The European Commission has awarded a six-year, €180 million sovereign cloud contract to four European cloud providers, a decision built around its new Cloud Sovereignty Framework and aimed at keeping EU institutional data and services under stronger European control. The contract went to Luxembourg’s Post Telecom, Germany’s STACKIT, France’s Iliad’s data centre unit Scaleway, and Belgium’s Proximus.
As a six-year deal, it is meant to serve EU institutions, bodies, and agencies, while pushing the market toward cloud services that comply more closely with EU laws and values.
The Commission designed the tender to reduce dependence on non-European cloud infrastructure and to avoid the risk of being locked into a single supplier. In plain terms, the EU is trying to keep more of its digital house built, run, and governed inside Europe.
How the EU Picked Winners
The Commission said it used a Cloud Sovereignty Framework to measure cloud providers against objective procurement criteria. That framework looks at eight areas, including strategic, legal, operational, environmental, supply chain transparency, technological openness, security, and compliance with EU law.
Another key part of the system is the Sovereignty Effectiveness Assurance Levels (SEAL), which run from SEAL-0 to SEAL-4. Providers had to reach at least SEAL-2, which the Commission defines as a data sovereignty level, meaning they comply with EU rules without the customer needing extra technical protections for its data.
What the Cloud Providers Achieved
Most of the selected providers reached SEAL-3, a level the Commission calls the digital resilience level. That means their services, technology, or operations are considered protected from disruption linked to non-EU third parties.
The Commission also said the providers had to show more than sovereignty alone. They were required to deliver reliable, modern cloud services with a strong focus on fully managed services, developer experience, and automation. In other words, European control was important, but so was technical quality.
The Google Cloud Question
There’s the inclusion of S3NS, the Thales-Google Cloud joint venture, in Belgium’s Proximus, and it has drawn criticism. CISPE, a trade association of 38 European cloud firms, argued that the Cloud Sovereignty Framework’s criteria are so broad and weighted that they could allow a provider to tick enough boxes to get a high score without truly delivering on the spirit of European sovereignty.
Francisco Mingorance, CISPE’s Secretary General, called the recognition of S3NS as sovereign an “own goal” that “threatens to institutionalize sovereignty washing at the highest levels.”
However, S3NS responded by stating that it is a French entity fully controlled by Thales, with European employees based in France. The company said its infrastructure runs on physically segregated data centers with dedicated and isolated networks, and that all operations are carried out exclusively by S3NS personnel, with only limited and supervised assistance from Google, without system access.
The Commission, for its part, justified the arrangement by stating that non-European technologies can meet the minimum level of sovereignty required when operated within a strict and appropriate framework.
What This Means for Europe
The deal gives the Commission a working model for buying cloud services without treating sovereignty as a mere vague policy slogan. It turns the idea into a solid framework that can be used in procurement, which makes the concept easier to apply across the public sector. The Commission said it plans to publish an updated version of the framework after learning from this tender.
The contract also shows that the EU is willing to reward cloud services built around European governance rather than only around global scale. The Commission said the success of the tender shows European providers can meet strict requirements.
For the cloud industry, this is a political statement. The EU has created a framework that others can copy, and that may influence how governments and large institutions buy cloud services in the coming years.
