Sovereign Cloud in 2026: How to Tell Real Sovereignty from a Sticker — a Softprom Breakdown
News | 29.07.2026
In 2026, sovereign cloud is the most used — and most diluted — term on the European IT market: 70% of the EU cloud infrastructure market belongs to three US providers, European providers hold around 15%, and 60% of Western European CIOs say they want to increase their use of local cloud. On 3 June 2026 the European Commission published the proposed Cloud and AI Development Act (CADA) with a four-level cloud sovereignty assurance framework. Softprom — a value-added IT distributor since 1999, operating in 33 countries across Central and Eastern Europe, the Caucasus, and Central Asia — explains what data sovereignty is actually made of and which solutions from its portfolio of 120+ vendors cover each layer.
A sovereign cloud is a cloud environment in which data jurisdiction, operational control and cryptographic keys belong to the customer or an EU-based operator — not merely "the server is in Frankfurt".
Three Questions That Separate Sovereignty from Marketing
-
Where is the data?
EU residency is necessary but not sufficient — location is only the first CADA level.
-
Whose keys?
If the provider generates and stores your encryption keys, your data's jurisdiction follows the keys. Fortanix provides external key management: data in the cloud, keys with you.
-
What is the exit plan?
Sovereignty without an exit strategy is dependency with a different logo. Cloudian (S3-compatible storage in your own data centre) and GitLab (self-managed DevOps) keep critical assets under local control.
What Hyperscalers Offer — and How to Read It
AWS European Sovereign Cloud and Google Cloud's sovereign controls are real engineering answers to CADA, with EU-based staff and isolated infrastructure. But "sovereign-flavoured" labelling without key control and an exit plan is sticker-level sovereignty. Practical advice: require any provider to map its service to the four CADA assurance levels — in writing.
Hybrid Architecture as the Working Compromise
- 88% of organisations already run hybrid or multi-cloud environments — the question is not "cloud or not", but "what exactly lives where".
- Critical data + keys: locally (Cloudian, Fortanix).
- Scalable workloads: a hyperscaler with sovereign controls (AWS, Google Cloud).
- Softprom's pre-sales team of 30+ engineers helps partners split workloads along this logic.
FAQ
The proposed Cloud and AI Development Act of 3 June 2026: a four-level framework for assessing the sovereignty of cloud services in the EU.
No. Without key control and operational jurisdiction, server location is only the first level.
Partially: sovereign regions plus external key management (Fortanix) cover most requirements for the commercial sector.
With an inventory: which data, in which jurisdiction, whose keys. Softprom runs this session with partners free of charge.
As a value-added IT distributor since 1999, Softprom helps partners across Central and Eastern Europe design sovereignty-ready cloud architectures — from key management to exit strategy. Request a data sovereignty inventory session today.
Share:
