessities however critics argue weighted scoring undermines independence goals, creating mathematical justification for outcomes that protect present dependencies on overseas infrastructure topic to extraterritorial surveillance powers.