The EU Cloud Sovereignty Framework and the BSI catalogue C3A define what a cloud provider must fulfil to be considered sovereign. Both are applied primarily through questionnaires and provider self-declarations, so the resulting assessment reflects what a provider states rather than what can be independently verified. There is also no machine-readable format to describe sovereignty properties along the framework criteria.
We present an ongoing research project at TU Dresden, supervised by Prof. Ivan Gudymenko and Dr. Stefan Köpsell, examining whether and how sovereignty of cloud infrastructures can be made measurable: which framework requirements can be turned into objectively measurable technical indicators; how such indicators can be collected with tooling and condensed into a traceable assessment; and what that assessment can say when comparing hyperscalers and EU providers.
The talk covers the gap between claimed and verifiable sovereignty, our approach so far, and the open questions we would like to share with the community.
