There is a question that has moved from industrial policy briefings to architecture review meetings in under eighteen months. The question is this: who actually controls the systems that run your organisation?

It is not a rhetorical question. It is an operational one. When a financial institution processes transactions on cloud infrastructure governed by foreign law, when a healthtech provider trains its AI models on servers that can be subject to judicial requests from third countries, when an industrial company stores its intellectual property on platforms whose encryption keys it does not fully control, digital sovereignty stops being a public policy concept and becomes a risk variable that no responsible CTO can ignore.

In 2026, that risk has names, numbers and concrete regulation behind it. This guide exists to help European CTOs and COOs convert digital sovereignty from a compliance burden into a real competitive advantage.

The problem that the data makes visible

The European Parliament, in its resolution on European Technological Sovereignty and Digital Infrastructure adopted in plenary on 22 January 2026 by 471 votes to 68 with 71 abstentions, estimates that the European Union relies on non-EU countries for over 80% of its digital products, services, infrastructure and intellectual property. In the cloud market, the diagnosis is even more specific: three US companies hold approximately 69% of the European cloud infrastructure market, according to the same parliamentary document, with European providers accounting for roughly 15%. The Parliament's own text noted that power is increasingly concentrated in the hands of non-European companies, limiting Europe's ability to innovate, compete and maintain control over its digital economy.

That concentration generates a structural tension that in 2026 is no longer merely theoretical. The US CLOUD Act allows American authorities to require access to data held by companies under US jurisdiction, regardless of where that data is physically stored. The GDPR requires that personal data of EU citizens be processed under the European legal framework. When the infrastructure hosting that data is governed by foreign law, the two obligations collide directly.

It is not a hypothetical collision. Data protection authorities in Austria, France and Italy have issued decisions against specific tools from US providers for breaching GDPR in transatlantic data transfers. Since the GDPR came into force in 2018, European data protection authorities have issued over 2,800 fines with cumulative penalties exceeding €6 billion, according to the GDPR Enforcement Tracker. In the first quarter of 2026 alone, fines totalled €68.18 million, a 400% increase year-on-year according to public authority data compiled by Finbold.

The geopolitical dimension has also sharpened. In February 2026, German Chancellor Friedrich Merz stated at the Munich Security Conference that Europe's excessive dependency on the United States in digital infrastructure was self-inflicted, framing competition policy as security policy. Polish MEP Michał Kobosko, who negotiated the Parliament resolution on behalf of Renew Europe, put it bluntly: if Europe does not act, it risks becoming a digital colony.

Key figure: On 17 April 2026, the European Commission awarded its Sovereign Cloud tender, enabling EU institutions to procure sovereign cloud services for up to €180 million over six years, applying the Cloud Sovereignty Framework as a binding procurement criterion for the first time.

Why 2026 is the inflection point

Digital sovereignty has been on the European policy agenda for years. What makes 2026 different is not the rhetoric: it is the legislative concretisation and market signals that convert the debate into operational obligations.

The EU Technology Sovereignty Package

The European Commission, led by Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen, has scheduled the publication of the Technology Sovereignty Package for 27 May 2026, according to the European Parliament's Legislative Train Schedule. The package includes the Cloud and AI Development Act (CADA), the EU's most ambitious legislative initiative on digital infrastructure since the GDPR itself.

The CADA, whose legal basis is Article 114 TFEU making it a directly applicable regulation across all member states, aims to triple EU data centre capacity within seven years, create a common framework of requirements for sovereign cloud providers, and embed sovereignty criteria into European public procurement processes.

The Cloud Sovereignty Framework is already operational

On 17 April 2026, the European Commission formally awarded its Sovereign Cloud tender. Four European consortia share up to €180 million over six years: Post Telecom from Luxembourg with OVHcloud and CleverCloud, STACKIT from Germany's Schwarz Group, Scaleway from France's Iliad Group, and Proximus from Belgium with S3NS, Clarence and Mistral.

To assess provider sovereignty, the Commission developed the Cloud Sovereignty Framework, which introduces Sovereignty Effectiveness Assurance Levels (SEAL), ranging from SEAL-0, complete absence of sovereignty, to SEAL-4, a fully European supply chain from chips to software. The minimum eligible level was SEAL-2. Three of the four awarded consortia reached SEAL-3, which guarantees immunity from supply chain disruption from non-European third countries. The consortium that included Google Cloud technology reached only SEAL-2. The message from the Commission's own procurement decision is unambiguous: involving a US hyperscaler, even through a European joint venture with a defence contractor, measurably reduces your sovereignty score.

The DORA Critical ICT Provider List: sovereignty enforcement is live

On 18 November 2025, the European Supervisory Authorities, EBA, EIOPA and ESMA, published the first official list of 19 designated Critical ICT Third-Party Providers (CTPPs) under DORA. The list includes AWS, Google Cloud, Microsoft Azure, Oracle and SAP among others. These providers are now subject to direct EU-level oversight through Joint Examination Teams (JETs), comprising staff from the ESAs and national competent authorities.

This designation is the operational proof that DORA's sovereignty requirements are not theoretical. Non-compliance by designated CTPPs exposes them to periodic penalty payments of up to 1% of average daily worldwide turnover per day of breach under Article 35(6) of DORA. Financial institutions with contracts with these providers must reflect that supervisory context in their own risk management and ICT contract documentation.

The Franco-German Summit and Council Declaration

On 18 November 2025, the French and German governments convened a Summit on European Digital Sovereignty. The declaration endorsed by the Council of the European Union on 5 December 2025 underlined the member states' shared ambition to strengthen Europe's digital sovereignty as a cornerstone of economic resilience, social prosperity, competitiveness and security.

Context: The European Commission's European Data Union Strategy, published in November 2025, includes investment of around €100 million in common European data spaces, with the explicit objective of safeguarding EU data sovereignty, according to official documentation from the Directorate-General for Communications Networks, Content and Technology.

Digital sovereignty: defining the concept precisely

Before evaluating technology options or vendors, it is essential to distinguish three concepts that are frequently conflated in architecture discussions.

Data residency refers to the physical location of the servers where data is stored. It is a necessary but not sufficient condition for sovereignty. Data can be physically located in Frankfurt or Dublin and still be subject to US law if the cloud provider is a company headquartered in the United States.

Data sovereignty is the ability to control who accesses data, under what legal conditions, and with what effective protective mechanisms against requests from external jurisdictions. It requires that the infrastructure, encryption keys and service contracts all sit within the European legal perimeter.

Technological sovereignty is the broadest concept: the ability of a state or group of companies not to depend on third parties for the functioning of their critical digital systems. It encompasses not only data but AI models, development platforms, semiconductor supply chains and high-performance computing capacity.

For a CTO, the relevant operational question is not which of these three concepts applies in the abstract. It is this: at which points in your organisation's architecture does dependency on extra-jurisdictional providers create a regulatory, operational or strategic risk you cannot accept?

The risk matrix by data type and system

Data type or system Sovereignty risk level Applicable regulatory framework
Personal data of EU citizens High GDPR, Art. 44-49, international transfers
High-risk AI systems High EU AI Act, Title III
Critical financial infrastructure Very high DORA, Art. 28-44, critical ICT providers
Health data Very high GDPR plus European Health Data Space
Intellectual property and source code Medium-high Trade secrets, industrial espionage risk
Non-critical support systems Low Proportionate risk management

The regulatory framework that converts sovereignty into obligation

Digital sovereignty in Europe is not merely a competitive aspiration. In 2026, it is the intersection of four regulatory frameworks imposing concrete obligations, with real sanctions for non-compliance.

GDPR: the foundation you already know, but are not yet fully applying

The General Data Protection Regulation has been in force since 2018. Since then, European data protection authorities have issued over 2,800 fines with cumulative penalties exceeding €6 billion according to the GDPR Enforcement Tracker. The most underestimated risk vector is not data processing itself: it is international data transfers through cloud providers operating under non-European jurisdiction.

The Standard Contractual Clauses (SCCs) approved by the European Commission are the reference mechanism for these transfers. But SCCs do not resolve the underlying problem if the provider can be compelled by its own national legislation to provide access to data without notifying the European customer, which is precisely the tension that the US CLOUD Act creates and that the Schrems II ruling of the Court of Justice of the EU addressed in 2020. The European Parliament's January 2026 resolution explicitly states that 69% of European cloud market share is held by US companies, exposing European data to extraterritorial legislation.

NIS2: the digital supply chain as a regulated security perimeter

The NIS2 Directive, which member states were required to transpose before October 2024, extends cybersecurity obligations to the supply chains of companies in critical sectors. If your organisation operates in energy, transport, banking, healthcare, digital infrastructure or water management, your cloud provider and technology partners are part of your regulated security perimeter.

The directive applies to companies with more than 50 employees and annual turnover above €10 million in critical sectors. Its obligations include supply chain security risk management, incident notification within 24 hours for early warnings and 72 hours for full reports, and documented business continuity policies.

DORA: operational sovereignty in financial services, enforced from day one

The Digital Operational Resilience Act entered into application on 17 January 2025 according to EIOPA, and its enforcement machinery is now operational. The ESAs published the first Critical ICT Provider list on 18 November 2025. Joint Examination Teams began operational supervision of designated providers in 2026. The oversight framework is no longer a future commitment: it is active.

