EU Cloud Sovereignty Framework in Practice: How Key Management Unlocks Compliance to SOV-3 and SEAL-2

With cloud-utilization, data sovereignty considerations are the top topic for organizations across all industries. Many still treat data residency and data sovereignty as the same thing. But they are truly not. Residency defines where data is stored. Sovereignty defines who controls it, which laws can reach it, and who can access it.

Hence, having data hosted in regional data center does not automatically make it sovereign. 

The diverse landscape of regulation, laws and compliance requirements is making this gap harder to ignore.
 

Why organizations are forced to rethink their cloud data protection strategy

The US CLOUD Act allows US authorities to compel US-incorporated cloud providers to disclose stored data, regardless of where that data physically resides. Meanwhile, data protection regulations such as GDPR, Schrems II, NIS2, and DORA require organizations to demonstrate control over sensitive data and to protect it accordingly.

The Cloud Sovereignty Framework (CSF) provides guidelines for secure cloud utilization to European organizations. 

In this blog post, we are uncovering the European Commission's Cloud Sovereignty Framework (CSF) and its two core models, SOV and SEAL, and why strong cryptographic key management outside the cloud is essential to meet the SOV-3 and SEAL-2 requirements directed towards strong Data Sovereignty.

→ Watch our Webinar “Your Cloud. Your Keys. Your Control. for more insights on how to enable strong data sovereignty here
 

The EU Cloud Sovereignty Framework in a Nutshell

The European Commission introduced the Cloud Sovereignty Framework (CSF) in late 2025. Its purpose is to help European organizations use cloud services without losing control over their data, operations, or legal protections.
The framework assesses how sovereign a cloud service really is, by answering four questions:

• Who controls the service?
• Which laws can reach it?
• Who can access the data?
• How dependent is it on non-EU entities?

Two models sit at the core of the framework, each playing a distinct role:

• SOV (Sovereignty Objectives Vector) model: Defines what is assessed. It classifies sovereignty across eight different objective levels, with each one representing a separate category of sovereignty.
• SEAL (Sovereignty Effectiveness Assurance Levels) model: Defines how well a cloud service meets a given sovereignty objective. Unlike SOV, SEAL works as an assessment scale, ranging from no meaningful sovereignty to full sovereignty.

Strong Key Management as the Cornerstone for SOV-3 and SEAL-2 Compliance

The SOV-3 (Data & AI Sovereignty) component focuses on data itself: where it is stored, how it is processed, and how it is used by AI. This category requires comparatively strong data residency and protection measures including the cloud customer — not the cloud service provider — holds effective control over cryptographic access. This implies Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK) to protect data at rest and in transit.

The most effective way to enable both architectures is an external Key Management System (KMS). It provides secure key generation, central key control, and strict separation of keys from cloud-stored data.

External key control with BYOK and HYOK provides the cryptographic mechanism to enforce your right to govern your data independent of a third-party cloud provider.

→ Read our blog post “Unlocking Full Data Sovereignty Through BYOK and HYOK” for a deeper technical breakdown of BYOK and HYOK and how to choose between them here
 

SEAL-2 (Data Sovereignty) is the assurance level most relevant to today's cloud data sovereignty discussion.
To achieve this level, CSPs must demonstrate sovereignty across several dimensions, including:

• Strategic sovereignty
• Legal and jurisdictional sovereignty
• AI sovereignty
• Operational sovereignty

Together, these indicate that strong sovereignty exists on the logical and technological level, even where some external dependencies remain.

Here again, key management is the enabling technology. A capable KMS adds strong key security and granular access control to the encryption keys. If a foreign authority compels a provider to hand over data, encrypted data without its keys remains unreadable. When the keys stay under the organizations’ sole control, outside the cloud environment, the CSP has zero access to them and has no way to disclose the data in readable form.

Quick Roundup: What SOV and SEAL Mean for Your Cloud Security Strategy

True data sovereignty is more than ensuring data hosting in Europe. It requires full control over your data globally based on strong key management. Data centers might be located in Europe, but data still be exposed to foreign legal reach. 

The CSF helps organizations evaluate whether a cloud service delivers real control, enforceability, and resilience.

For data sovereignty in the cloud, the SOV-3 / SEAL-2 level is the relevant target. Broader sovereignty goals, covering supply chain control, technical sovereignty, and infrastructure sovereignty, may require higher levels.

To unlock these sovereignty levels and protect cloud-stored data against extraterritorial laws, strong key management is not just recommended. It is a clear must-have.

Enable your Data Sovereignty Strategy with Utimaco

Utimaco's purpose-built key management solutions keep your cryptographic keys under your full control. They help you meet SOV-3 and SEAL-2 requirements while achieving compliance with legal and regulatory mandates across the globe.

Enterprise Secure Key Manager (ESKM) is the most interoperable and integrated KMS in the market. It provides a single pane of glass for all cryptographic keys across on-premises, hybrid and cloud environments. Available as hardware or virtual appliance it integrates with all major CSPs.

Enterprise Key Manager as a Service (EKMaaS) delivers enterprise-grade key management as a fully managed, geo-redundant service combining KMS and HSM capabilities. 

About the Author

Silvia Clauss

Head of Product Marketing