EU Cloud Sovereignty Framework explained: SEAL levels, the sovereignty score and what they mean for ad tech buyers

What the law says. No EU regulation or directive adopts the framework. Its force comes from the tender documents that use it. Version 1.2.1 says the tender specifications set a minimum SEAL per objective, and tenders that miss it "consistently across all objectives will be rejected" (framework v1.2.1, section 1). Outside such a tender, nothing in the framework obliges a cloud provider or a buyer to do anything.

What the Commission has said. The framework draws on France's "Cloud de Confiance", Germany's sovereign cloud work, Gaia-X rules and the EU cybersecurity certification framework (framework v1.2.1, section 1). On 1 June 2026 the Commission encouraged "all organisations, both public and private" to consult and use it (Commission, 1 June 2026). It also promised an updated version based on the tender (Commission, 17 April 2026).

What practitioners do. Several cloud vendors and consultancies now publish SEAL self-assessments and explainers. A SEAL level on a vendor website is the vendor's own claim. The only ratings we found published by the Commission are the four tender results of 17 April 2026.

The framework splits sovereignty into eight objectives, numbered SOV-1 to SOV-8. Each has several criteria, and each criterion has scored answers. The table compares the two official weight sets. Neither the guidance nor the calculator says which set a future tender must use; contracting authorities can adapt the scores (implementation guidance, p. 11).

Sources for the table: objectives and October 2025 weights from framework v1.2.1, sections 2, 4 and 5; criteria counts and June 2026 weights from the Commission calculator, 1 June 2026.

Version 1.2.1 explains its low weights for SOV-2 and SOV-7. The tender "already contains significant safeguards" in those domains, so they counted less in the ranking (framework v1.2.1, section 5). The 48 criteria match the Commission's statement that the score uses "48 specific criteria" (Commission, 1 June 2026). The guidance adds that the first tender used 43 questions, nine aimed at the companies and 19 asked for every technical layer (implementation guidance, p. 13).

A SEAL is a floor, not a grade. The buyer sets a minimum level, and a bid that falls below it on any objective fails. The table gives both official names, because the Commission renamed SEAL-3 between October 2025 and June 2026.

Sources for the table: level names and descriptions from framework v1.2.1, section 3 and implementation guidance, pp. 2 to 3; answer mappings from the Commission calculator, criteria SOV-2.2, SOV-3.1, SOV-3.4 and SOV-4.4.

Three rules decide how the levels work in practice.

1. The weakest answer sets the level. The calculator computes the overall SEAL as the minimum level across every answered criterion (calculator, cell F2). One SEAL-1 answer on data location makes the whole service SEAL-1.
2. The level beats the score. The guidance stresses "the prevalence of the SEAL criterion over the Sovereignty Score". The buyer fixes the minimum SEAL, and the score only ranks offers that reach it (implementation guidance, p. 10).
3. The evaluator decides. The calculator proposes a level per answer, but "the evaluator ultimately decides" whether the provider really offers it (implementation guidance, p. 9).

The Commission was candid about the top level. In its lessons learnt it said SEAL-4 "is not today relevant" given Europe's dependence on chip and hardware supply chains. It also found that checking bidders' self-declarations took "significant effort" (implementation guidance, p. 13).

Each objective carries up to 1,000 points in the calculator. The score multiplies each objective's points by its weight, adds the results and divides by 1,000 (Commission calculator, cell E1). Version 1.2.1 states the same idea as a sum of each objective's share of its maximum, times its weight (framework v1.2.1, section 5).

Worked example. Take a fictional provider with an EU parent, US-made hardware and an EU operations team. It earns the shares of maximum points below. The weights come from the two official sets in the framework and the calculator.

The same answers gain 3.75 points under the 2026 weights, mostly because supply chain counts half as much. The SEAL does not move at all: it depends on the weakest answer, not on the weights. If this provider answered SEAL-1 on any data-location criterion, a SEAL-2 tender would reject it whatever its score.

The tender result is instructive for buyers. The Commission said Proximus uses S3NS, "a joint venture between Thales and Google Cloud", in an environment "exclusively operated by EU companies" (Commission, 17 April 2026). That offer met SEAL-2 but not SEAL-3. In the Commission's words, non-European technologies operated within "a strict and appropriate framework" can meet the minimum level. Our comparison of sovereign cloud providers covers these offers in detail.

What the proposal says. The Cloud and AI Development Act (CADA) would turn sovereignty levels into law for the public sector. The pinpoints below come from the proposal text (COM(2026) 502).

• Article 16 creates a "Union cloud computing sovereignty framework" of four Union assurance levels, with criteria in Annex II. The Commission reviews the annexes at least every 18 months.
• Article 17 lets providers apply for recognition to the national authority where they are established. Level 1 rests on a statement of conformity; Levels 2 to 4 need an audit report and a "positive" audit opinion.
• Article 30 requires public bodies to use Level 1 services as a minimum. Bodies whose activities contribute to public order, in NIS2 sectors and in areas such as defence and justice, "shall only procure" Level 2, 3 or 4 services.
• Article 31 says private entities in NIS2 Annex I sectors "may carry out similar assessments". The Commission may later make such assessments mandatory for high-criticality sectors by delegated act.

