More Sovereignty Measurements…Towards a Meta-Framework?

The EU Cloud Sovereignty Framework: Scoring Sovereignty on a Ladder The Commission’s framework of October 2025 defines eight sovereignty objectives: Strategic Sovereignty (SOV-1), Legal & Jurisdictional Sovereignty (SOV-2), Data & AI Sovereignty (SOV-3), Operational Sovereignty (SOV-4), Supply Chain Sovereignty (SOV-5), Technology Sovereignty (SOV-6), Security & Compliance (SOV-7), and Environmental Sustainability (SOV-8). In April 2026, the Commission awarded its €180 million sovereign cloud tender to four providers: a Post Telecom-led consortium with CleverCloud and OVHcloud, STACKIT, Scaleway, and a Proximus-led consortium partnering with S3NS (a Thales-Google Cloud joint venture), Clarence, and Mistral. ZenDiS: Sovereignty as an Organisational Health Check As a prior observation: ZenDiS is currently moving beyond the confines of the German administrative framework – and while the organisation itself remains a public body, its products are being made suitable for a mass market through a European partner network. The ZenDiS concept of “Wechselmöglichkeit” maps directly to the EU framework’s portability requirements under SOV-6 and to EuroStack’s criterion of “Operational Reversibility.” And all three recognise that data sovereignty requires more than localisation – it demands customer-controlled encryption and protection of metadata, backups, and logs, not just primary data stores. Still BSI’s 6 pillars map quite closely to EuroStack’s 5 dimensions (JOTED): Strategic & Legal (BSI SOV-1 & SOV-2) ↔ Jurisdiction & Governance (EuroStack): Both frameworks require a EU-based headquarter, structural insulation from foreign laws, and effective corporate control by EU entities. EuroStack treats Economic Sovereignty as a “Key Differentiator” (Level 3 award criteria), requiring the provider to have >50% of its global R&D in Europe, prohibit punitive data egress fees, and actively contribute to the European SME and Open Source ecosystems.