Are you assessing cloud offerings or considering a move away from a hyperscaler? The WZ-IT cloud exit assessment evaluates costs, dependencies per service, target architecture and migration path for AWS, Azure and Google Cloud. Implementation runs through migration. View the cloud exit assessment · Book an initial consultation (free and non-binding)
A cloud offering can be called ‘sovereign’ without meeting any assessment framework. ‘Sovereignty washing’ stands for this gap between marketing claim and evidence. This article provides a checklist of 13 checkpoints for tenders and provider conversations. Each checkpoint contains a question to the provider, a piece of evidence, a warning sign and, where available, the reference to a primary source: the BSI criteria (C3A), the EU Cloud Sovereignty Framework or a legal provision. Questions, types of evidence and warning signs are our own derivations from these sources.
The article does not rate providers, provider names appear only where a provider documented something itself. The CLOUD Act is explained in detail in It's Time to Move Servers and Data to European Clouds and Rocket.Chat and the AWS European Sovereign Cloud. Sources retrieved on 10 November 2026, the date of each source is given in the text. This is not legal advice.
Table of contents
- In brief
- What is sovereignty washing, and what is it not?
- Which frameworks exist: BSI C3A, the EU framework and C5?
- Which legal framework stands behind it?
- What do public contracting authorities require in practice?
- The checklist: 13 checkpoints with question, evidence and warning sign
- How do you score the answers?
- Which often-heard assumptions do not hold up?
- Status and methodology
- Our approach at WZ-IT
- Further guides
- Sources
In brief
The mapping is an assessment based on the frameworks documented below, not a vendor statement.
| Situation | Obvious check (assessment) | Basis |
|---|---|---|
| The offering is called ‘sovereign’ but names no shareholders | Checkpoints 1 to 4 first: ownership, law, third-country access, authority requests | C3A SOV-1, SOV-2 |
| Only the data location in the EU is promised | Checkpoints 5 to 8: personnel, keys, metadata, supply chain | C3A SOV-3, SOV-4, SOV-5 |
| A certificate (C5, ISO 27001) is presented as proof | Checkpoint 10: read the scope and assess sovereignty separately | BSI C5 FAQ (in German) |
| ‘Encryption with your own key’ is promised | Checkpoint 6: where is the key used, who can decrypt? | C3A SOV-3-02, SOV-3-05 |
| Public tender | Set a minimum level per objective and the type of evidence, the lowest level counts | EU framework |
| Switchability is decisive | Checkpoints 11 to 13: exit, audit rights, contract stability (checkpoints 12 and 13 rest on C3A, the minimum standard and our own derivations) | Data Act Art. 25, 29, 31 |
What is sovereignty washing, and what is it not?
We are not aware of a statutory definition of sovereignty washing. The Gesellschaft für Informatik (GI) draws the parallel to greenwashing and describes that there is so far no separate offence for this conduct (GI working group Digital Sovereignty, in German). That does not mean that inaccurate advertising is without consequence: under current law it can be challenged, for example as misleading commercial practice (section 5 UWG, section 5a UWG, German Unfair Competition Act, not legal advice). It refers to an offering marketed as sovereign, European or independent without ownership, control, operations or applicable law matching that claim. The sources use the term from different positions of interest:
| Source | Statement | Classification |
|---|---|---|
| CISPE according to heise, 19 Mar 2026 | US groups advertise EU data centres and cybersecurity certificates and remain subject to the US CLOUD Act | Secondary source (heise report on a CISPE statement, the wording is not in the CISPE letter); association of European cloud providers, interest group |
| CISPE letter, 17 Mar 2026 | Sovereignty should be defined by control, ‘not simply by having EU presence or meeting cybersecurity standards’ | Original letter, demand on the Cloud and AI Development Act, 25 signatories according to CISPE; association position |
| heise, 17 Jun 2026 | Three levels: data location, operational autonomy, legal sovereignty; the label ‘sovereign’ addresses the first two | Opinion piece in the heise blog |
| GI discussion paper, 8 Apr 2025 | Corporations label products ‘sovereign’ although dependencies remain (‘Schein-Lösungen’, sham solutions); the paper contains no explicit definition | Paper by the spokespersons of three GI working groups, labelled a discussion paper, evaluative |
| GI working group Digital Sovereignty | Sovereignty washing is the digital counterpart of greenwashing, there is so far no separate offence for it; demand for criminal liability | Political demand, evaluative; no formal definition |
An offering may meet some criteria and leave others open. The checklist therefore separates claim from evidence, not good providers from bad ones.
