European “cloud” service: the idea of strengthening digital sovereignty

Views: 96

The European Commission intends to strengthen the EU’s digital sovereignty by awarding a tender that allows EU institutions, bodies, offices and agencies to procure sovereign cloud services for up to €180 million over 6 years. The four awarded providers are from the European digital companies in Germany, France, Luxembourg and Belgium. 

Background
Cloud is one of the most important innovations in the history of computing. It has revolutionized the way software engineers build applications – with elasticity, resilience and security built in – as well as in the way the consumers using AIs software applications. Cloud computing continues to evolve, including some of the best-known researchers in the digital technology.
More on the evolution of the “cloud” in:
https://www.jpmorgan.com/technology/news/evolution-of-public-cloud

The European Commission’s aim is to provide European businesses, private and public entities with access to secure, sustainable and interoperable cloud infrastructure services. Present active cloud data and services’ usage world-wide is forcing the EU authorities to facilitate cloud computing infrastructures through secure and sustainable digital services, alongside safe data storage and transmission.
The global data volume is growing very fast: whereas cloud computing happens mostly in large data centres, it is expected that soon 80% of all data will be processed in smart devices closer to the user, known as edge computing. As the Commission notes in the press release, “the availability of both edge and cloud computing is essential to ensure that data is processed in the most efficient manner; hence, energy-efficient and trustworthy edge and cloud infrastructures in the EU will be fundamental for the sustainable use of edge and cloud computing technologies”.
Source and citation from: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833

The “sovereign cloud” tender
This April, the European Commission provided details of its Sovereign Cloud call for tender through which the EU institutions, bodies, offices as well as the EU’s agencies and entities can procure sovereign cloud services for up to €180 million over a period of 6 years.
The tender was, actually, launched in October 2025, as part of Commission’s efforts to strengthen the EU-wide digital sovereignty, and as “competition” under the Cloud III Dynamic Purchasing System (the so-called Cloud III DPS). An initial goal of the tender was to encourage the market to offer sovereign digital solutions that comply with EU laws and values.

     Note: Cloud III DPS is the main acquisition channel for the procurement of multi-tenant IaaS/PaaS cloud services by the Commission and the other participating EU institutions, bodies and agencies EUIs); it has been opened for registration from April 2024. It enables the Commission Cloud Broker, together with other participating EUIs, to run mini-competitions that address their needs for cloud services. Cloud III DPS builds upon the experience acquired through its innovative predecessor Cloud II DPS1, which was the first procedure of its kind and served as a key enabler for the adoption of cloud services by various EUIs during the last four years. Like its predecessor, Cloud III DPS focuses on automated, pay-per-use services depending on public clouds, as opposed to custom-made private clouds.
The Cloud III DPS also includes: a) hybrid cloud management (fully managed automated IaaS/PaaS services running on top of standardized infrastructure hosted on premises by the EUIs); b) possibility to obtain products and services that are complementary to the main IaaS/PaaS services in scope or facilitating their adoption.
Source and citation from: https://commission.europa.eu/news-and-media/news/commission-launches-new-procurement-process-cloud-services-2024-02-07_en

     The present tender supports the Commission’s broader efforts to enhance the EU-wide sovereignty, reinforcing strategic control across key technologies and infrastructure. The four awarded providers are:
= Luxembourgish-French partnership led by Post Telecom with OVHCloud and Clever Cloud;
= German company StackIT (Schwarz Group);
= French company Scaleway (Iliad Group); and
= Belgian-French-Luxembourgish partnership led by Proximus, that uses services from S3NS (a joint venture between Thales and Google Cloud), Clarence and Mistral.
Source: https://commission.europa.eu/news-and-media/news/commission-advances-cloud-sovereignty-through-strategic-procurement-2026-04-17_en

Selected contracts
The awarded providers were selected based on their alignment with the Commission’s Cloud Sovereignty Framework, which measures sovereignty across eight objectives: e.g. strategic, legal, operational and environmental considerations, as well as supply chain transparency, technological openness, security and compliance with the EU laws and values.
The Commission awarded four contracts to ensure diversification and resilience, avoiding over-reliance on a single provider. To be eligible, the providers had to reach rigorous assurance levels ensuring that non-EU third parties have limited control over the technologies the providers use, or services they provide. Hence, the large-scale use of the EU cloud is a vital prerequisite for improving the EU’s digital sovereignty.
The Commission leads by example, as the Sovereign Cloud call for tenders sets a new benchmark for what ‘sovereign’ means in practice for cloud services. The Cloud Sovereignty Framework defines the European Commission’s criteria, assurance levels (SEAL) and scoring methodology for assessing the sovereignty of cloud services across strategic, legal, operational and technological dimensions.
On the EU’s cloud sovereignty framework in: https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en

The tender encourages the entire sector to comply with European standards and values. Its success highlights the high quality of European providers, demonstrating their ability to meet the Commission’s strict criteria. It also shows that non-European technologies, when operated within a strict and appropriate framework, shall meet the minimum level of sovereignty required.
Source: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833

EU’s digital sovereignty milestones
By successfully introducing sovereignty in its cloud procurement, the Commission explores the EU-wide idea of advancing European digital sovereignty in general, setting a benchmark for secure, compliant and values-based cloud adoption across the public sector.
Thus, the tender highlights the high quality of European providers, demonstrating their ability to meet the Commission’s strict criteria. It also shows that even non-European technologies, when operated within a strict and appropriate framework, shall meet the minimum level of sovereignty required.
Before the Sovereign Cloud Framework (SCF) was developed, it was not possible to measure digital sovereignty; besides, it was difficult to introduce such a concept through the strict requirement in procurement procedures. The SCF has now provided a clear and standardised method to assess cloud services, moving away from abstract principles to concrete sovereignty metrics, giving a clear framework to companies on what they should focus on.
The EU approaches to the cloud services’ security are based on assumption that it is possible “making data” more secure than on-premise solutions through advanced encryption, multi-factor authentication (MFA) and robust, automated infrastructure.
Security relies on a “shared responsibility model,” where providers secure the infrastructure and users secure their data, access and configurations.
Major cloud providers like AWS, Google Cloud, and Microsoft Azure provide built-in security features designed to protect against threats, but it is essential to configure these services correctly and understand the shared responsibility models.
Thus, it is possible to provide a EU-type secure cloud services, which is presently a major European strategic digital priority, though it involves significant technical and geopolitical challenges. The EU is actively building a “secure and sovereign” cloud system through a combination of strict regulations, specialized certifications and investments in local infrastructure to reduce dependence on non-EU providers.
More on cloud computing in: https://digital-strategy.ec.europa.eu/en/policies/cloud-computing

Perspectives
Presently, the Commission is finalising an updated CSF’s version, which would include specific criteria to perform sovereignty assessments; this update is meant to support the entities that are willing to reuse the Commission’s approach to digital implementation.
The Commission is working on adapting the developed EU-wide sovereignty criteria to assess and enhance it across the digital services provides and other Union entities. The Commission is also preparing the Technology Sovereignty package, which would include the Open-Source strategy, the Chips Act 2, the Strategic Roadmap for Digitalisation and AI in Energy, as well as the Cloud and AI Development Act (CADA). The CADA will harmonise what sovereignty for Cloud and AI computing services means across the EU-wide single market; it will improve opportunities for sovereign cloud offerings, including through public procurement, and support the entry into the market of a more diverse set of cloud and AI service providers.

      Note on CADA: The proposed EU Cloud and AI Development Act (somewhere around April 2025) aims to strengthen Europe’s leadership in cloud computing and artificial intelligence (AI), by establishing a robust regulatory framework for high-performance computing resources and digital infrastructure. It seeks to address the growing demands of AI applications while promoting innovation, interoperability, and a competitive internal market, ensuring Europe’s technological sovereignty and long-term economic resilience. The EU currently lags behind the US and China in terms of available data center capacity. The initiative aims to tackle the currently unfavorable conditions for the private sector to close this capacity gap in a way that prioritises highly sustainable solutions.
The proposed CADA complements existing EU regulations, such as the Artificial Intelligence Act, which provides a legal framework for AI development and use in the EU-27.
Reference to: https://www.eu-cloud-ai-act.com/

