A sovereignty scorecard for every public cloud contract
The European Commission presented the Cloud and AI Development Act on June 3, 2026, as the centerpiece of a broader tech sovereignty package. At its core is a requirement that every EU public body classify its cloud workloads against a four-tier sovereignty assurance scale before procurement can proceed. Level 1 covers general public administration and requires standard EU data protection controls. Level 2 adds data localization and jurisdictional guarantees for internal security and law enforcement use. Level 3 requires legal and technical neutralization of third-country legal exposure for defense, justice and border management workloads.
Level 4, the strictest tier, applies to an estimated 1 percent of total services but demands complete software transparency and zero third-country influence of any kind, a bar that explicitly targets exposure to the US CLOUD Act. That last point is the one causing the most friction, because it does not just restrict where data physically sits, it restricts which vendors can plausibly claim compliance at all, given that the CLOUD Act applies to any US-headquartered company regardless of where its servers are located.
Why Azure specifically is in the crosshairs
Microsoft Azure is the largest cloud provider serving European defense agencies today, used by 18 to 19 EU member states for defense-related systems. That footprint did not happen by accident. Azure built out government and defense-specific compliance programs years before most competitors took European sovereignty concerns seriously, and NATO-aligned militaries adopted it partly because it was the most mature option available at the scale modern defense computing requires. The Cloud and AI Development Act does not ban Azure outright, and the Commission has signaled it may use grandfathering or phased compliance timelines rather than forcing an immediate cutover.
But the law's Level 4 tier, even if it only covers the most sensitive 1 percent of workloads, targets exactly the kind of national security systems where Azure's defense footprint is deepest. Amazon has already moved to get ahead of this pressure, launching a European Sovereign Cloud on January 15, 2026, structured with local operational control specifically to satisfy stricter sovereignty tiers. Google Cloud has a smaller defense footprint across four member states, and Oracle's presence in this segment is smaller still, leaving Azure with the most exposure to whatever compliance regime ultimately emerges.
The defense ministries pushed back in public
Objections from European defense ministries became public between September 4 and September 7, and the substance of the pushback is straightforward: NATO-aligned militaries already run mission-critical systems on US cloud infrastructure, and no EU sovereign provider currently matches Azure, AWS or Google Cloud at the scale or AI capability modern defense computing requires. Building that alternative capacity from scratch, defense officials argue, would take years longer than the compliance timelines currently being discussed, and forcing a migration on an unrealistic schedule risks fragmenting interoperable systems that NATO allies depend on jointly.
There is also a practical operational argument beneath the political one. Defense systems that share data and tooling across allied militaries lose value if some allies are forced onto sovereign-only infrastructure while others remain on shared commercial cloud platforms. A fragmented compliance landscape across NATO members would create exactly the kind of interoperability gap that modern coalition operations are designed to avoid, which is why defense ministries are pushing this fight into the open rather than negotiating it quietly through procurement channels alone.
The 2 trillion euro number behind the fight
The Commission's own estimates put roughly 2 trillion euros in EU public procurement within the scope of the new sovereignty classification system, spanning everything from municipal IT services to national defense infrastructure. That figure is what makes this fight consequential well beyond defense ministries. Every public sector cloud contract in the EU, not just the sensitive Level 4 tier, will need to be classified and justified against this framework going forward, which means procurement teams across European government at every level are about to inherit a compliance burden that did not exist a year ago.
For AWS, Azure and Google Cloud, this becomes a permanent addition to how every future European public sector deal gets structured, priced and sold, rather than a one-time compliance project to check off and move past. Companies that can demonstrate credible sovereignty tiering across their service catalog will have a real competitive advantage in EU public procurement going forward, and companies that cannot will find themselves locked out of an increasingly large share of a 2 trillion euro market regardless of how technically capable their underlying infrastructure actually is.
What this means beyond government contracts
Enterprise buyers outside the public sector should not assume this fight stays confined to defense ministries and government IT departments. Regulatory frameworks built for public procurement have a well-documented habit of migrating into private sector expectations, particularly in regulated industries like financial services, healthcare and critical infrastructure that already operate under EU data residency rules. A four-tier sovereignty classification system built for government cloud contracts is a template regulators in adjacent sectors will study closely, and possibly borrow from, the moment it produces enforceable outcomes.
The practical move for any enterprise running EU workloads on Azure, AWS or Google Cloud is to start mapping your own contracts against this same tiering logic now, before a regulator or a customer asks you to do it under deadline pressure. Understanding which of your workloads would plausibly need Level 3 or Level 4 treatment, and which vendor can credibly deliver it, is the kind of exercise that is far cheaper to run proactively than to run in response to a compliance deadline that arrives with the force of law behind it.