What does a construction consist of that needs to be checked?
The example is AWS's own description of the European Sovereign Cloud. The table states what AWS itself writes and what remains open or is to be checked through evidence. It is not an assessment.
| Component | Statement according to AWS (as of 14 Jan 2026 and FAQ) | Open or to be checked through evidence |
|---|---|---|
| Operator | Separate companies under German law; ‘AWS European Sovereign Cloud GmbH’ is the parent company of three entities for operating staff, infrastructure and trust services (AWS FAQ) | Shareholders above the GmbH |
| Contracting party | For EU-associated accounts Amazon Web Services EMEA SARL, Luxembourg (AWS FAQ) | Governing law of the contract terms: not stated in the FAQ, contract documents (addendum) not checked |
| Personnel | Operation ‘exclusively by EU residents located in the EU’, according to AWS including day-to-day operations, technical support and customer service; transition to EU citizens in the EU, an advisory board of EU citizens with two independent third parties (AWS News Blog) | Implementation, such as authorisation concept and access paths, is to be checked through evidence |
The open points correspond to checkpoints 1, 2 and 5 below. We did not check other provider programmes.
Which frameworks exist: BSI C3A, the EU framework and C5?
Three frameworks matter for tenders. They answer different questions.
| BSI C3A | EU Cloud Sovereignty Framework | BSI C5 | |
|---|---|---|---|
| Publisher | BSI | European Commission, DG DIGIT | BSI |
| Version | v1.0 of 27 Apr 2026, English version (the only one the BSI page listed on 10 Nov 2026) | Version 1.2.1, October 2025, implementation guidance (undated, PDF metadata June 2026) | C5:2026 (in German) final since end of March 2026 |
| Subject | Self-determined usability of a cloud service | Sovereignty of cloud providers in procurement | Information security of a cloud service |
| Bindingness | Not binding, no regulatory effect | Assessment instrument of the Commission for its tender | Via the minimum standard for federal bodies and by contract |
| Evidence | The provider demonstrates compliance through an audit, guide announced | Questions to bidders, supporting documents, assessment by the contracting authority | Attestation by an independent auditor (usually a Wirtschaftsprüfer) |
How is C3A structured?
C3A adopts the structure and objectives of the EU framework, but deliberately omits SOV-7 (Security & Compliance, covered by C5:2026, IT-Grundschutz and the HV Benchmark Compact) and SOV-8 (environment, outside the BSI's remit). C3A does not cover portability because the ‘Portability and Interoperability (PI)’ section of C5:2026 regulates it (BSI). By our count of its outline, the catalogue contains 30 criteria groups:
| Category in C3A | Criteria groups (excerpt from the catalogue) | Count |
|---|---|---|
| SOV-1 Strategic Sovereignty | Jurisdiction, Registered Office, CSP Effective Control, CSP Control Change | 4 |
| SOV-2 Legal & Jurisdictional Sovereignty | Extraterritorial Exposure, Audit Rights, State of Defense Takeover | 3 |
| SOV-3 Data Sovereignty | Data Residence, External Key Management, External Identity Provider, Logging and Monitoring, Client-Side Encryption | 5 |
| SOV-4 Operational Sovereignty | Operating Personnel, Remote Work, SOC, Data Exchange Monitoring, Disconnect, Reconnect and others | 10 |
| SOV-5 Supply Chain Sovereignty | Software, hardware and external services, Export Restriction, Capacity Management | 5 |
| SOV-6 Technology Sovereignty | Source Code Availability, Continuous Service Delivery, Software Development | 3 |
Criteria can be selected per use case: many exist in an EU variant and a variant for Germany (C1 and C2). According to C3A, restrictions to Germany should be justified and permissible under procurement law (SOV-1-01-SI).
How do SOV objectives, SEAL and score work in the EU framework?
