For most of the internet's commercial history, the question of where data lives was considered a technical detail — an implementation choice made by engineers optimising for latency and cost, not a political decision with consequences for national security, democratic governance, and individual rights. That era is over. In 2026, data sovereignty has become one of the defining geopolitical contests of the decade, and the European Union's Cloud and AI Development Act (CADA), introduced in June 2026, represents the most ambitious attempt yet to translate the principle of digital sovereignty into enforceable law.
The stakes are considerable. US hyperscalers — Amazon Web Services, Microsoft Azure, and Google Cloud — control more than 70% of the European cloud market. These companies are subject to the US Clarifying Lawful Overseas Use of Data (CLOUD) Act, which allows US authorities to compel the production of data held by US-incorporated companies regardless of where that data is physically stored. The result is a structural conflict at the heart of European digital infrastructure: data stored in EU data centres, on servers operated by US companies, remains legally accessible to US authorities in ways that may violate EU law. This is not a theoretical risk. It is an operational reality that European organisations must navigate every day.
The Residency Illusion
The central conceptual contribution of the 2026 regulatory moment is the distinction between data residency and data sovereignty. These terms are frequently conflated, but they describe fundamentally different things. Data residency refers to the physical location of data — the country in which the servers storing it are located. Data sovereignty refers to the legal jurisdiction under which data is governed — the legal system that determines who can access it, under what conditions, and with what protections.
The distinction matters because residency does not guarantee sovereignty. A European company that stores its data in an AWS data centre in Frankfurt has achieved data residency in Germany, but not data sovereignty over its data. The data remains subject to the jurisdiction of AWS's US parent company, which is in turn subject to the CLOUD Act. US authorities can compel AWS to produce the data without the knowledge or consent of the European data subject, and without going through the mutual legal assistance treaty (MLAT) process that would normally govern cross-border law enforcement cooperation.
This "residency illusion" — the false comfort of physical proximity without legal protection — has been the central target of European digital sovereignty policy for the past several years. The CADA framework addresses it directly by establishing a four-level "Union Assurance" framework that classifies cloud services not by where their data centres are located, but by the legal jurisdiction to which they are subject and the degree of independence they maintain from third-country legal demands.
"Data residency and data sovereignty are not the same thing. Storing your data in a Frankfurt data centre operated by a US company gives you the former but not the latter — and in 2026, that distinction has become legally consequential."
The CADA Framework: Four Levels of Sovereignty Assurance
The Cloud and AI Development Act establishes a tiered framework for assessing the sovereignty of cloud services used by public-sector bodies and critical infrastructure operators. The four levels represent a graduated scale of sovereignty assurance, from basic data residency to full independence from third-country legal jurisdiction.
Level 1: Data Residency
Level 1 requires that data be stored and processed within EU territory. This is the minimum requirement for general public administration workloads and represents the baseline that most major cloud providers already meet through their EU-region offerings. However, as the residency illusion analysis makes clear, Level 1 compliance does not protect against CLOUD Act demands or other forms of extraterritorial legal reach.
Level 2: Jurisdictional Independence
Level 2 adds the requirement that the cloud provider be independent of third-country legal jurisdiction — meaning that it cannot be compelled by a non-EU government to produce data without going through EU legal channels. This requirement effectively excludes US hyperscalers from Level 2 compliance, even when they operate EU-based "sovereign cloud" programmes. AWS's European Sovereign Cloud, launched in Brandenburg, remains subject to US parent company jurisdiction and therefore cannot achieve Level 2 status under the CADA framework.
Level 2 also requires software supply chain transparency — the ability to audit the provenance and integrity of the software components used in the cloud service. This requirement reflects growing concern about the security implications of opaque software supply chains, particularly in the wake of high-profile supply chain attacks that have compromised critical infrastructure in recent years.
Data residency and data sovereignty are not the same thing. Storing your data in a Frankfurt data centre operated by a US company gives you the former but not the latter — and in 2026, that distinction has become legally consequential.
Level 3: EU Ownership and Control
Level 3 adds requirements for EU ownership, control, and personnel citizenship. Cloud services at this level must be owned and controlled by EU-incorporated entities, with key personnel holding EU citizenship. This level is designed for the most sensitive public-sector workloads — defence, intelligence, critical national infrastructure — where the risk of foreign interference is highest and the consequences of a breach are most severe.
Level 4: Full Supply Chain Sovereignty
Level 4 represents the highest level of sovereignty assurance, requiring full supply chain transparency and prohibiting any third-country interference. This level is reserved for the most critical sovereignty functions — the infrastructure that underpins democratic governance, national security, and essential public services. At Level 4, every component of the cloud service — hardware, software, personnel, governance — must be demonstrably free from third-country influence.
The Compliance Cascade
The CADA framework does not operate in isolation. It is the centrepiece of a broader "compliance cascade" — a set of overlapping regulations that collectively enforce digital sovereignty across different sectors and use cases. Understanding this cascade is essential for organisations navigating the 2026 regulatory environment.
