EU Cloud Sovereignty Framework
SEAL Levels
The European Commission's framework for comparing how sovereign cloud services are. It rates eight sovereignty objectives on the Sovereignty Effectiveness Assurance Level (SEAL) scale and is used to set minimum sovereignty requirements in cloud tenders.
8
Objectives
SOV-1 through SOV-8
5
Assurance Levels
SEAL-0 to SEAL-4
Min
Overall Level
Weakest objective
20%
Heaviest Weight
Supply chain (SOV-5)
What is the EU Cloud Sovereignty Framework?
The framework describes digital sovereignty as eight objectives — from who ultimately controls the provider to its supply chain and environmental footprint — and rates each one from SEAL-0 (no sovereignty) to SEAL-4 (full digital sovereignty).
It combines the ratings two ways. The SEAL level is the weakest objective: a procurer sets a minimum SEAL per objective, and an offer below it on any one is rejected. The Sovereignty Score is a weighted average that ranks the offers that pass.
BSI C3A is structured on the same objectives and turns SOV-1 to SOV-6 into verifiable criteria. No body issues SEAL certificates today, and the ratings providers publish are self-assessments — which is why an independent, evidence-based assessment matters.
The SEAL Scale
No sovereignty
Service, technology or operations under exclusive control of non-EU parties, governed entirely by non-EU law.
Jurisdictional sovereignty
EU law formally applies, but with limited practical enforceability.
Data sovereignty
EU law applies and is enforceable; material non-EU dependencies remain.
Digital resilience
EU law applies and is enforceable; EU actors exercise meaningful but not full influence.
Full digital sovereignty
Technology and operations under full EU control, with no critical non-EU dependency.
8 Sovereignty Objectives
The framework's weights, and the pillars and questions this platform rates each objective from.
Strategic Sovereignty
15%Measured by: Legal 60% · Operational 20% · Data 20% — CSP parent jurisdiction, change-of-control notice, executive accountability, vendor register, concentration and provider-exit risk
Legal & Jurisdictional Sovereignty
10%Measured by: Legal — Governing law and venue, extraterritorial access, transparency, DPA, DPO, regulator access
Data & AI Sovereignty
10%Measured by: Data — Residency, key custody, lifecycle, DPIA, AI training and inference location
Operational Sovereignty
15%Measured by: Operational 70% · Identity 30% — Administrator and SOC location, support model, lockbox, continuity, identity provider hosting
Supply Chain Sovereignty
20%Measured by: Legal 50% · Technological 50% — Sub-processors, foreign sub-contractors, SBOM, hardware origin, critical dependency map
Technology Sovereignty
15%Measured by: Technological — Open standards, portability, exit plan, container platform, open model formats
Security & Compliance Sovereignty
10%Measured by: Identity 50% · Operational 50% — Privileged access, MFA, audit logs, incident notification, security policy and independent audit
Environmental Sustainability
5%Measured by: Its own questions only (no pillar) — Energy and renewable reporting, ISO 14001 / EU Code of Conduct, hardware lifecycle, energy and raw-material resilience — asked in EU regions, never assumed to pass
How This Platform Rates SEAL
Objective score
For a questionnaire-based run, the penalty-weighted share of the objective’s own questions that meet their expected answer. For a scan-only run, the pillars that measure it, less a deduction per failed control.
SEAL per objective
Score 85+ is SEAL-4, 70+ SEAL-3, 55+ SEAL-2, 35+ SEAL-1. An open mandatory control caps the objective at SEAL-2 and any other open control at SEAL-3 — SEAL-4 means nothing critical is left open.
Weakest link
The overall SEAL is the lowest objective. A high average cannot hide one weak area, exactly as in a tender that sets a minimum SEAL per objective.
Sovereignty Score
The framework’s weighted average of the assessed objectives — used to rank offers that already meet the minimum.
Turn the rating on in the assessment scope brief — Is this for an EU sovereign-cloud tender? — with the tender's minimum SEAL per objective, or select the framework directly. The report then shows which objectives fall below their minimum and the open controls behind each.
Disclaimer
SEAL ratings produced by this platform are assessor-attested evaluations derived from the assessment's answers and evidence. They are not a SEAL certificate, and the thresholds that turn objective scores into levels are this platform's method, not the Commission's. Environmental sustainability (SOV-8) is rated only from its own questions and shows as not assessed without them. Check the framework version a tender references before relying on a rating.
Need a SEAL rating for a workload or provider?
Answer Yes to the EU tender question in the scope brief, or select the framework for an EU region.