For years, “sovereign cloud” has been a marketing term, something a provider slaps on a data center in Frankfurt and calls compliant. That’s about to change. On June 3, 2026, the European Commission proposed the Cloud and AI Development Act, part of a broader Tech Sovereignty Package, which would create an EU-wide framework for actually grading how sovereign a cloud or AI service is, with formal tiers for providers serving the public sector. If it passes, sovereignty stops being whatever a vendor says it is and becomes something regulators define and measure.
Residency was never the same thing as sovereignty
The distinction most enterprises still get wrong: storing data in an EU data center is not the same as controlling who can access it. A provider that is US-incorporated remains subject to the US CLOUD Act even when every byte of customer data sits on European soil — meaning US authorities can compel that provider to hand data over regardless of where the servers are. That gap between residency and sovereignty is exactly what the Cloud and AI Development Act is trying to close by defining sovereignty as a graded, auditable standard rather than a claim on a website.
This is one piece of a fast-moving compliance stack
The sovereignty proposal doesn’t exist in isolation. It lands in the middle of a year where several EU regulations have moved from political agreement into active enforcement:
- The Data Act, in effect since September 2025, already governs cloud switching rights and protections against non-EU government access to data. Starting September 12, 2026, products released in the EU must be designed so user data is portable by default, and providers lose the ability to charge switching fees entirely by January 2027.
- NIS2 is now in national enforcement across member states, with Sweden’s version (effective January 2026) covering an organization’s entire IT environment, mandating 24-hour breach notification, and holding management personally accountable.
- DORA has put major cloud providers serving financial institutions under direct regulatory oversight since November 2025, meaning EU regulators can now inspect infrastructure providers directly rather than only through their customers.
Each of these treats where data lives, who can touch it, and how portable it is as a compliance question with teeth — not a procurement nice-to-have.
Why this matters beyond Europe
None of this is theoretical for organizations weighing where to run their data platform. The sovereign cloud market itself has already reached roughly $80 billion in 2026, growing more than 35% year over year, largely driven by enterprises moving regulated AI and data workloads away from US hyperscalers. And the pressure may be building faster than expected: a June 29, 2026 US Supreme Court ruling affecting FTC independence has prompted privacy group noyb to formally ask the European Commission to reconsider the EU-US data transfer agreement altogether, on the grounds that one of its founding conditions no longer holds (Glesys). If that agreement unravels, organizations processing EU personal data in the US would need a new legal basis to keep doing so — or need to move that processing to Europe outright.
The architecture question underneath the regulation
Strip away the acronyms and every one of these rules is really asking the same question: do you actually know where your data is, who can reach it, and how fast you could move it if the rules — or the vendor — changed? That’s not a question a fully public-cloud, single-vendor warehouse architecture answers comfortably. It’s a question a hybrid architecture, where an organization controls deployment across cloud, on-prem, and edge without re-platforming, is built to answer by design.
Sovereignty is heading toward becoming something you have to prove, not something you can claim. Enterprises that treat data architecture as a compliance lever now — rather than scrambling when the Cloud and AI Development Act clears Parliament — will spend a lot less time in audits later.