The framework originates from the Commission's tender under the Cloud III Dynamic Purchasing System. The implementation guidance describes the mechanics:
| Element | Content |
|---|---|
| Objectives | SOV-1 Strategic, SOV-2 Legal & Jurisdictional, SOV-3 Data & AI, SOV-4 Operational, SOV-5 Supply Chain, SOV-6 Technology, SOV-7 Security & Compliance, SOV-8 Environmental Sustainability |
| SEAL levels | SEAL-0 No Sovereignty, SEAL-1 Jurisdictional, SEAL-2 Data, SEAL-3 Technological (in version 1.2.1: ‘Digital Resilience’), SEAL-4 Full Digital Sovereignty |
| Minimum level | The contracting authority sets a minimum SEAL per objective, SEAL-2 in the first tender; offers below it are rejected |
| Overall SEAL | The lowest level across all objectives |
| Score | Weighted per version 1.2.1: SOV-1 15%, SOV-2 10%, SOV-3 10%, SOV-4 15%, SOV-5 20%, SOV-6 15%, SOV-7 10%, SOV-8 5%; contracting authorities may adapt the points per answer |
Which legal framework stands behind it?
The checklist follows the frameworks, not the law. The law does explain why individual questions are asked. The table summarises documented provisions and is not legal advice.
| Provision | Content | As of the respective source |
|---|---|---|
| CLOUD Act, 18 U.S.C. § 2713 | Governs the territorial reach of the preservation and disclosure obligations of that chapter: data in the provider's ‘possession, custody, or control’, ‘regardless of whether’ it is located within or outside the United States. For content data, the statute generally requires a procedure under § 2703, for example a warrant from a competent court or other procedures named there. To be distinguished are preservation requests (§ 2703(f)) and further disclosure duties, for example under § 2709 for certain subscriber and transactional records on written request of the FBI; details not checked | In force since 23 Mar 2018 |
| 18 U.S.C. § 2703(h) | Special motion because of a conflict with foreign law. Conditions include: an agreement with a ‘qualifying foreign government’, the customer is not a US person and does not reside in the US, 14-day deadline. Other objections remain unaffected | The US Department of Justice lists agreements with the United Kingdom and Australia and, for the EU, only notices on negotiations (latest 3 Mar 2023). We did not find an agreement with the EU or Germany. As of the DOJ page: October 2023, later agreements not checked |
| FISA Section 702 | Programmatic surveillance of non-US persons outside the United States | As of the source (CRS, 22 Jun 2026): automatically repealed on 12 Jun 2026, existing orders continue until they expire, and according to lawmakers a one-year approval was granted in March 2026. Not conclusively checked since, we did not find a reinstatement |
| EU-US Data Privacy Framework | Commission adequacy decision of 10 Jul 2023 | Action T-553/23 dismissed on 3 Sep 2025, appeal C-703/25 P lodged on 31 Oct 2025; the register lists the case on 10 Nov 2026 as ‘Case in progress’, without hearing date, opinion or judgment; the order of 4 Jun 2026 admits Microsoft as an intervener |
| GDPR Art. 28, 44, 46, 48 | Transfers to third countries only under Chapter V; decisions of third-country authorities can be recognised only if based on an international agreement, without prejudice to other grounds for transfer under Chapter V (Art. 48); further processors only with the controller's authorisation (Art. 28) | Applicable law |
| Data Act Art. 28 and 32 | Providers publish the jurisdiction of their infrastructure (Art. 28(1)(a)) and a general description of their measures against international governmental access to non-personal data held in the Union where it would create a conflict with Union law or the law of a Member State (point (b)); they take adequate measures against such access (Art. 32) | Applies since 12 Sep 2025 (Art. 50) |
| Data Act Art. 25 and 29 | Notice period for initiating the switch at most two months; transitional period in principle at most 30 calendar days, where technically unfeasible up to seven months after a justified notification within 14 working days (para. 4), one-time extension by the customer possible (para. 5); data retrieval at least 30 days; switching charges prohibited from 12 Jan 2027 (Art. 29), subject to Art. 31: Art. 29 does not apply to custom-built services not offered at broad commercial scale via the service catalogue, and Chapter VI does not apply to services provided as a non-production version for testing and evaluation purposes for a limited period of time | Details in the article EU Data Act Switching Charges |
| Cloud and AI Development Act | Proposal COM(2026) 502 of 3 Jun 2026 with four Union assurance levels, level 1 by self-assessment, levels 2 to 4 by third-party audit | Document dated 3 Jun 2026: proposal, not in force; a later procedural status is not checked |
| EUCS | European certification scheme for cloud services, planned according to the BSI | Status of the sovereignty requirements not conclusively checked, secondary sources contradict each other |
What do public contracting authorities require in practice?