Basics on cloud and www
The cloud refers to on-demand, remote computing services (storage, processing) rented over the internet, while the World Wide Web (www) is a system of interconnected data accessed via web browsers. In simple terms, the cloud is where data is stored/processed, and the www is how the information is viewed. The key differences can be better seen in:
a) function: the cloud allows for remote computing, data storage and applications (e.g., Dropbox, Google Drive). The web is for sharing, publishing and browsing information (e.g., websites).
b) access: the cloud requires a network connection to operate, usually providing a personalized or secure experience; the web uses HTTP to deliver public web pages.
c) storage vs. display: the cloud is a place to store data or run apps remotely; the web uses web servers to store and display content.
d) relationship: both generally overlap: one can use the web (web browser) to access cloud services (e.g. SaaS like Google Docs).
Thus, the cloud is a utility (renting computing power), while the web is a service (browsing the internet). Online clouds, also known as public clouds, can fall under the personal cloud umbrella when they’re used for individual file storage and syncing: examples include services like Google Drive and Dropbox, which offer personal-level access to files stored in shared server environments. Presently, spending on cloud computing services world-wide reached $706 billion in 2024; the International Data Corporation predicted that it would reach $1.3 trillion by 2025.
Reference and citations from: https://www.quora.com/Whats-the-difference-between-a-cloud-and-a-web-server

Historically, large technology companies that provide internet-scale services to their customers have had to build this infrastructure for themselves. While there had been significant innovation in building and managing such large infrastructures at scale, there was still opportunity to enable more efficiencies. Thanks to the cloud, software engineers can presently build applications more quickly, resiliently and efficiently: e.g. a new business idea can be proven out in a matter of weeks instead of months or years. The cloud also offers on-demand infrastructure and services that are easily accessible and have a greatly increased capacity. If applications are written well and infrastructure is managed well, the pay-as-you-go model may even help reduce costs.

Cloud computing has become the backbone of modern businesses, powering everything from e-commerce to AI research; and the landscape of cloud service providers (CSPs) continues to evolve. While the “Big Three” providers: the Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP)are dominating, some emerging players in Asia offer unique opportunities. Comparing CSPs now requires looking beyond cost and performance to consider integration with cost optimization tools, observability platforms and multi-cloud strategies.
The CSPs offer key benefits for businesses: – in scalability: by easily scale services up or down, paying only for what’s used; – in cost efficiency: by avoiding large upfront hardware costs and by accessing high-performance infrastructure at lower rates; – in global accessibility: by data centers around the world ensuring low-latency access to applications; – in security and compliance: by robust security features and industry certifications to meet numerous digital regulations (like GDPR and HIPAA); – in reliability and availability: by high uptime and automated failover to keep business applications running smoothly.
Reference and citations from: https://www.astuto.ai/blogs/top-cloud-service-providers

The global cloud-market share
Six main providers are dominating already the global cloud market; and five of them are from the US and one from China:
1= Amazone Web Service, AWS: leading the market with 39.2% share, AWS continues to dominate due to its comprehensive service catalog and global infrastructure.
More in: https://aws.amazon.com/
2= Microsoft Azure: holding a strong 25.3%, Azure’s success is fueled by its hybrid cloud capabilities and seamless integration with Microsoft enterprise products.
Morein: https://azure.microsoft.com/en-us; Reference to the Microsoft Sovereign Cloud, which “delivers sovereign cloud services in Europe through technical controls, operational governance and legal commitments without limiting innovation or cloud capability”. In: https://www.microsoft.com/en-us/sovereignty
3= Google Cloud Platform, GCP: With 16.5% of the market, GCP stands out for its focus on data analytics, AI, and machine learning tools like BigQuery and TensorFlow.
More on the Google Cloud Platform, GCP in: https://cloud.google.com/
4= IBM Cloud: At 5.1%, IBM Cloud serves industries with enterprise-grade solutions like AI and blockchain. IBM Cloud is designed for hybrid multi-cloud environments, enabling businesses to run workloads wherever they perform best—on-premises, private cloud, public cloud, or at the edge. More in: https://www.ibm.com/solutions/cloud
5= Oracle Cloud: with 2.5%, Oracle Cloud continues to serve its niche with database management and enterprise applications. Oracle Cloud is a leader in database services and enterprise solutions, offering a comprehensive suite of cloud applications. Known for its powerful database services, Oracle Cloud is particularly popular among large businesses and those in need of reliable database management and analytics solutions.
More about the Oracle Cloud in: https://www.astuto.ai/blogs/top-cloud-service-providers
6= Alibaba Cloud: dominating the Asia-Pacific region with 11.4%, Alibaba Cloud excels in e-commerce and big data analytics. More in:
https://www.alibabacloud.com/en?_p_lc=1&spm=a3c0i.7938564.3245461670.d_logo.184e441eSrtkvX