Article 28 of DORA requires that contracts with critical ICT providers include specific clauses on data processing location, audit rights, documented exit plans and subcontracting conditions. Financial institutions must maintain and annually update a full register of ICT third-party arrangements. Any financial institution or technology provider serving the financial sector that has not reviewed its vendor contracts against these requirements is already operating with documented compliance gaps that supervisors can identify.

Resource: The HumanosTech DORA Guide for ICT Providers translates the regulation's articles into concrete contractual obligations for outsourcing relationships, with verified clause templates.

EU AI Act: sovereignty over models, not just over data

The EU AI Act (Regulation 2024/1689), in gradual application since August 2024 according to the Official Journal of the European Union, introduces a dimension of sovereignty that goes beyond data: sovereignty over artificial intelligence models. High-risk AI systems must comply with traceability, technical documentation and risk management requirements that mean the full model lifecycle, from training to production inference, must be documented and auditable.

If the model is trained or deployed on infrastructure governed by foreign law, the ability to document and audit that lifecycle is significantly compromised. Sovereignty over AI infrastructure is not just an architecture decision: it is a compliance requirement under the most consequential AI regulation currently in force anywhere in the world.

Resource: The HumanosTech Guide to the EU AI Act 2026 details the requirements by risk level and how to structure the development cycle for compliance from day one.

The most common mistakes when assessing your organisation's digital sovereignty

Having worked with European companies on their digital sovereignty assessments, we have identified the patterns of error that most consistently generate unnecessary risk.

  • Conflating data residency with data sovereignty. A contract specifying that data will be stored on servers located in the EU does not guarantee protection against requests from foreign jurisdictions if the provider is governed by non-European law. The Commission's SEAL framework illustrates this distinction precisely: EU-located servers are SEAL-1; effective operational sovereignty begins at SEAL-3.
  • Overlooking sovereignty at the AI model layer. Many organisations control where they store their data but train their models on third-party platforms whose computing supply chain is not under European control. With the EU AI Act in force, this inconsistency is a direct regulatory risk for systems classified as high-risk.
  • Treating sovereignty as an IT project rather than a corporate governance decision. Dependency on extra-jurisdictional providers affects board-level accountability, enterprise risk management and the ability to respond to regulatory auditors. It is a strategic decision, not only a technical one.
  • Deferring assessment until a regulatory audit arrives. The documented exit plans required by DORA, the traceability required by the EU AI Act and the subcontractor registers required by NIS2 all take time to implement correctly. Starting under audit pressure is significantly more expensive than doing it in a planned manner.
  • Assuming that hyperscaler sovereign cloud offerings resolve the problem. The Commission's April 2026 procurement decision demonstrates this directly: the consortium including Google Cloud technology reached only SEAL-2, compared to SEAL-3 for consortia built entirely on European technology. Sovereignty is measurable and the differences are real.

How to assess your organisation's digital sovereignty maturity in 2026

Before designing a digital sovereignty strategy, an honest assessment of the current situation is required. These are the questions your organisation must be able to answer with precision:

  1. Do you have an up-to-date map of all vendors processing your organisation's data, classified by data type and vendor jurisdiction?
  2. Does each relationship with an extra-jurisdictional vendor have an explicitly documented GDPR-compliant data transfer mechanism, whether SCCs or a Commission adequacy decision?
  3. Do contracts with critical ICT providers include the data processing location clauses, audit rights and exit plans required by Article 28 of DORA?
  4. Is the lifecycle of AI systems you develop or deploy documented to the level of traceability required by Title III of the EU AI Act?
  5. Have you identified the systems for which a provider outage or external judicial request would generate a critical operational impact?
  6. Is there a board-approved corporate policy defining sovereignty criteria for the selection of new technology providers?

If you cannot answer most of these questions affirmatively, the appropriate starting point is a structured audit. The HumanosTech Digital Sovereignty Audit provides that initial assessment and translates it into a concrete action plan with priorities ranked by regulatory risk level.

The operational model that converts sovereignty into competitive advantage

Digital sovereignty does not have to be a compliance burden. Organisations that approach it as a strategic capability, rather than a regulatory cost, are building real competitive advantages in markets where customer trust and the ability to win public contracts are critical assets.

Sovereignty as a differentiator in regulated markets

In sectors including financial services, healthcare, public administration and legaltech, the ability to demonstrate digital sovereignty over data and AI systems is a first-order differentiator in tender processes and enterprise sales. Clients in these sectors have their own regulatory obligations requiring them to assess the sovereignty posture of their technology vendors. If your product or service can demonstrate that level of control, the commercial conversation changes fundamentally.