In practice, security and sovereignty requirements are combined. The following points are documented:
| Framework | Requirement | Source |
|---|---|---|
| BSI minimum standard for the use of external cloud services (version 2.1) | The body sets at least the C5 basic criteria as a requirement on the provider in its security policy (NCD.2.1.02 b); agreements SHOULD be concluded exclusively under German law and with German courts (NCD.2.2.03); subcontractors must meet the requirements as well, and audit rights extend to them (NCD.2.2.02); all locations of data processing including backups must be fixed by contract (NCD.2.2.04); data return with deadlines and format must be regulated by contract (NCD.2.2.07) | BSI (in German) |
| C5 attestation under the minimum standard | According to the BSI, an attestation is not sufficient to meet the minimum standard | BSI FAQ (in German) |
| EVB-IT Cloud | Contract template with terms and a criteria catalogue for cloud services; the IT Planning Council recommends its members to apply it (decision 2022/01 of 11 Feb 2022). We did not check the current version at CIO Bund | IT-Planungsrat (in German) |
| Deutschland-Stack, criterion ‘Digital Sovereignty’ | ‘Mindestens ist eine Wechselfähigkeit zwischen Betreibern und Anbietern notwendig’ (at minimum, switchability between operators and providers is necessary); recommendation (‘sollte’): buy primarily in the European single market | Deutschland-Stack (in German) |
A general statutory obligation for companies does not follow from these frameworks: C3A is not binding, the minimum standard addresses federal bodies, and the EU framework applies to the tender in which it is used. Companies can use the frameworks as a template or incorporate them by contract; statutory obligations remain unaffected.
The checklist: 13 checkpoints with question, evidence and warning sign
The checkpoints follow the C3A categories and add legal and contract questions. The ‘Source reference’ column names the primary source of the respective topic. Questions, required types of evidence and warning signs are our own derivations and not requirements of the sources, unless a criterion is named explicitly. Where we found no counterpart in C3A or the EU framework, it says so there. Warning signs point to open questions and are not proof of a defect.
Ownership, law and access from outside (checkpoints 1 to 4)
| No. | Question to the provider | Evidence | Warning sign | Source reference |
|---|---|---|---|---|
| 1 | Who holds the shares in the provider, and who can determine strategy, finances or operations, up to the ultimate parent company? | Ownership structure up to the top level, commercial register extract, contractual assurance of the control relationships | Information ends at the EU subsidiary; control is ‘transparent’ only on request | C3A SOV-1-02, SOV-1-03; EU framework SOV-1 |
| 2 | Which law and which place of jurisdiction govern the contract, and which company is the contracting party? | Contract and terms; in addition the statement on the jurisdiction of the infrastructure on the provider's website (Art. 28 Data Act, concerns the infrastructure, not the contract law) | Contracting party or place of jurisdiction outside the EU; mandatory conciliation proceedings first | C3A SOV-1-01; minimum standard NCD.2.2.03 (recommendation for federal bodies); in addition Data Act Art. 28(1)(a) (jurisdiction of the infrastructure) |
| 3 | Which legal systems outside the EU can compel access to data or service, and how does the provider assess the risk? | Written, annually updated legal risk assessment; transparency report on authority requests | Blanket statement (‘the CLOUD Act does not affect us’) without justification; reference to location only | C3A SOV-2-01; EU framework SOV-2; 18 U.S.C. § 2713 |
| 4 | How does the provider handle orders from third-country authorities: review, notifying the customer, legal remedies? | Contract clause on notification, challenge and minimisation; description of measures under Art. 28(1)(b) Data Act (concerns non-personal data in the Union) | Promise ‘we will fight it’ without a clause; notification only ‘where permitted’ without a procedure (statutory secrecy duties can require a limitation, the procedure is what matters) | GDPR Art. 48; Data Act Art. 32; 18 U.S.C. § 2703(h); we did not find a criterion on this in the C3A catalogue (v1.0) |
Operations, keys, data and supply chain (checkpoints 5 to 8)
| No. | Question to the provider | Evidence | Warning sign | Source reference |
|---|---|---|---|---|