  Since 2025, choosing the right cloud provider required a comprehensive evaluation of factors beyond just cost and hardware: customers must consider how CSPs align with their business goals in areas like cost optimization, observability, multi-cloud readiness and niche capabilities.
Picking the right Cloud Service Provider (CSP) is a key step in choosing a digital provider: each of existing ones, like mentioned AWS, Azure, Google Cloud, IBM Cloud, Oracle Cloud, and Alibaba Cloud are offering unique services. For example, the AWS leads the market with its wide range of services, the Azure excels in hybrid solutions, and the Google Cloud “shines” in AI models and analytics. However, the best choice of provider depends on the concrete corporate needs: whether prioritizing scalability, cost savings, security and/or specialized tools, etc.

As to the EU’s “cloud sovereignty”, the general digital security and privacy are still major concerns in the cloud computing services; hence the issues of a due security are becoming the major concern for consumers and digital researchers. Globally, for example, the CloudChain, a cloud-oriented blockchain system is designed to increase the layers of security: i.e. Google, Amazon and Azure are the major cloud companies that are leading the market; these cloud computing platforms can assist businesses choose the right solution based on their needs.
Sources: https://www.cloudchaintechnologies.com/; and https://www.google.com/search?q=cloudchain+technologies&oq=CloudChain&gs

Our opinion
The short cloud’s history reflects the US dominance in creating new types of digital connections: thus, already in 1993, the cloud’s pioneers noted that “anyone with a computer… would be able to use intelligent assistance in the “cloud”. They underlined that a “new meeting place was open, so that anyone, whether individual, entrepreneur or a multinational company, would be able to offer information, goods and services”.
Reference to: https://www.youtube.com/watch?v=_a7hK6kWttE

The concept of the cloud computing as a platform for distributed computing is already about 30-year-old: initially, Apple spined-off the General Magic and AT&T to use the term in the context of their Telescript and Personal Link technologies. The Telescript’s fascinating aspect was that instead of having a device to program, it was possible having the entire “cloud out there”, where a single program can go and travel to many different sources of information and create a sort of a virtual service”.
Source: Steven Levy (April 1994). “Bill and Andy’s Excellent Adventure II” Archived 2015-10-02 at the Wayback Machine. Wired. And: https://en.wikipedia.org/wiki/History_of_cloud_computing

During the starting of the new century, the service-oriented architecture (SOA) and web service frameworks popularized loose coupling, coarse-grained capabilities and composable services; this process has led to and merged with the cloud computing service-delivery models. Besides, the software as a service (SaaS) emerged as an approach to delivering applications over the Internet rather than via local or on-premise’s installation.
More in: Quick Primer “A short history on the evolution of Public Cloud”. January 2023. In:
https://www.jpmorgan.com/technology/news/evolution-of-public-cloud

With all the virtues of adopting the cloud, there remains debate about efficiency, including costs, and portability. While cloud resources are easy to spin-up, there is a lot of discipline needed to spin them down when not in use, as well as architecting the application for optimal usage with greatest efficiency by proactively monitoring the allocated resources for utilization as well as transforming the applications using serverless principles.
As for portability, the omnipresent vendor’s lock-in principle plays out in the cloud too: i.e. it would serve well to build and deploy applications using generic frameworks which can be deployed and moved between clouds; but as one might imagine, this is a fast-emerging area…