What is the EU’s Cloud Sovereignty Framework and will it be enough?

Chips from Taiwan, oil from the Persian Gulf, and cars from Germany – what was long taken for granted is now being called into question all over the world.

<![CDATA[ <article> <p>Chips from Taiwan, oil from the Persian Gulf, and cars from Germany – what was long taken for granted is now being called into question all over the world. Where markets and expertise are concentrated among a few providers, enormous economies of scale arise.</p><p>At the same time, however, dependencies also grow – often with risks that only become apparent when supplies fail, prices rise, demand evolves, policies change, or individual players begin to monopolize the market.</p><p>Take AI, for example – according to research institute, Epoch AI, only two notable AI models have emerged in Europe over the past twenty years compared to 50 in the US and 30 in China. The technology has moved so quickly that the repercussions of this imbalance are only just beginning to be felt in European markets.</p><h2 id="is-europe-becoming-too-dependent">Is Europe becoming too dependent?</h2><p>From <a href="https://www.techradar.com/best/free-office-software">office applications</a> to storage and computing resources to <a href="https://www.techradar.com/best/best-small-business-software">software</a>, what providers deliver from their data centers in a highly scalable, maximally available, and extremely innovative manner does not, in most cases, originate from the European continent.</p><p>According to Bitkom’s Cloud Report 2026, roughly 85% of German companies consider Germany to be too dependent on US providers, and almost two thirds of local users (64%) feel compelled to review their own IT strategy due to US government policy. Countries like France are already taking action, with the French government announcing plans to replace Windows with Linux on its government computers.</p><p>At the same time, the national health insurance fund has already migrated 80,000 <a href="https://www.techradar.com/pro/best-employee-management-software-of-year">employees</a> from Microsoft Teams, Zoom, and Dropbox to its own alternatives. </p><p>Whether in Germany or France, the question of how digitally dependent companies, governments, and societies are on individual suppliers is being asked throughout Europe. And it has been for some time. While Gaia-X focused on common standards for sovereign <a href="https://www.techradar.com/best/best-cloud-computing-services">cloud computing</a>, the EU is now pursuing a more pragmatic approach. </p><p>The Cloud Sovereignty Framework (CSF), unveiled in October 2025, aims to make digital sovereignty measurable. To achieve this, it builds on initiatives such as Gaia-X as well as regulations like DORA and NIS2, with the ultimate goal of being able to prioritize compliant, low-risk providers in public procurement.</p><h2 id="the-sovereignty-metric-score">The sovereignty metric score</h2><p>Controlling and regionally consolidating one’s own digital traffic flows. That’s quite a task in a world where AI superpowers are evolving overseas. With regard to IT supply chains, the framework favors providers who operate their environments in a transparent, resilient, and sufficiently sovereign manner to ensure that systems are protected from external influences or the interests of third parties.</p><p>This means, for example, that data paths must be traceable and controllable at the regional level to ensure they remain within the EU legal framework. In other words, there is no sovereign <a href="https://www.techradar.com/best/best-cloud-databases">cloud</a> without an interconnection strategy. After all, Internet Exchanges (IXs) already play a key role when it comes to processing bits and bytes locally. Wherever companies, networks, and clouds connect at IXs, they exchange information along paths that can be precisely defined geographically.</p><p>Although the EU does not explicitly make IXs a scoring criterion, it’s heavily implied. For example, the CSF also evaluates cloud services based on supply chain-related legal, operational, and technological objectives. This concept is also reflected in the NIS2 Directive and argues in favor of more decentralized and resilient backbones, such as mutually secured interconnection platforms, such as IXs.</p><p>In practical terms, this means that any IT landscape is only as secure as the individual elements that comprise it. So, if all partners design the components they provide to others with multiple layers of redundancy, the overall system becomes not only more reliable but also more independent for everyone.</p><p>Distributed and provider-neutral IXs have already made this principle their guiding philosophy: to allow data to be exchanged with high availability, security, and control – between all companies, partners, and clouds within the digital ecosystem.</p><h2 id="europe-at-a-crossroads">Europe at a crossroads</h2><p>Technical issues can usually be resolved easily, but legal ones often cannot. Therefore, the CSF is unlikely to revolutionize the European cloud market overnight, but it can steer public demand in a targeted manner. As a result, hybrid, multi-cloud, and on-premises approaches are becoming more important, and IT is becoming infinitely more complex.</p><p>While unravelling this complexity will take additional effort, the pay-off of rearchitecting networks around neutral IXs will be a two for one: not only will it reduce long-term lock-in risks but will also reduce the threat of having to pay significantly higher prices later on when things inevitably change. Europe must now consciously accept this and align and strengthen its own provider market accordingly.</p><p>Just as operations would come to a standstill for 46% of companies in a prolonged outage, without the cloud, there can be no functional public administration – and no independent, sovereign, and thus capable state.</p><p><em></em><a href="https://www.techradar.com/best/best-cloud-storage&quot"><em>We've featured the best cloud storage.</em></a></p><p><em>This article was produced as part of </em><a href="https://www.techradar.com/pro/perspectives" target="_blank"><em>TechRadar Pro Perspectives</em></a><em>, our channel to feature the best and brightest minds in the technology industry today.</em></p><p><em>The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: </em><a href="https://www.techradar.com/news/submit-your-story-to-techradar-pro" target="_blank"><em>https://www.techradar.com/pro/perspectives-how-to-submit</em></a></p> </article> ]]>