| 5 | Who has logical or physical access to the infrastructure and customer support: nationality, residence, location of access paths, follow-the-sun support across time zones? | Operations and authorisation concept, access logs, statement of the SOC location | EU personnel only ‘on site’; remote access from third countries without a technical block; support rotates worldwide | C3A SOV-4-01, SOV-4-02, SOV-4-04; EU framework SOV-4 |
| 6 | Where are keys generated and used, who can trigger decryption, and what does revoking a key do? | Architecture description (external key management, client-side encryption), test record of key revocation | ‘BYOK’ without stating where the key is used; key material in provider HSMs | C3A SOV-3-02, SOV-3-05; EU framework SOV-3; AWS KMS as an example |
| 7 | Where are the following stored and processed: customer data, derived data (logs, telemetry), account data and provider data? Which data goes to third parties or group companies? | Data flow diagram, list of data types per location, documentation of data exchange with third parties | Promise for customer data only; telemetry and support data worldwide; group companies not treated as third parties (C3A treats them as third parties) | C3A SOV-3-01, SOV-4-07, SOV-4-08; minimum standard NCD.2.2.04; EU framework SOV-3 |
| 8 | Which software components, hardware suppliers, external services and subcontractors are involved, each with country and company? | Subcontractor list with country and group affiliation; software bill of materials (SBOM) per BSI TR-03183-2 or equivalent (as per C3A); audit rights also for subcontractors | List gives company names only; vendor of the platform software missing; subcontractors without audit rights | C3A SOV-5-01 to SOV-5-03; GDPR Art. 28; minimum standard NCD.2.2.02; EU framework SOV-5 |
Dependency and evidence (checkpoints 9 and 10)
| No. | Question to the provider | Evidence | Warning sign | Source reference |
|---|---|---|---|---|
| 9 | What happens if a software supplier, a licence server or a third country stops delivery, updates or connection? | Contingency plan, record of the annual disconnect test, proof of a source code copy in the EU, licence model | Licence check or heartbeat against servers outside the EU; disconnect never tested; a single vendor without fallback | C3A SOV-4-09, SOV-5-04, SOV-6-01, SOV-6-02; EU framework SOV-6 |
| 10 | Which certificates and attestations exist, for which services, regions and periods, with which auditor? | C5 report (type 2, according to the minimum standard one possible form of evidence) with scope, audit period and deviations; ISO 27001 certificate with scope | ‘C5 certified’ without service and region; certificate presented as proof of sovereignty | BSI C5 (attestation for the audited services in the defined regions); C3A presupposes C5; ISO/IEC 27001 concerns the information security management system |
Exit, audit rights and contract (checkpoints 11 to 13)
| No. | Question to the provider | Evidence | Warning sign | Source reference |
|---|---|---|---|---|
| 11 | How, in which format and on what terms does the customer get data and configuration back, and which deadlines apply? | Exit plan, export formats (open, documented), contract clauses on termination, transition period and data retrieval | Proprietary formats; deadlines that go beyond Art. 25 without technical unfeasibility (para. 4) or an extension by the customer (para. 5); switching charges from 12 Jan 2027 (exceptions in Art. 31, details in the article EU Data Act Switching Charges) | Data Act Art. 25(2), Art. 29; C5:2026 section PI; minimum standard NCD.2.2.07; EU framework SOV-4, SOV-6 |
| 12 | Which audit rights does the customer have, which does a competent authority have, and who audits subcontractors? | Audit clause in the contract, audit reports, documented procedure for authority audits | Audit right only through third-party reports (our own heuristic, the minimum standard permits waiving own audit rights in justified cases); no documented procedure for authority audits; audit fees that effectively deny the right (C3A names this for the authority audit) | Authority audit: C3A SOV-2-02; customer audit rights: minimum standard NCD.2.2.01 j (recommendation for federal bodies) and NCD.2.2.02; EU framework SOV-7 (not adopted by C3A) |
| 13 | How are changes of owners, prices, scope of services and terms announced, and which special termination rights exist? | Change-of-control clause (C3A: announcement 90 days in advance of changes that could undermine or affect the C3A controls of the service, including significant changes to ownership, shareholding or governance), price adjustment clause, special termination right | Unilateral right to change terms without notice period and without special termination | C3A SOV-1-04 (change of control only); price and contract stability is our own addition without a primary source |
How do you score the answers?
