Between 17 and 20 April 2026 the European Commission named the four provider groupings selected for its €180m, six-year sovereign cloud framework. Post Telecom leads a Luxembourg consortium with CleverCloud and OVHcloud at SEAL-3; StackIT, owned by the Schwarz Group, represents Germany at SEAL-3; Scaleway represents France at SEAL-3; and Proximus leads a Belgian consortium that includes S3NS, Clarence and Mistral AI, with S3NS rated at SEAL-2. the Commission's Sovereignty European Assurance Level framework grades contracts from SEAL-1 to SEAL-3, and SEAL-3 requires the operator to run the service without foreign technical dependencies. SEAL-2 requires only data-sovereignty minima. Three awardees cleared the higher bar; one did not.
CISPE's Francisco Mingorance told The Register the award was "clearly an own goal" and called the S3NS inclusion "sovereignty washing". The objection is specific: S3NS is a joint venture between French defence group Thales and Google Cloud, and workloads running on Google infrastructure sit within reach of the US CLOUD Act, the 2018 law that lets American authorities compel disclosure of cloud data held anywhere in the world. Microsoft told the French Senate last year that it could not guarantee French customer data would never be disclosed under US legal orders; the same exposure attaches structurally to any Google-hosted workload regardless of where the data physically sits.
EU-native providers hold roughly 15 per cent of the European cloud market against around 70 per cent for the three US hyperscalers combined, and the Commission's counter-case rests on that arithmetic. Excluding every provider with any US linkage would have narrowed the tender to a field too small to be competitive, and the sovereign cloud market is forecast to triple to $23bn by 2027; a procurement logic that restricts the supplier base risks producing either no viable bidder or a single one. Hedged inclusion of S3NS at SEAL-2, alongside three SEAL-3 awardees, reads on that defence as a deliberate widening of the competitive field rather than a concession on sovereignty.
A €180m framework becomes the citation benchmark for every national cloud tender that follows, and member-state procurement Teams tend to cite the Commission's own designation as prima facie evidence of sovereignty compliance. Over six years the downstream contracts will be valued well above €180m, and a SEAL-2 provider sitting inside the same slot as a SEAL-3 one collapses two categories the framework was designed to separate. CISPE has the foundation for a legal challenge; Mingorance's keynote in Brussels this week on "Making Sovereignty Verifiable" suggests the challenge will come through an auditability argument rather than a tender-rules one.
