Europe Has Drafted Four Levels of "Sovereign". A Postcode Only Gets You Level 1.

The European Commission published its proposal for the Cloud and AI Development Act on 3 June 2026, as COM(2026) 502. Alongside measures on data centre capacity, it introduces a single EU-wide assessment framework for cloud and AI sovereignty, with a mechanism for steering public sector procurement towards it. 1

Two things to get straight before anyone panics or celebrates. It's a proposal rather than a law, and the consultation on it runs until 27 August. 2 Adoption is currently targeted for late 2027, after which member states would have a year to determine what level of protection their own systems need and procure accordingly. 3

So nothing binds anyone soon. The definition is still worth reading, because it's the first serious attempt to write down what "sovereign" means in terms you could hold a supplier to.

Geography is the floor, not the goal

Level 1 requires cloud services to process and store data on EU infrastructure, alongside baseline sovereignty requirements. Level 2 adds demonstrated independence from third countries and visibility into the software supply chain. Level 3 generally requires EU ownership and control, plus citizenship criteria for the people running the service - although the proposal leaves a mechanism for recognizing certain associated third-country providers. Level 4 requires full transparency and control over the software supply chain, with no third-country interference. 3

Read that from the bottom. Where the racks are gets you onto the first rung and no further. Everything above it increasingly becomes about who owns the company, who staffs it, and what's in the software supply chain.

We wrote on 1 June that the useful question was never where the servers are, but who can be served with an order, in what country, and whether they can comply without telling you. The drafters appear to have landed in the same place.

Then look at where the work actually sits. On the Commission's own impact assessment, about 70% of existing EU public sector workloads fall under Level 1 and 20% under Level 2, leaving 9% at Level 3 and 1% at Level 4. 4

The fight is over the bottom two rungs

CISPE, which represents European cloud providers, allowed that with Level 3 and above the Commission "provides some strong definitions of Sovereignty". It called the Level 1 and 2 criteria "confusing and non-sensical", noting that "almost any vendor can meet these requirements", and argued that services at those levels "should not be called, designated or otherwise referred to as 'sovereign' in any way". 5

Put that next to the distribution and the problem is plain: 90% of the public sector's cloud sits in the two levels CISPE says should not carry the word at all.

From the other direction, CCIA Europe calls the proposal discriminatory and warns of market fragmentation, on the grounds that the upper levels exclude providers by headquarters and corporate structure rather than by any technical property. 6

Both objections can be true at once. Origin is a blunt proxy for the thing anyone actually cares about, and nobody has proposed a sharper one that survives a lawyer.

The supply side is the hard part

The Act is also an industrial policy, aiming to triple EU data centre capacity within five to seven years, 2 with a maximum 12-month permit-granting procedure in designated acceleration zones. 7

We wrote in April that electricity, not capital, is the binding constraint here. A permitting target beats a multi-year grid queue, but a permit is not a substation.

Where we sit, without the marketing

AVS ISP runs four sites in four countries: Tirana, Skopje, Amsterdam and London. Exactly one of them is in the EU. If you're a public body that will one day procure at Level 3 or 4, we aren't your answer, and we won't pretend a certification programme is coming.

What we have is the property the levels are a proxy for. We're a small independent ISP, so the answer to who can be compelled, and under which law, is short and checkable rather than an org chart. Legal compulsion only matters if there is data to disclose in the first place, which is why we don't collect identity documents to sell you a server, so there isn't a pile of them to produce. And you choose the jurisdiction per machine at deploy time.

A VPS starts at €5/mo, a VDS runs from €40/mo for 4 vCPU to €160/mo for 16, and bare metal starts at €150/mo. We operate AS210464 with RPKI validation and sell BGP sessions from €5/mo, so if you bring your own /24 your addressing moves with you. You can measure the network first through the looking glass, no account required.

What a level number stands in for

Long before any of this binds, buyers will start asking suppliers which level they would meet, and the shorthand will be misused within a fortnight. A number on a slide is easier to produce than the property it stands for.

The underlying questions haven't changed since June. Which entity holds your contract, which law governs it, who can compel that entity and whether they can comply silently, what data actually exists to be handed over, and how long it would take you to leave. A provider that answers those in plain sentences is telling you more than a level number will for the next two years.

And if you can't answer the last one, the cheapest way to find out is still one small server, in another country, running one real thing.

Sources

1. Proposal for the Cloud and AI Development Act (CADA), European Commission
2. European Commission Advances New Proposal to Expand Cloud Capacity and AI Infrastructure, Hunton Andrews Kurth
3. European Commission's Proposed Cloud Sovereignty Framework Creates New Compliance Tiers, Jones Day
4. EU takes first steps to reduce reliance on US hyperscalers, Computerworld
5. Europe Takes a Tentative Step Towards Strategic Autonomy, CISPE
6. Discriminatory EU Cloud and AI Development Act Risks Severe Market Fragmentation, CCIA Europe
7. EU's cloud and AI development act gets mixed reception, Euronews