The Cloud Sovereignty Framework: measurable progress or missed opportunity?
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Chips from Taiwan, oil from the Persian Gulf, and cars from Germany – what was long taken for granted is now being called into question all over the world. Where markets and expertise are concentrated among a few providers, enormous economies of scale arise.
At the same time, however, dependencies also grow – often with risks that only become apparent when supplies fail, prices rise, demand evolves, policies change, or individual players begin to monopolize the market.
Take AI, for example – according to research institute, Epoch AI, only two notable AI models have emerged in Europe over the past twenty years compared to 50 in the US and 30 in China. The technology has moved so quickly that the repercussions of this imbalance are only just beginning to be felt in European markets.
From office applications to storage and computing resources to software, what providers deliver from their data centers in a highly scalable, maximally available, and extremely innovative manner does not, in most cases, originate from the European continent.
According to Bitkom’s Cloud Report 2026, roughly 85% of German companies consider Germany to be too dependent on US providers, and almost two thirds of local users (64%) feel compelled to review their own IT strategy due to US government policy. Countries like France are already taking action, with the French government announcing plans to replace Windows with Linux on its government computers.
At the same time, the national health insurance fund has already migrated 80,000 employees from Microsoft Teams, Zoom, and Dropbox to its own alternatives.
Whether in Germany or France, the question of how digitally dependent companies, governments, and societies are on individual suppliers is being asked throughout Europe. And it has been for some time. While Gaia-X focused on common standards for sovereign cloud computing, the EU is now pursuing a more pragmatic approach.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The Cloud Sovereignty Framework (CSF), unveiled in October 2025, aims to make digital sovereignty measurable. To achieve this, it builds on initiatives such as Gaia-X as well as regulations like DORA and NIS2, with the ultimate goal of being able to prioritize compliant, low-risk providers in public procurement.
Controlling and regionally consolidating one’s own digital traffic flows. That’s quite a task in a world where AI superpowers are evolving overseas. With regard to IT supply chains, the framework favors providers who operate their environments in a transparent, resilient, and sufficiently sovereign manner to ensure that systems are protected from external influences or the interests of third parties.
This means, for example, that data paths must be traceable and controllable at the regional level to ensure they remain within the EU legal framework. In other words, there is no sovereign cloud without an interconnection strategy. After all, Internet Exchanges (IXs) already play a key role when it comes to processing bits and bytes locally. Wherever companies, networks, and clouds connect at IXs, they exchange information along paths that can be precisely defined geographically.
Although the EU does not explicitly make IXs a scoring criterion, it’s heavily implied. For example, the CSF also evaluates cloud services based on supply chain-related legal, operational, and technological objectives. This concept is also reflected in the NIS2 Directive and argues in favor of more decentralized and resilient backbones, such as mutually secured interconnection platforms, such as IXs.
In practical terms, this means that any IT landscape is only as secure as the individual elements that comprise it. So, if all partners design the components they provide to others with multiple layers of redundancy, the overall system becomes not only more reliable but also more independent for everyone.