The matrix below is WZ-IT's own working aid. It is not a vendor statement, not a standard and not part of C3A or the EU framework. It carries over only one principle of the EU framework: the lowest level across all objectives determines the overall result.
| Level | Meaning | Example |
|---|---|---|
| A: evidenced | The answer is in writing, the evidence is a document, a contract clause or an attestation with its scope, checked by third parties or contractually binding | Register extract, contractually assured subcontractor list with country, audit clause |
| B: answered, evidence missing | The answer is verbal or a marketing claim, no evidence was presented | ‘We operate with EU personnel only’ without an authorisation concept |
| C: open | Question unanswered or the answer contradicts the evidence | Shareholders above the subsidiary not named |
Three steps:
- Set must or can. The contracting authority sets for each checkpoint whether it is a must or a can, depending on the protection needs of the data. C3A offers selection options for this, such as EU or Germany for location and personnel.
- Set the type of evidence. For must-have points, accept level A only. The Commission describes self-declarations as costly to assess, so the type of evidence belongs in the tender specification.
- Score the answers, the lowest level counts. Each checkpoint gets A, B or C with the location of the evidence. A must-have point at B or C leads to rework or exclusion, a can-have point to a deduction.
‘Evidence missing’ does not mean the provider fails the requirement. It means the contracting authority cannot confirm it. Whether scoring under this scheme is permissible in a specific procurement procedure must be checked under procurement law.
Which often-heard assumptions do not hold up?
The table checks often-heard assumptions, we did not survey how frequent they are.
| Assumption | Finding | Source |
|---|---|---|
| A data centre in the EU makes a service sovereign | Location is one checkpoint (C3A SOV-3-01). Ownership, law, operations and supply chain must be checked separately. The reach of the disclosure obligations under the CLOUD Act attaches to the provider's possession or control, not to the storage location. Disclosure obligations exist only within statutory procedures (§ 2703, § 2709; details not checked) | C3A, 18 U.S.C. § 2713 |
| The EU subsidiary of a US group is not subject to the CLOUD Act | Not provable in general. By its wording, the provider and its ‘possession, custody, or control’ are decisive. Whether a specific company falls under it is an individual case (assessment); in its FAQ, AWS writes that the CLOUD Act applies to any provider with operations or a legal presence in the US. Ask for a written justification and obtain legal advice | 18 U.S.C. § 2713, AWS FAQ |
| C5 certifies sovereignty | C5 concerns information security, the attestation applies to the audited services in the defined regions, and the provider commissions the auditor. Autonomy is covered by C3A, which presupposes C5 | BSI C5, BSI C3A |
| BYOK solves the problem | With AWS KMS, BYOK means the service uses a copy of the imported key material. The operation with a key at the customer is offered there by an external key store (HYOK), where AWS KMS first encrypts itself and the external key adds a second layer. The service still encrypts the payload with data keys. Client-side encryption is another route (C3A SOV-3-05). Encryption is not a complete solution for metadata, operations and availability (assessment) | AWS KMS, C3A SOV-3-02, SOV-3-05 |
| Open source means sovereign | Open licences are one factor (SOV-6), not the whole framework. Licences can change, for example at HashiCorp in 2023 and Redis in 2024 and 2025 (details in the FAQ) | HashiCorp, Redis |
| C3A or the EU framework are binding quality seals | According to the BSI, C3A is not binding and an audit guide is announced. The EU framework was the instrument of one tender, and the Cloud and AI Development Act was a proposal on 3 Jun 2026 (later status not checked) | BSI, COM(2026) 502 |
Status and methodology
Retrieved: 10 November 2026. The basis is the C3A document and BSI pages, Commission documents, the minimum standard, statute texts (EUR-Lex, govinfo.gov), a CRS report and AWS documentation, each retrieved on 10 November 2026 and linked in the text. Sources with their own interests (CISPE, GI working groups), our own assessments and the scoring matrix are marked as such.
