EU SEAL Framework: How sovereign is your cloud service?
- The SEAL framework makes digital sovereignty measurable and comparable for the first time.
- Eight sovereignty goals with varying weightings and a five-level scale form the basis of the assessment.
- Companies can use the framework to objectively evaluate and compare cloud providers.
- The assessment is complex. Proliance can support SMEs in particular in applying the framework efficiently to their cloud strategy.
What is the EU Cloud Sovereignty Framework?
The EU Cloud Sovereignty Framework is a reference framework from the European Commission. It is designed to help companies and public authorities systematically assess the digital sovereignty of cloud services.
Digital sovereignty has been a topic of discussion for years – the EU Cloud Sovereignty Framework makes it measurable for the first time through clearly defined sovereignty objectives, enabling Europe to reduce its strategic dependence on non-European providers and ensure control over its own data. The core assessment tool of this framework is the Sovereignty Effectiveness Assurance Levels (SEAL).
What is the SEAL framework?
The SEAL framework is a multi-level assessment systemthat allows companies to determine the level of sovereignty guaranteed by a cloud provider. This enables decision-makers, for example, during tender processes to ensure that providers meet specific minimum requirements for digital sovereignty.
The framework directly implements the EU's efforts toward greater digital sovereignty in Europe. It defines what sovereignty specifically means in the context of cloud services and makes it measurable.
How the assessment works based on sovereignty objectives and their weighting
The framework is based on a total of eight Sovereignty Objectives. Each objective is weighted according to the EU's strategic priorities.
For instance, the supply chain is weighted most heavily, as it forms the foundation for digital sovereignty. Legal and compliance aspects are certainly important as well. However, the EU assumes that these are already covered by other regulations such as GDPR and the NIS2 Directive.
Each of these objectives is assessed on a five-level scale:
- SEAL-0 – No sovereignty: Service, technology, or operations are under the exclusive control of non-EU third-party providers and are governed entirely outside of EU jurisdiction.
- SEAL-1 – Jurisdictional sovereignty: EU law applies formally but is only enforceable to a limited extent. Service, technology, or operations are under the exclusive control of non-EU third-party providers.
- SEAL-2 – Data sovereignty: EU law is applicable and enforceable, but material dependencies on non-EU actors remain. Service, technology, or operations are under the indirect control of non-EU third-party providers.
- SEAL-3 – Digital resilience: EU law is applicable and enforceable. EU actors exert significant, though not complete, influence. Service, technology, or operations are under marginal control by non-EU third-party providers.
- SEAL-4 – Full digital sovereignty: Technology and operations are under complete EU control and are subject exclusively to EU law. There are no critical dependencies on entities outside the EU.
Requirements catalog for Germany
The EU Cloud Sovereignty Framework is the European standard. In Germany, the Federal Office for Information Security (BSI) specifies the framework's requirements with the C3A catalog (Criteria enabling Cloud Computing Autonomy). The C3A provides German companies and public authorities with practical, verifiable criteria for evaluating cloud providers.
The C3A differs from the EU framework by translating abstract sovereignty goals into concrete, verifiable criteria, focusing on six specific objectives. SOV-7 (Security) is covered by existing BSI standards such as C5, while SOV-8 (Environment) falls outside the BSI's focus.
Example SOV-3 (Data Sovereignty):
- The EU framework states: "Control and protection of data assets"
- The C3A catalog specifies: "The cloud provider MUST ensure that customer data is stored and processed exclusively within the EU."
What are the benefits of the SEAL framework for companies?
The EU SEAL framework transforms what have often been vague discussions about digital sovereignty into concrete, measurable criteria. While the framework is not yet binding for private companies, it could potentially become the standard for regulated industries and public tenders in the future.
However, companies can already benefit today:
- Informed decisions: Companies receive a standardized tool to objectively compare cloud providers. Using the SEAL levels, they can precisely assess the level of sovereignty a service offers.
- Efficient compliance: The framework is aligned with EU regulations such as the GDPR, NIS2, and DORA. By choosing a provider with a high SEAL rating, German companies can more easily demonstrate that they are fulfilling their due diligence obligations regarding data protection and cybersecurity.
- Holistic risk assessment: The framework compels companies to think beyond the mere storage location of their data. It shifts the focus to the entire supply chain, operational management, and legal control. This encourages German companies to develop a 360-degree view of their cloud strategy and makes it easier to uncover hidden dependencies and risks.
German and European Cloud providers stand to benefit: Those who offer sovereign services in the future will secure a clear competitive advantage. At the same time, the new framework increases the pressure on international providers, who must adapt more closely to the requirements of the European market if they wish to remain successful.
What do companies in Germany need to do now?
For companies in Germany that want to operate more independently and work in the most secure cloud environments possible, the SEAL framework provides a solid foundation for deriving a sovereignty roadmap . Here is how you can proceed:
Step 1: Internal inventory & protection requirements analysis
Before you evaluate the sovereignty of external providers, you should be clear about your own dependencies. The following questions will help:
- Classify data: What data does your company process? Is it public marketing data, internal process data, personal customer data, or highly sensitive research and development data? Each category has different protection requirements.
- Evaluate processes: Which business processes depend on which data and IT systems? Which processes are absolutely critical to the company's survival?
- Analyze dependencies: Where are your data and applications currently located? With which providers? What legal and operational dependencies already exist? Is there perhaps some shadow ITthat you might not even be aware of?
Step 2: Re-evaluate and define your cloud strategy
Based on your inventory, the next step is to refine your cloud strategy. Define for yourself which SEAL level is required for which data category and process. A differentiated strategy is often the most sensible approach, as not all data typically requires SEAL-4.
Also, determine whether a hybrid or multi-cloud strategy best suits your requirements. A multi-cloud strategy offers the advantage of combining sovereign European providers for critical processes with hyperscalers for non-critical tasks.
Step 3: Market analysis and provider due diligence
Next, use the SEAL framework as a loose checklist for your individual provider selection. It is best to ask potential and existing cloud providers directly about their position regarding the EU-SEAL framework. Reputable providers will usually have a quick answer to this.
Go through the sovereignty goals and the criteria of the C3A catalog step-by-step and request concrete evidence for each point from the provider. Pay attention to relevant certifications, such as the BSI’s C5 attestation.
Step 4: Contract design and legal protection
For both new and existing contracts, the findings must be contractually secured . For existing partnerships, for example, expand the Service Level Agreement to include the guaranteed sovereignty features. Also, define what happens if the provider breaks its sovereignty commitments or is acquired by a non-EU company.
Step 5: Continuous monitoring
Regularly check whether your providers are still meeting their contractual commitments. Additionally, monitor the geopolitical situation and keep an eye on legislative changes that could impact your cloud strategy. It is best to appoint a responsible person or a team for cloud sovereignty to manage this process.
What does the NIS2 Directive mean for your company, and what obligations come with the implementation of NIS2 in Germany? Our guide brings clarity.
Hurdles and limitations of the SEAL framework
The SEAL framework is an important step toward greater digital sovereignty. However, choosing cloud providers will continue to present challenges. Companies should be aware of the following limitations:
- Few certified providers so far: Because the framework is new, there are currently only a few providers with SEAL-3 or SEAL-4 certification.
- The assessment process is complex: There is currently no "SEAL certificate" issued by independent bodies. Companies must apply the eight sovereignty goals themselves, which can be complex and time-consuming, especially for SMEs.
- 100% sovereignty is unrealistic: Almost all servers worldwide use processors and hardware from the US or Asia. Open-source software is also written by developers around the globe. SEAL-4 should therefore be viewed as an ideal rather than a standard.
- Transparency is not guaranteed: A provider may store data in the EU but have support and maintenance performed by external partners. While the framework addresses this, companies must look closely if they want full clarity.
- Sovereignty vs. innovation: Anyone striving for true sovereignty may have to compromise on technology. Innovative AI and cloud solutions often come from US providers. Strict sovereignty may therefore mean fewer features but more control—depending on what is more important to you.
Conclusion: A good start for digital sovereignty, with limitations
The SEAL framework provides companies that value digital sovereignty with important guidance for choosing their cloud providers. The goals and levels help in asking the right questions and assessing risks more effectively. It is important to view the framework as a guide rather than a rigid checklist.
The experts at Proliance are happy to support you in planning your cloud infrastructure to be as secure and sovereign as possible.
Still have questions? We have the answers.
The SEAL Framework (Sovereignty Effectiveness Assurance Levels) is an assessment system developed by the European Commission. It makes the digital sovereignty of cloud services measurable for the first time, based on eight sovereignty objectives and a five-level scale ranging from SEAL-0 (no sovereignty) to SEAL-4 (full digital sovereignty). Proliance supports companies in the efficient application of the framework.
The SEAL Framework enables companies to objectively compare cloud providers, more efficiently demonstrate compliance with requirements from GDPR, NIS2, and DORA, and uncover hidden dependencies in the supply chain. It promotes a holistic cloud strategy. Proliance advises SMEs on how to integrate the framework purposefully and pragmatically into their cloud strategy.
Companies should proceed in five steps: analyze data and dependencies, redefine their cloud strategy, evaluate providers using the SEAL framework, contractually secure sovereignty commitments, and monitor regularly. Given the complexity of the evaluation, Proliance, as an experienced consultant, supports — especially SMEs — in doing so efficiently and in a legally sound manner.
Do you have further questions on this topic? Our experts will be happy to advise you free of charge.