The EU Data Act
The EU Data Act, fully applicable since September 2025, addresses the vendor lock-in problem that has made it difficult for organisations to move workloads between cloud providers. The Act mandates cloud switching and portability, requiring providers to eliminate technical and financial barriers to migration. All egress and migration fees must be eliminated by January 2027 — a requirement that directly targets the pricing practices that hyperscalers have used to make switching prohibitively expensive.
The Data Act also requires providers to block unlawful third-country government access — a provision that directly addresses the CLOUD Act conflict. Providers that comply with CLOUD Act demands without going through EU legal channels risk violating the Data Act, creating a legal dilemma that can only be resolved by restructuring their legal and operational relationships with their US parent companies.
NIS2 and DORA
The NIS2 Directive, fully effective in 2026, extends cybersecurity and incident reporting obligations to a wider range of critical sectors, including energy, transport, health, and digital infrastructure. Its supply chain security requirements are particularly significant: organisations must assess and manage the cybersecurity risks posed by their technology suppliers, including cloud providers. This requirement creates a direct incentive to prefer suppliers whose supply chains are transparent and auditable — a characteristic more easily achieved by EU-incorporated providers than by US hyperscalers with complex global supply chains.
The Digital Operational Resilience Act (DORA), which applies specifically to the financial sector, goes further by requiring direct supervisory oversight of Critical Third-Party Providers (CTPPs) — a category that includes major cloud providers. Financial institutions that rely on a single US hyperscaler for critical functions face regulatory pressure to treat this concentration as a systemic risk and to develop credible alternatives. The practical effect is to push financial institutions toward multi-cloud architectures that include at least one EU-sovereign provider.
"The compliance cascade of 2026 — CADA, the Data Act, NIS2, DORA, and the EU AI Act — is not a collection of independent regulations. It is a coherent architecture for enforcing digital sovereignty across every sector of the European economy."
The EU AI Act
The EU AI Act adds a further dimension to the sovereignty challenge. High-risk AI systems — those used in critical infrastructure, employment decisions, education, law enforcement, and other sensitive domains — must comply with stringent requirements for transparency, accountability, and human oversight. These requirements are difficult to meet when the AI system is hosted on infrastructure that is subject to third-country legal jurisdiction, because the provider may be compelled to modify or disclose the system's operation in ways that violate EU law.
The compliance cascade of 2026 — CADA, the Data Act, NIS2, DORA, and the EU AI Act — is not a collection of independent regulations. It is a coherent architecture for enforcing digital sovereignty across every sector of the European economy.
The AI Act's phased enforcement timeline — with full enforcement of high-risk AI requirements expected by 2027–2028 — gives organisations time to restructure their AI infrastructure, but the direction of travel is clear: high-risk AI systems will increasingly need to be hosted on EU-sovereign infrastructure to achieve full compliance.
GAIA-X: From Vision to Operational Reality
The GAIA-X initiative — launched in 2020 as a European vision for federated, interoperable cloud infrastructure — has matured significantly by 2026. The release of Trust Framework 3.0 "Danube" in late 2025 provided the standardised interfaces and federated trust structures required for multi-cloud interoperability, and by mid-2026, over 400 service providers are certified under the GAIA-X framework.
GAIA-X's significance lies not in the infrastructure it provides directly, but in the standards it establishes. By defining common interfaces for data exchange, identity management, and service discovery, GAIA-X makes it possible for organisations to move workloads between EU-sovereign providers without the technical lock-in that has historically made cloud migration prohibitively expensive. The initiative works with partners including CISPE (Cloud Infrastructure Services Providers in Europe) to deliver thousands of trust-labelled services that meet defined sovereignty criteria.
The practical impact of GAIA-X is still developing. Critics have noted that the initiative has been slow to translate its technical standards into widely adopted products, and that the fragmentation of the European cloud market — with dozens of national providers competing for a relatively small pool of sovereignty-conscious customers — limits the economies of scale that would make EU-sovereign cloud services cost-competitive with US hyperscalers. These are legitimate concerns, but they reflect the difficulty of building a new market rather than a fundamental flaw in the GAIA-X approach.
The Self-Hosting Surge
For organisations that cannot wait for the EU-sovereign cloud market to mature, a more immediate response to the sovereignty challenge has emerged: self-hosting. Driven by the need for control over sensitive data and communications, many organisations are moving away from US hyperscalers for core data and communication tools, adopting open-source, self-hosted alternatives such as Mattermost (for team communications), Nextcloud (for file storage and collaboration), and Keycloak (for identity and access management).