Not found or not checked:
- German version of C3A and audit guide: not found on the BSI pages.
- FISA Section 702 after 22 June 2026 and the procedural status of the Cloud and AI Development Act after 3 June 2026: not conclusively checked.
- Current version of EVB-IT Cloud, EUCS sovereignty requirements, sovereignty programmes of providers other than AWS: not checked.
- Commission news items on the framework were not reachable when retrieved, the implementation guidance states no date, its PDF metadata says June 2026.
- A formal definition of the term by the GI: not found, the GI papers only describe it.
Later changes are not included.
Our approach at WZ-IT
Anyone already running on AWS, Azure or Google Cloud and considering a move starts with the cloud exit assessment. It evaluates costs, dependencies per service, a target architecture in European data centres or on own hardware, and the migration path. The result is a decision paper and a fixed-price quote for the migration. Requirements for data location and availability are among the inputs of the assessment. Contract or legal advice on cloud contracts is not part of the assessment. The checklist in this article is an aid for contracting authorities, not part of the offering.
After the decision, WZ-IT migrates the environment to German, European or customer-owned target environments and, on request, continues to operate it, on servers in the customer's own account with the provider or on the customer's hardware. Managed server operations comprise monitoring, updates, backups and the agreed response for the migrated systems.
Are you weighing a move away from a hyperscaler? We discuss your services, data location requirements and the migration path with you. View the cloud exit assessment · View migration · Book an initial consultation (free and non-binding)
Further guides
- Cloud Exit for SMEs: Costs, Dependencies, Target Architecture and Process
- EU Data Act Switching Charges: What Becomes Free on 12 January 2027
- It's Time to Move Servers and Data to European Clouds
- Rocket.Chat and AWS European Sovereign Cloud
- Leaving AWS: Compare European Cloud Providers
- Cloud migration and cloud exit overview
Sources
- BSI: C3A - Criteria enabling Cloud Computing Autonomy (PDF, v1.0, 27 Apr 2026)
- BSI: C3A page
- BSI: press release on C3A, 27 Apr 2026 (German)
- BSI: C5 criteria catalogue (German)
- BSI: C5 FAQ (German)
- BSI: C5:2026, criteria catalogue (PDF, German)
- BSI: C5:2026 (German)
- BSI: Minimum standard for the use of external cloud services, version 2.1 (German)
- BSI: FAQ on the minimum standard (German)
- European Commission: Cloud Sovereignty Framework, implementation guidance
- European Commission: Cloud Sovereignty Framework, version 1.2.1
- EUR-Lex: proposal for the Cloud and AI Development Act, COM(2026) 502
- EUR-Lex: Data Act, Regulation (EU) 2023/2854
- EUR-Lex: GDPR, Regulation (EU) 2016/679
- US Code (govinfo.gov): 18 U.S.C. § 2713
- US Code (govinfo.gov): 18 U.S.C. § 2703
- US Code (govinfo.gov): 18 U.S.C. § 2709
- Gesetze im Internet: section 5 UWG (German)
- Gesetze im Internet: section 5a UWG (German)
- US Department of Justice: CLOUD Act Resources
- Congressional Research Service: The Impact of FISA Section 702's Repeal, 22 Jun 2026
- General Court: press release 106/25 on T-553/23 (Latombe)
- Official Journal: appeal C-703/25 P
- IT Planning Council: decision 2022/01 on EVB-IT Cloud (German)
- Deutschland-Stack: criteria and maturity (German)
- heise: 25 European CEOs warn the EU against sovereignty washing (German)
- CISPE: open letter on the Cloud and AI Development Act
- heise: The sovereign cloud that isn't
- Gesellschaft für Informatik: Schein-Lösungen stoppen, discussion paper, 8 Apr 2025 (German)
- GI working group Digital Sovereignty: Warum Souveränitätswashing strafbar sein muss (German)
- AWS News Blog: Opening the AWS European Sovereign Cloud
- AWS: FAQ on the European Sovereign Cloud
- AWS KMS: Importing key material
- AWS KMS: External key stores
- HashiCorp: Adopts Business Source License
- Redis: Redis Adopts Dual Source-Available Licensing, 20 Mar 2024
- Redis: Redis is now available under the AGPLv3
