Three words show up in the same procurement paragraph and are treated as interchangeable: data residency, data sovereignty, digital sovereignty. They are not. Conflating them is the single most common reason a European operator signs a contract that looks sovereign and behaves like a dependency.
Three words procurement conflates
- Data residency — where the bytes are stored. A geographical statement. Answered by a region label on a cloud console.
- Data sovereignty — which legal regime can compel disclosure, modification or interruption of those bytes. Answered by the corporate structure and jurisdictional exposure of every entity in the operational chain, not by the region label.
- Digital sovereignty — the operator's demonstrated ability to continue operating when a single dependency in that chain is removed. A posture, exercised, not asserted.
Residency is necessary. It is nowhere near sufficient. A dataset resident in Frankfurt, operated by a subsidiary whose ultimate parent is subject to extraterritorial disclosure orders, is resident and non-sovereign at the same time. This is not a hypothetical; it is the default configuration of most European cloud contracts signed before 2023.
Why the distinction matters operationally
The three concepts fail on three different Mondays.
- Residency fails when a vendor quietly re-routes traffic through a support region to meet an SLA. The dataset briefly ceases to be resident. The contract is technically breached; the regulator, sensibly, cares more about the pattern than the incident.
- Sovereignty fails when a foreign legal instrument compels a parent company to produce, freeze or interrupt data held by its European subsidiary. Residency is intact. Sovereignty is not.
- Digital sovereignty fails when the operator cannot substitute the provider within a defined recovery window. Residency and legal sovereignty may both be intact; the institution is still not sovereign in any operational sense.
Three tests to apply on the next procurement
- The substitution test. If this provider disappeared on Monday, what is the operator's position on Friday? Answer as a list, not a sentence.
- The jurisdiction test. Which legal regimes — plural — can compel disclosure or interruption of the data flowing through this system? Is that set compatible with the institution's mandate today, and under foreseeable political changes?
- The continuity test. Has the institution rehearsed a substitution within the defined recovery window in the last twelve months? "We have a plan" is not a continuity posture; "we exercised the substitution last quarter within fourteen days" is.
A procurement paragraph that survives all three tests can honestly use all three words. A paragraph that survives only the first should say "resident" and stop there.
Frequently asked
Is a sovereign-cloud offering the same as digital sovereignty? No. A sovereign-cloud offering is an input to a sovereignty posture; it is not the posture itself. The posture is what the operator does with the input over time.
Does data residency inside the EU protect against extraterritorial disclosure orders? Not by itself. Protection depends on the corporate structure, the applicable legal instruments, and the operational separation between the European entity and any parent subject to foreign law. Read the sovereignty essay for the underlying framework.
Where does the EU AI Act sit in this picture? The AI Act adds a fourth vector: model provenance and orchestration. Even fully sovereign data can be processed by non-sovereign weights and orchestration layers. Article-6 high-risk classification forces the operator to answer for the whole chain, not just the storage layer. See the AI Act essay.
First published May 2026 · Frankfurt am Main.