The European Commission awarded a €180 million contract in April 2026 to buy “sovereign cloud” services for EU institutions and other EU bodies from four providers.
The procurement covers EU institutions, bodies, offices and agencies — referred to as “Union entities,” the Commission noted in a release on Monday.
The tender was run under the Commission’s Cloud III Dynamic Purchasing System, a framework used to buy cloud services, it added.
After receiving questions about how it applied its Cloud Sovereignty Framework, the Commission published additional clarification on the framework’s content.
The clarification sets out two “sovereignty scores” used in the procurement process.
Two scores used to assess cloud sovereignty
The first is a Sovereignty Effectiveness Assurance Level (SEAL), designed to assess whether providers meet specified thresholds for “sovereignty and resilience”, the Commission said.
Those thresholds correspond to three levels: data sovereignty (SEAL-2), technological autonomy (SEAL-3) and full sovereignty (SEAL-4).
The second is an overall sovereignty score based on 48 criteria, each with a defined scoring method.
The criteria are grouped into eight categories: strategic; legal and jurisdictional; data and AI; operational; supply chain; technological; security and compliance; and environmental sustainability.
The Commission has also published implementation guidance for the Cloud Sovereignty Framework, alongside a separate statement about the procurement.