Sovereignty as an enabler of European public procurement

The European Commission has embedded SEAL criteria into its cloud procurement processes. Member state governments and national administrations will follow that example progressively, as the Cloud Sovereignty Framework documentation makes explicit. Organisations that have built sovereign architectures will be positioned to compete for that market; those that have not will be de facto excluded from a growing share of European public demand.

Sovereignty as a reduction in regulatory and operational risk

A sovereign architecture reduces exposure to regulatory sanctions, to service disruptions caused by third-country political decisions, and to reputational risks from data breaches involving extra-jurisdictional providers. That reduced risk has direct economic value that the HumanosTech ROI Calculator allows you to model with your organisation's specific parameters, with the ROI Methodology available for internal audit.

The HumanosTech model: digital sovereignty as operational architecture from day one

HumanosTech was founded in 2025 in Estonia, within the European Union, with an operating model designed from the outset to ensure that European companies can access first-rate technical talent without surrendering legal and operational control over their data and systems.

The Estonian legal foundation ensures that all contractual relationships are governed by European law. Client data is processed exclusively on infrastructure within the EU perimeter. AI models are developed with the EU AI Act's traceability requirements embedded in the process from the design phase, not added as a documentation layer after the fact.

HumanosTech's AI Governance, Cybersecurity, Data Engineering and Regulatory Compliance services are designed to help European organisations build sovereign architectures without sacrificing development speed or technical quality.

For CTOs managing the tension between pressure to scale quickly and the need to do so under a robust digital sovereignty framework, HumanosTech's IT Outsourcing model provides a response that does not require choosing between the two.

Additional resource: The HumanosTech GDPR Checklist for IT Outsourcing provides a practical verification list for assessing any outsourcing relationship's compliance with GDPR requirements, including the specific aspects of data sovereignty and international transfers.

What comes next: the regulatory wave ahead and its implications for decisions you make today

The European digital sovereignty regulatory framework does not stop in 2026. Initiatives planned for the next two to three years will substantially expand the compliance perimeter for your organisation.

The Cloud and AI Development Act, scheduled as a legislative proposal in the package of 27 May 2026 according to the European Parliament's Legislative Train Schedule, will introduce for the first time in European law a legally binding definition of sovereign cloud. The SEAL criteria already operational in procurement will become formal legal requirements directly affecting the architecture decisions of every company operating in regulated European markets.

The Cyber Resilience Act (CRA), in force since December 2024 and with the majority of its obligations applicable from December 2027 according to the European Commission, will extend security requirements to the full lifecycle of digital products. External development teams participating in the creation of those products will form part of the manufacturer's accountability perimeter.

The European Health Data Space, planned for full application in 2027 according to the European Commission, will establish specific sovereignty requirements for health data processing that go beyond the general GDPR. Healthtech companies operating in Europe will need architectures specifically prepared to meet those requirements.

The State of the Digital Decade 2025 report from the European Commission warns that a substantial portion of European governmental digital infrastructure continues to depend on providers outside the Union, and that dependencies in semiconductors, cloud and AI threaten the EU's technological sovereignty and economic security. Regulatory pressure on private sector companies to correct this dependency will increase steadily in the years ahead.

Organisations that begin now to document their data architectures, review vendor contracts through the lens of digital sovereignty and build the registers that DORA, NIS2 and the EU AI Act require will be substantially better positioned when the next rounds of regulatory supervision arrive and new public procurement requirements come into force.

Conclusion

Digital sovereignty has moved from an industrial policy concept to an operational and regulatory risk variable with direct consequences for your technology architecture, vendor contracts, ability to access regulated markets and exposure to sanctions.

In 2026, the European regulatory framework already imposes concrete obligations through GDPR, NIS2, DORA and the EU AI Act. Nineteen critical ICT providers are now under direct EU supervisory oversight, including the hyperscalers that underpin most European enterprise infrastructure. The Commission's Cloud Sovereignty Framework has translated those obligations into measurable metrics with five SEAL levels. CADA will convert that framework into binding legislation. And cumulative GDPR fines exceed €6 billion, with the first quarter of 2026 recording a 400% increase year-on-year.

CTOs who approach digital sovereignty as a compliance burden will spend time and resources on reactive adjustments. Those who approach it as a strategic capability will simultaneously build a genuine competitive advantage: in public tenders, in the trust of regulated clients, and in operational resilience against third-country political decisions.

The question is not whether your organisation needs a digital sovereignty strategy. In 2026, it does. The question is whether you have the process to build one and the right partner to do it correctly. HumanosTech exists precisely for that purpose. The conversation starts at contact.html.

References

Share

LinkedIn
governance DIGITAL-SOVEREIGNTY EU-AI-ACT GDPR DORA NIS2 SOVEREIGN-CLOUD AI-GOVERNANCE CTO OUTSOURCING REGULATORY-COMPLIANCE