The self-hosting surge is documented in detail by a 2026 analysis from Elest.io, which tracks the adoption of self-hosted alternatives to major cloud services. The analysis finds that EU data residency laws — particularly the NIS2 Directive's supply chain security requirements and the GDPR's restrictions on data transfers to third countries — are the primary drivers of self-hosting adoption among European organisations. The analysis also notes the emergence of "managed sovereignty" platforms — services that provide managed hosting for open-source tools on EU-based infrastructure, allowing organisations to achieve compliance without the operational overhead of traditional self-hosting.
The Tiered Workload Approach
The most sophisticated organisations are not choosing between hyperscaler and sovereign cloud as an all-or-nothing decision. Instead, they are adopting a tiered workload classification approach that matches the sovereignty requirements of each workload to the appropriate infrastructure:
- Sovereignty-Critical (Tier 1): Workloads involving the most sensitive data — personal health records, financial data, national security information — are hosted on bare-metal, on-premises, or in-country infrastructure that provides physical and legal chain of custody.
- Residency-Required (Tier 2): Workloads that require EU data residency but not full sovereignty are hosted on EU-sovereign cloud VMs with strict contractual and technical controls.
- Standard Compliance (Tier 3): Workloads with standard compliance requirements are hosted on major cloud providers' EU regions, with robust Data Processing Agreements and technical controls to limit data exposure.
This tiered approach allows organisations to manage the cost and complexity of sovereignty compliance while ensuring that their most sensitive workloads receive the highest level of protection. It also provides a migration path: as EU-sovereign cloud services mature and become more cost-competitive, organisations can progressively move Tier 3 workloads to higher sovereignty tiers.
The most sophisticated organisations are not choosing between hyperscaler and sovereign cloud. They are building tiered architectures that match the sovereignty requirements of each workload to the appropriate infrastructure — and that architecture is becoming a competitive advantage.
"The most sophisticated organisations are not choosing between hyperscaler and sovereign cloud. They are building tiered architectures that match the sovereignty requirements of each workload to the appropriate infrastructure — and that architecture is becoming a competitive advantage."
The Geopolitical Dimension
The digital sovereignty debate cannot be understood without its geopolitical context. The concentration of internet infrastructure in the hands of US hyperscalers is not merely a market outcome; it is a geopolitical reality with strategic implications. European institutions have become increasingly concerned about "digital dependency" — the risk that critical European infrastructure is controlled by companies subject to the laws and policies of a foreign government.
This concern has been sharpened by the experience of the past several years, in which geopolitical tensions have demonstrated the potential for technology to be weaponised as an instrument of statecraft. The use of export controls to restrict access to advanced semiconductors, the threat of sanctions against technology companies, and the growing use of data as a tool of intelligence gathering have all contributed to a European consensus that digital sovereignty is a strategic imperative, not merely a regulatory preference.
The CADA framework, in this context, is not simply a compliance exercise. It is a strategic investment in European autonomy — an attempt to ensure that European institutions, businesses, and citizens retain meaningful control over their digital infrastructure in an era of geopolitical competition. Whether it succeeds will depend not only on the quality of the regulatory framework, but on the willingness of European organisations to invest in EU-sovereign alternatives and the ability of European cloud providers to deliver services that are genuinely competitive with US hyperscalers.
Implications for Organisations
For organisations operating in Europe, the 2026 regulatory environment creates both obligations and opportunities. The obligations are clear: organisations that handle sensitive data — particularly in the public sector, financial services, healthcare, and critical infrastructure — must assess their cloud infrastructure against the CADA framework and develop plans to achieve the appropriate level of sovereignty assurance.
The opportunities are less obvious but equally significant. Organisations that invest early in EU-sovereign infrastructure will be better positioned to compete for public-sector contracts, to demonstrate compliance with the full compliance cascade, and to build the trust of customers and partners who are increasingly concerned about data sovereignty. In a market where sovereignty is becoming a differentiator, early movers have a structural advantage.
The path forward requires a clear-eyed assessment of workload sovereignty requirements, a realistic evaluation of available EU-sovereign alternatives, and a phased migration plan that manages cost and complexity while progressively reducing dependence on third-country infrastructure. It also requires engagement with the GAIA-X ecosystem and the broader European cloud market — not as a compliance exercise, but as a strategic investment in the infrastructure of European digital autonomy.
Key Takeaways
- The EU's Cloud and AI Development Act (CADA, June 2026) establishes a four-level sovereignty assurance framework that goes far beyond data residency to address jurisdictional independence, ownership, and supply chain transparency.
- The "residency illusion" — storing data in EU data centres operated by US companies — does not provide sovereignty protection against the US CLOUD Act.
- The compliance cascade (CADA, Data Act, NIS2, DORA, EU AI Act) creates overlapping obligations that collectively enforce digital sovereignty across all sectors of the European economy.
- GAIA-X Trust Framework 3.0 "Danube" provides the interoperability standards needed for multi-cloud sovereignty, with over 400 certified providers by mid-2026.
- A tiered workload classification approach — matching sovereignty requirements to infrastructure — is the most practical path for organisations navigating the 2026 regulatory environment.
