4·
4 days agoThe tricky part is that “reducing reliance on non-EU providers” is often not visible from the outside.
A tool may be headquartered in the EU but predominantly funded from the US, or hosted in the EU but owned by a US parent company. In such cases, it may still fall within the reach of the US CLOUD Act.
When I reviewed around 180 “European” SaaS alternatives, roughly one in six turned out to be EU-headquartered but mostly US-funded. That means sovereignty needs to be assessed at the ownership and sub-processor level, not only by looking at where the service is hosted.
The four-tier procurement model is the most concrete part here, but probably also the hardest to implement well, because “European provider” is not a simple yes/no category.
From reviewing around 180 EU and privacy-focused tools, I saw the same pattern repeatedly: a vendor can be EU-headquartered but US-funded, EU-owned but hosted on AWS or GCP, or open source but still using US sub-processors. Any of these can bring back the same “kill switch” or CLOUD Act exposure the top tier is meant to avoid.
So the model depends heavily on the definition of “sovereign.” If it only means “EU-registered company,” many providers in the top tier may still have US ownership, funding, or infrastructure underneath.
If it means ownership, hosting, and sub-processors all need to check out, then the real pool of qualifying providers is much smaller than it looks. But it’s totally possible to build using complete sovereign providers, it’s just in some cases the quality is a bit behind. I’m curious where the final criteria will land.