{"id":3916,"date":"2026-10-19T01:29:14","date_gmt":"2026-10-19T00:29:14","guid":{"rendered":"http:\/\/sooma.com\/pt-pt\/bruxelas-passa-a-exigir-cloud-europeia-o-que-muda-para-quem-compra-e-quem-fornece\/"},"modified":"2026-10-19T01:29:14","modified_gmt":"2026-10-19T00:29:14","slug":"brussels-starts-requiring-european-cloud-what-changes-for-buyers-and-providers","status":"publish","type":"post","link":"https:\/\/sooma.com\/en\/bruxelas-passa-a-exigir-cloud-europeia-o-que-muda-para-quem-compra-e-quem-fornece\/","title":{"rendered":"Brussels starts requiring European cloud: what changes for buyers and providers"},"content":{"rendered":"

While the Cloud and AI Development Act makes its way through Parliament and the Council, the European Commission did not wait: in its own sovereign cloud tender it applied a grid of sovereignty levels, excluded anyone who fell short of the minimum and awarded everything to European providers. The outcome shows how far the hyperscalers' \"sovereign\" offerings go, and what a European public body can demand today.<\/strong><\/em><\/p>\n

What has already happened<\/h2>\n

In April 2026 the Commission split a six-year, 180 million euro framework contract, open to every EU institution and agency, between four consortia: Post Telecom with OVHcloud and Clever Cloud, STACKIT (Schwarz Group), Scaleway (Iliad Group) and Proximus with S3NS, Clarence and Mistral. It assessed them with its Cloud Sovereignty Framework, which turns sovereignty into eight measurable objectives and assigns a SEAL level from 0 to 4: corporate control, data location, supply chain, technological openness, security and compliance with EU law. Only bidders reaching SEAL-2 (data sovereignty) were eligible. OVHcloud, STACKIT and Scaleway reached SEAL-3 (digital resilience). The consortium built on S3NS, the Thales and Google joint venture, stayed at SEAL-2, the minimum. The Commission will apply the same criteria to its own digital services and publish an updated version of the framework.<\/p>\n

What is coming<\/h2>\n

The Cloud and AI Development Act (CADA) will make this kind of grid mandatory for the public sector in every Member State, with four assurance levels and a requirement of level 2 or above in critical sectors, extendable to companies covered by NIS2. We explained the four levels in Brussels proposes four levels of digital sovereignty in public procurement<\/a>.<\/p>\n

The Public Procurement Act, adopted on 9 September, replaces the public procurement directives with a single regulation carrying a European preference across all sectors: at least 30% of the evaluation on non-price criteria, where European origin can count, and the power for the Commission to close tenders to countries without reciprocity. E-procurement platforms will have to be established in the EEA, keep their data there and be free of external control.<\/p>\n

Neither is in force yet. The CADA will have no final text before 2027 and will not apply before 2028; the Public Procurement Act does not apply before 2029. But a four-year cloud contract signed today will end under these rules.<\/p>\n

Where this leaves Microsoft, Google and Amazon<\/h2>\n

The three hyperscalers can meet level 1: they have European subsidiaries and data regions in the EU. But that is not what comes by default. EU data residency is an option to be configured and contracted separately, at an extra price and with exclusions, such as telemetry, support and some AI services, which keep leaving Europe. Even securing level 1 requires the customer to know what to ask for and to pay for it. The problem starts at level 2. As long as the parent company is subject to the CLOUD Act and FISA 702, a provider controlled from the United States cannot guarantee that no foreign actor accesses the data or suspends the service. The 2025 case in which the email account of an International Criminal Court prosecutor was suspended following US sanctions is cited in the preparatory work as the very scenario level 2 is meant to prevent.<\/p>\n

Their answer is the trustee model: American technology operated by a European entity that holds the keys and employs the staff. S3NS (Thales with Google), Bleu (Orange and Capgemini with Microsoft) and AWS's European Sovereign Cloud all follow that path. The Commission's tender showed its limit: the consortium that relied on S3NS stayed at SEAL-2, the minimum, while the native European providers reached SEAL-3. CADA level 3 only admits providers controlled from third countries if the Commission formally recognises the jurisdiction and safeguards are demonstrated; level 4 admits no exceptions.<\/p>\n

Where this leaves Sooma<\/h2>\n

Sooma is a European company, with its capital, management and team in the EU, that has run its own infrastructure since 2018: servers exclusively in Europe, beyond the reach of third-country laws. The structural criteria of CADA levels 2 and 3, establishment and data in the EU, a European subcontracting chain, no third-country control and a European team, are simply how Sooma has always operated. Sooma Business, with email, drive and chat built on open-source software, meets the technological openness criterion that the SEAL framework values and that prevents vendor lock-in.<\/p>\n

The table below sets the CADA and SEAL framework criteria against what each type of provider can demonstrate today.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
What the buyer will require<\/th>\nMicrosoft, Google, Amazon<\/th>\nSooma<\/th>\n<\/tr>\n<\/thead>\n
Establishment and control in the EU<\/td>\nEuropean subsidiary, but ultimate control in the US; only addressed through a trustee model (S3NS, Bleu, AWS European Sovereign Cloud)<\/td>\nEuropean company, capital and management in the EU<\/td>\n<\/tr>\n
Data, backups and logs in the EU<\/td>\nEuropean regions available; telemetry and support not always confined to the EU<\/td>\nServers exclusively in Europe<\/td>\n<\/tr>\n
European subcontractors<\/td>\nGlobal hardware, software and support chain<\/td>\nData centres, connectivity and suppliers in the EU<\/td>\n<\/tr>\n
Immunity from third-country orders and sanctions<\/td>\nCannot be guaranteed while the parent company is subject to the CLOUD Act and FISA 702; the trustee model stayed at SEAL-2 in the Commission's tender<\/td>\nSubject only to the law of the EU and its Member States<\/td>\n<\/tr>\n
Privileged-access staff who are EU citizens (level 3)<\/td>\nOnly in the trustee offerings, within a limited perimeter<\/td>\nTeam entirely in the EU<\/td>\n<\/tr>\n
Customer data not used to train third-country AI<\/td>\nDepends on contractual clauses; the AI models are operated from the US<\/td>\nNo model training on customer data<\/td>\n<\/tr>\n
Technological openness and a 12-month exit plan<\/td>\nProprietary formats and APIs; complex migration<\/td>\nSooma Business is open source; open formats and portability<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The hyperscalers' limit is not technical, it is legal: however much they invest in European regions and partners, ultimate control and exposure to US law do not change. That is precisely the criterion that CADA level 3 and SEAL-3 put at the centre.<\/p>\n

For public bodies and companies in critical sectors across Europe, the message is simple: the providers that will be eligible in 2028 already exist today, and the criteria for telling them apart are already published.<\/strong><\/em><\/p>\n

Sources<\/h2>\n