What the Commission has said. Level 1 covers data "processed and stored in infrastructure located in the Union". Level 3 requires providers "owned and controlled from the EU" (Commission CADA page, updated 5 November 2026).

Status on 9 November 2026. The proposal is in the ordinary legislative procedure. ITRE is the lead committee, and the procedure file shows "Awaiting committee decision" (Legislative Observatory, 2026/0138(COD)). No Parliament or Council position exists yet. Key dates will appear in our ad tech regulation calendar.

The proposal text does not mention SEAL or the Cloud Sovereignty Framework by name. How the two scales will relate is not stated in any Commission document we found.

What the law says. The framework does not change data protection law. When a bid request carries personal data to an exchange or demand-side platform (DSP) outside the EEA, GDPR Chapter V governs that transfer (Regulation (EU) 2016/679, Articles 44 to 49). Tools such as standard contractual clauses (SCCs) answer the transfer question. The GDPR, ePrivacy and bidstream guide explains which bid request fields are personal data.

What the Commission's scale says. The calculator scores data location strictly. "Data mainly in the EU, some third-country use with standard safeguards" maps to SEAL-1. So does "Data in the EU by default, tightly controlled exceptions". Only "All data exclusively in the EU with no third-country fallback" reaches SEAL-4 on that criterion (Commission calculator, criterion SOV-3.4). A lawful transfer under SCCs can still be a SEAL-1 answer.

Our analysis. The framework assesses cloud services, not ad tech vendors. Applying it to a DSP, a supply-side platform or a clean room is an analogy, and a buyer would have to adapt the questions. The mapping below shows where ad tech data flows meet the framework's criteria.

A scenario shows the effect. A Dutch retailer runs its audience data in an EU region of a sovereign cloud offer, but its DSP sends bid requests to bidders in the US under SCCs. The hosting may score well on SOV-3, while the bidstream flow is a SEAL-1 answer on data location. Under the framework's weakest-answer rule, the combined service would sit at SEAL-1.

Whether that matters depends on whether the retailer's own procurement sets a minimum level. Country rules that may also apply are tracked in our data residency requirements by country tracker, and switching rights in our page on the EU Data Act for ad tech.

• Whether DG DIGIT has issued a numbered version after 1.2.1. The guidance and calculator of 1 June 2026 on the Commission tender page are the latest documents we found.
• Any public register of SEAL ratings beyond the four tender results.
• How CADA's four Union assurance levels will map to SEAL-0 to SEAL-4. Neither document states it.
• Whether any member state has adopted SEAL levels in its own public procurement (n/d).

1. European Commission, DG DIGIT, "Cloud Sovereignty Framework", Version 1.2.1 (document page dated 20 October 2025). https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en
2. European Commission, DG DIGIT, "Cloud Sovereignty Framework: Implementation guidance" (1 June 2026). https://commission.europa.eu/document/download/2ad80a48-166f-4c77-a513-80c53ca2a128_en?filename=Cloud%20Sovereignty%20Framework%20-%20Implementation%20guidance.pdf
3. European Commission, DG DIGIT, "Annex: Sovereignty assessment calculator" (XLSX, 1 June 2026). https://commission.europa.eu/document/download/3acb8fe8-8a4a-4339-ae74-f56138d913d1_en?filename=Annex%20-%20Sovereignty%20assessment%20calculator.xlsx
4. European Commission, "Tender opportunities: Digital Services", section "Cloud Sovereignty Framework" (checked 9 November 2026). https://commission.europa.eu/funding-and-tenders/find-calls-tender/tender-opportunities-department/tender-opportunities-digital-services_en
5. European Commission, "Commission advances cloud sovereignty through strategic procurement" (17 April 2026). https://commission.europa.eu/news-and-media/news/commission-advances-cloud-sovereignty-through-strategic-procurement-2026-04-17_en
6. European Commission, "Sovereign Cloud Framework explained" (1 June 2026). https://commission.europa.eu/news-and-media/news/sovereign-cloud-framework-explained-2026-06-01_en
7. European Commission, "Proposal for the Cloud and AI Development Act (CADA)", COM(2026) 502 (3 June 2026). https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
8. European Commission, COM(2026) 502, proposal text, Articles 16, 17, 30 and 31 (3 June 2026). https://ec.europa.eu/newsroom/dae/redirection/document/129111
9. European Commission, "Cloud and AI Development Act" policy page (last update 5 November 2026). https://digital-strategy.ec.europa.eu/en/policies/cloud-and-ai-development-act
10. European Parliament, Legislative Observatory, procedure 2026/0138(COD) (checked 9 November 2026). https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2026/0138(COD)