The European Commission has awarded a framework contract worth up to €180 million over six years for EU institutions, bodies, offices, and agencies to procure sovereign cloud services. The four winners are Post Telecom along with CleverCloud and OVHcloud, STACKIT, Scaleway, and Proximus with a consortium including S3NS, Clarence, and Mistral. The decision was announced on April 17 as a move to strengthen European digital sovereignty and reduce dependence on a single provider or a single technological ecosystem.
The news is significant not only for the amount involved but also for what it symbolizes. Brussels has opted not for a large contract concentrated in one company, but for four parallel awards. The Commission explains that this diversification aims for resilience and seeks to avoid excessive dependency on a single actor. In other words, European digital sovereignty is no longer viewed solely as a matter of data location but also as a market policy, industrial capacity, and strategic risk reduction.
There is also an important nuance: this move does not mean excluding any non-European technology. The Commission emphasizes that the process demonstrates that non-European technologies, when operated within a strict and appropriate framework, can meet the minimum sovereignty levels required. This is clearly illustrated by Proximus, which competes with S3NS—the joint venture of Thales and Google Cloud—as well as Clarence and Mistral. The political message, therefore, is not one of absolute closure but of effective control.
Behind the award is also an evident industrial interpretation. Europe has been debating for years how to attain autonomy from US hyperscalers, not just for economic reasons but also for legal and geopolitical considerations. The sovereignty framework set by the Commission takes into account, among others, exposure to extracomunitarian laws with cross-border reach, such as the US CLOUD Act, as well as control over operations, supply chains, technological openness, and regulatory compliance within the EU.
What Brussels Considered in Its Decision
The award was based on the so-called Cloud Sovereignty Framework, a document from the Directorate General for Digital Services of the Commission that defines eight sovereignty objectives. These include strategic, legal and jurisdictional, data and AI, operational, supply chain, technological, security and compliance, and environmental sustainability sovereignty. The framework not only demands cybersecurity but also aims to measure how deeply a provider is anchored in the European legal, industrial, and operational ecosystem.
The system also establishes various levels of assurance, known as SEAL. These range from SEAL-0, defined as a lack of sovereignty due to exclusive control by non-European third parties, to SEAL-4, embodying full digital sovereignty with technology and operations under complete control of the EU and no critical non-community dependencies. To qualify for the contract, providers had to meet minimum assurance levels and pass an evaluation combining public documentation, tests submitted by vendors, and an additional sovereignty score.
This scoring also reveals Brussels’s priorities. The framework places the greatest weight on supply chain sovereignty at 20%, and allocates 15% to strategic, operational, and technological sovereignty. The remaining points are divided among legal, data and AI, security and compliance, and environmental sustainability aspects. This distribution clearly enforces the idea that, for the Commission, sovereignty depends not only on who hosts the data but also on who controls the software, hardware, support, funding, and the capacity to evolve the service without becoming dependent on an external provider.
The Winners and the Significance of Each Choice
The list of winners also reflects a certain snapshot of the European cloud landscape. OVHcloud, CleverCloud, STACKIT, and Scaleway represent the most clearly European segment of the sector, with infrastructure, operations, and branding originating within the continent. Proximus, on the other hand, exemplifies a more pragmatic approach: a European company supported by partners including Mistral as a European AI actor, Thales, and Google Cloud via S3NS. The Commission appears to have aimed to recognize both realities: the fully European provider and the hybrid solution that, under certain conditions, can meet the required minimum sovereignty threshold.
This balance has political implications. On one hand, the Commission signals support for the European cloud ecosystem and demonstrates that it can contract large services without automatically relying on AWS, Microsoft Azure, or Google Cloud as primary providers. On the other hand, it stops short of closing the door entirely to non-European technologies when they are embedded within governance structures that meet its requirements. Fundamentally, Brussels is trying to build autonomy without disrupting the market reality, where much of the core technology still originates outside Europe.
What Comes Next: More Rules and Increased Market Pressure
The award is not an endpoint. The Commission has announced that it is finalizing an updated version of the Cloud Sovereignty Framework with more concrete criteria for sovereignty assessments, and intends to internally adapt these criteria to review the digital services it provides to its departments and other Union entities. This means this contract is not an exception but a model to be reused.
Additionally, Brussels is preparing a broader package of technological sovereignty initiatives, including the European open-source strategy, a future Chips Act 2, a strategic roadmap for digitalization and AI in energy, and the Cloud and AI Development Act (CADA). According to the Commission, this regulation aims to harmonize the definition of sovereignty in cloud and AI services within the single market, open more opportunities for sovereign offers, and facilitate the entry of a wider range of providers. If this package progresses, the €180 million award could be viewed in a few years as the first serious step toward a more ambitious industrial policy for European cloud infrastructure.
In this context, the contract’s value lies in its volume but even more in its precedent. Europe has historically spoken of digital sovereignty in more rhetorical than operational terms. This time, there are clear criteria, scores, assurance levels, and concrete awards. The real challenge now begins: to verify whether these four providers can turn the concept of sovereign cloud into a competitive, scalable, and attractive service that enables the European administration not only to set an example but also to genuinely reshape market rules.
Frequently Asked Questions
What exactly has the European Commission awarded?
It has awarded a framework contract worth up to €180 million over six years for EU institutions and agencies to procure sovereign cloud services from four selected providers.
Which companies won Brussels’s sovereign cloud tender?
The winners are Post Telecom with CleverCloud and OVHcloud, STACKIT, Scaleway, and Proximus with S3NS, Clarence, and Mistral.
Does this mean the EU excludes all non-European technology?
No. The Commission explicitly states that non-European technologies can meet the minimum sovereignty level if operated within a strict and appropriate framework, as demonstrated by Proximus’s consortium with S3NS.
What criteria does Brussels use to assess whether a cloud is sovereign?
The Cloud Sovereignty Framework evaluates eight objectives: strategic, legal and jurisdictional, data and AI, operational, supply chain, technological, security and compliance, and environmental sustainability sovereignty. It also employs SEAL levels and a sovereignty score to classify offers.
via: European Commission