Sovereignty is more than a promise

Europe is making sovereignty measurable

With the Cloud Sovereignty Framework, the European Commission assesses cloud services on a scale from SEAL-0 (no sovereignty) to SEAL-4 (full European control, from chip to software). For the April 2026 tender, SEAL-2 was the minimum entry requirement.

In June 2026, the proposal for the Cloud & AI Development Act (CADA) followed. It introduces four Union Assurance Levels. The lower levels require a European establishment, data within the EU, and transparency regarding subcontractors. The higher levels set requirements for ownership, control, and exposure to non-EU legislation.

CADA is still a proposal, but the direction is clear. Both frameworks treat sovereignty not as a binary yes or no, but as a layered structure. That is exactly how you, as an organization, should look at it as well.

‍

Location is only the first layer

A data center in the Netherlands or Europe feels good, but it doesn't actually say anything about true sovereignty. If the provider is subject to US law, the Cloud Act applies and the data is immediately accessible, regardless of where the servers are located. But even the right jurisdiction isn't the whole story. Ultimately, sovereignty revolves around three questions:

1. Who holds the keys?

Who can access your data? Who manages the encryption keys and who has administrative rights to the environment? If the data is encrypted but the key is held by a party subject to foreign law, the encryption is merely a formality.

2. What law is the owner subject to?

It is not just about the party you have a contract with. The parent company, subcontractors, and the technology supply chain all count. The European frameworks therefore explicitly look through the entire chain.

3. Can you keep running if a service goes down?

This is the question most often skipped. Who can pull the plug? Think of a blocked account, a changed license, sanctions, or a large-scale outage. Sovereignty also means that your data is recoverable: an independent, immutable copy in a location that you control yourself.

Not everything needs to be at the maximum level

Sovereignty comes at a price, and not every workload requires it. A marketing tool or a test environment can perfectly well run in a different cloud. Business-critical applications, personal data, and the processes that customers and citizens rely on are a different story. The real question is: which part of your organization must remain under your control? And you determine that per workload, not by selecting a single provider.

Since August 15, 2026, this is no longer an optional choice for many Dutch organizations, but a requirement. The Cybersecurity Act, the Dutch implementation of NIS2, demands risk management, insight into suppliers, and demonstrable continuity. Cybersecurity has thus become a board-level responsibility. If you don't know your dependencies, you cannot account for them.

Open source is no magic bullet

Open source is often cited as the ultimate path to digital autonomy. There is a case to be made for that: no owner can pull the plug, and the code is open for anyone to inspect. However, that openness cuts both ways. This year, AI models identified hundreds of serious vulnerabilities in widely used open source projects, some of which had gone unnoticed for years. The recent PHP vulnerability has heightened this awareness.

Open source is great in theory, but it is no guarantee. What matters is who manages the environment and how quickly a vulnerability is patched. Sovereignty lies in management, not in the license.‍

Honest about dependency

Full sovereignty, from chip to software, is barely feasible in practice. This also applies to European cloud providers. Almost every IT environment uses technology from outside the EU at some point. This is true for Fundaments as well. We are a Dutch company with no parent company under foreign law. Data and management remain in the Netherlands, handled by Dutch engineers. At the same time, we work with technology from international suppliers. We acknowledge this dependency and design our environment so that we cannot be held hostage by it.

We look primarily at the data. For us, sovereignty is the certainty that you can access your data under European law and under all circumstances, and that you can prove it. This means maximum technical protection, immutable backups, and fast patching cycles, including reporting that an auditor can request.‍

Start at the core

Sovereignty does not start with choosing a provider. It starts with insight. Which systems and data are critical? Who holds the keys to them? Under what law do the parties in your supply chain fall? And how quickly can you be operational again if a link fails?

Anyone who can answer these questions for each workload knows exactly where maximum control is needed and where it is not. We are happy to help answer these questions and provide insight into your dependencies.

Next week, Larik-Jan will be speaking about this at Fusion Forward. Want to know more about this event? Take a look here.

‍