How can Europe leverage laws to secure cloud sovereignty? – POLITICO

European organizations have to reckon with how to keep up with the modern world without sacrificing sovereignty. Geopolitical instability, tightening regulatory expectations and the rapid adoption of artificial intelligence (AI) mean that, for many organizations, sovereignty now sits alongside resilience and business continuity in board-level risk discussions. The question they can no longer defer is how to harness the opportunities of the modern cloud without surrendering control over their own data. Answering it requires honesty about what sovereignty means, and about where it can actually be found.

A definition Europe can trust

The European Commission’s forthcoming Cloud and AI Development Act (CADA) is the right vehicle for that honesty: giving Europe a shared, enforceable definition of what “sovereign” actually means. Without such a definition, the market is filled with commercial offerings that claim the sovereignty label without delivering the substance, a practice described as “sovereignty washing.” This gap has led some organizations to treat open source as the answer. But open source software is a licensing model, not an operating model, and it doesn’t settle questions about infrastructure or jurisdiction or even reliability and access. It’s not a route out of dependency, it’s a different dependency on project sponsors and code maintainers. A definition gives policymakers a way to properly assess claims of sovereignty against a consistent standard rather than taking marketing at face value.