Three companies—Google, Amazon and Microsoft—together account for 70% of the European cloud market. European providers each hold a market share of approximately 2%. This is more than just a market statistic. It reflects a balance of power that directly affects who can, in practice, access the data held by Dutch public sector organisations and which laws govern that access. The Dutch government has decided that this needs to change. In a memorandum published in June 2026, the Ministry of the Interior and Kingdom Relations’ NDS Cloud Programme explains how the government intends to build its own sovereign cloud service. The document is concrete in its approach, setting out a timeline, a selected scenario, a technical strategy and an honest acknowledgement of the challenges involved.
The risks associated with current dependencies are not abstract. US legislation—including the CLOUD Act, Section 702 of FISA and Executive Order 12333—gives US authorities the ability to request data from US companies, even when that data is stored in Europe. And this is not merely a theoretical concern: the bankruptcy of Amsterdam Trade Bank was partly caused by the effects of US sanctions. In addition, the decision by a US company to disable the email account of the chief prosecutor of the International Criminal Court demonstrated that digital dependency can pose a direct threat to the performance of public functions.
To assess how sovereign a cloud service really is, the Dutch government uses the EU Cloud Sovereignty Framework as a benchmark. This framework measures sovereignty using the Sovereignty Effectiveness Assurance Levels, or SEALs. Developed by the European Commission, it ranges from SEAL0, which represents no sovereignty and full control by non-EU parties, to SEAL4, which represents full digital sovereignty: technology and operations entirely under EU control, with no critical foreign dependencies.
This framework is useful far beyond the public sector. It provides a practical way to assess what a provider that describes itself as “sovereign” actually offers. A service running on servers in the Netherlands but managed by a US company is unlikely to achieve even SEAL1 or SEAL2. And an organisation that requires SEAL3 for a particular application will also need a cloud provider that achieves at least SEAL3.
Following an open market consultation involving 69 parties and research conducted by Gartner, the government has chosen the most ambitious scenario: building an entirely new, centrally managed sovereign cloud service. The plan is not to modernise existing infrastructure, which would carry forward legacy dependencies. Nor is it simply to adopt a governance model under which third parties build the service, as this would not provide sufficient control. Instead, the government will build a new service based on open-source technology, hosted in existing government data centres, with the intellectual property owned by the government.
The timeline is clearly defined. The ongoing proof of concept will be evaluated well before the end of 2026. By the end of 2026, the first pilot applications are expected to be running in production. Initial migrations will begin in 2027, followed by a scale-up to government-wide deployment during the period from 2028 to 2030.
The development of a sovereign cloud service for use across government will have a direct impact on the market. For companies providing services to the public sector, the procurement landscape will change: SEAL levels will become part of tender requirements, open-source standards will become the norm, and suppliers that fail to meet the sovereignty criteria will risk being excluded from contracts.
For companies considering their own digital sovereignty, the SEAL framework offers a useful benchmark for assessing their current position and justifying their cloud choices to directors, regulators or customers.
Do you have questions about the legal aspects of cloud procurement, GDPR compliance, public procurement law or contractual protection in IT agreements? Please contact Natascha van Duuren, partner and lawyer specialising in IT, Privacy & Cybersecurity.
Would you like to receive a monthly overview of our latest legal updates and blog articles? Subscribe to our newsletter.
