The EU Cloud Sovereignty Framework and the BSI’s C3A catalogue set out the requirements a cloud provider must meet to be considered sovereign. Both are implemented primarily through questionnaires and self-declarations by providers, so the resulting assessment reflects what a provider states rather than what can be independently verified. There is also no machine-readable format for describing sovereignty properties in accordance with the framework criteria.
We present an ongoing research project at TU Dresden, supervised by Prof. Ivan Gudymenko and Dr Stefan Köpsell, which examines whether and how the sovereignty of cloud infrastructures can be made measurable: which framework requirements can be translated into objectively measurable technical indicators; how such indicators can be collected using tools and consolidated into a traceable assessment; and what that assessment reveals when comparing hyperscalers and EU providers.
The talk addresses the gap between claimed and verifiable sovereignty, our approach to date, and the outstanding questions we would like to share with the community.
