Delos Cloud under the CADA framework – Why the SAP-Microsoft "administration cloud" structurally fails to reach sovereignty Level 3

On 3 June 2026 the European Commission tabled the draft Cloud and AI Development Act (CADA) as COM(2026) 502. Its centerpiece is Article 16 and the Union Assurance Framework with four sovereignty levels. The scale applies first to cloud procurement by EU institutions and member states in sensitive areas, but the effect reaches deep into German municipal and Land administration: the Vergabebeschleunigungsgesetz passed in April 2026 has already anchored sovereignty assessments in German procurement law in anticipation.

For Delos Cloud GmbH – founded in 2023, marketed as a "sovereign administration cloud" on Microsoft Azure, and having signed the final contracts with Microsoft and Arvato Systems in June 2026 – the CADA framework marks the moment when its own marketing position gets measured against a new legal scale. The result is unambiguous: Delos structurally reaches Level 1, partially Level 2, but not Level 3. Why that is and what public bodies, districts, and municipalities need to take away from this for their cloud procurement from autumn 2026 onwards, we unpack in the following sections.

The CADA sovereignty framework – four levels in brief

Article 16 CADA defines four Union Assurance Levels (UAL 1 to 4). They are not certifications, but target catalogs against which awarding authorities align their tenders.

• UAL 1 – data locality. Processing and storage happen inside EU infrastructure. The provider may be a US company as long as the data centers sit in the EU.
• UAL 2 – transparency and documented independence. In addition to UAL 1, the software supply chain must be disclosed, sub-processors are named, and technical dependencies on third countries are documented.
• UAL 3 – EU ownership and control. Additionally, the operating entity must be EU-owned, key personnel must hold EU citizenship, and extraterritorial access rights of foreign states are excluded. This tier demands freedom from the CLOUD Act, FISA 702, and Executive Order 12333.
• UAL 4 – full foreign-technology freedom. Reserved for state secrets, defense, intelligence. The Commission estimates need at one per cent of all public procedures.

UAL 3 is the interesting tier. It is designed structurally for every administrative procedure that processes special categories under Article 9 GDPR – health data in social offices, biometric data in identity documents, data on ethnic origin in youth welfare, political opinions in electoral and citizen participation procedures.

What Delos Cloud technically is

Delos Cloud GmbH was founded in 2023 as a fully owned SAP subsidiary, funded with around two billion euros. The platform is a physical instance of Microsoft Azure operated in data centers in Berlin and Frankfurt. Operations sit with Arvato Systems (a Bertelsmann subsidiary). Software licenses and security updates come from Microsoft. Azure Foundational Services, Azure Mainstream Services, and Microsoft 365 run on the platform. Target customer base: German federal, state, and municipal administration.

Legally, Delos is a German GmbH with German personnel and German headquarters. Technically and operationally, however, the platform is not sustainably operable without Microsoft – for updates, patches, feature development, core know-how. This is exactly where Level 3 of the CADA definition fails.

Why Delos structurally fails to reach Level 3

UAL 3 demands not just EU ownership but controllability of the software supply chain. A provider that structurally sources its codebase, security updates, and operational know-how from a US company cannot guarantee freedom from extraterritorial access – not for legal reasons (the German Delos instance may be shielded from CLOUD Act requests) but for operational ones. Whoever controls the update chain controls the platform.

Delos co-CEO Georges Welz himself put this on the record in a 2024 Heise interview: in a hypothetical US trade conflict the platform could run independently "for a few months". The Open Source Business Alliance (OSBA) cited exactly this dependency in an open letter to the German Ministry of the Interior as an argument against a Delos-first approach. The Baden-Württemberg state ministry acknowledged in a 2024 response to the Landtag that the Delos platform could "not fully ensure digital sovereignty".

Those statements were still political debate in 2024. With CADA they become an exclusion criterion for tenders from UAL 3 upwards starting in 2027. Whoever buys the platform today with long-running contractual commitments risks a forced migration within two years of CADA entering into force.

"Sovereignty with an expiration date" – why this becomes legally relevant

Until June 2026, the phrase "sovereignty with an expiration date" was a journalistic label. With the CADA draft it becomes a procurement-law test. A target sovereignty level of UAL 3 that only holds as long as the US supplier stays cooperative is not UAL 3. Signing such contracts produces structural procurement-law risk – complaints from losing bidders, annulment applications, in the worst case rescission.

This already applies in anticipation: § 121 GWB as amended by the Vergabebeschleunigungsgesetz demands that sovereignty aspects be considered in security-relevant procurement. Whoever signs a ten-year Delos contract in 2026 for a procedure with UAL 3 requirements must prove that sovereignty. The proof is hard to produce.

Context: the CLOUD Act access situation has not eased in 2026, the Bundestag Operation Sovereignty decision has sent the political signal for federal bodies, and the CADA structure presented in June 2026 has delivered the procurement-law scale. Together, the three form consistent pressure to act.

What public bodies and municipal IT must now lock into contracts

Four clauses belong in every cloud tender from July 2026 onwards whose target level is UAL 3.

• Proof of ownership and control of the operating entity. The bidder submits an audited overview of shareholder structure and voting rights. Proof obligation throughout contract duration.
• Exclusion of extraterritorial access. The bidder contractually declares that no disclosure obligation under CLOUD Act, FISA 702, Executive Order 12333, or comparable legislation applies. Breaches trigger extraordinary termination and damages.
• Full sub-processor disclosure with jurisdiction naming. Changes are subject to notification before taking effect, with the right of the client to reject.
• Exit clause with data extraction in open format within 30 days after contract end, at no additional cost. Formats: OpenDocument for documents, JSON/CSV for structured data, iCal for calendars, vCard for contacts.

Whoever adopts these clauses into their own procurement practice automatically re-evaluates Delos. For simple collaboration and citizen communication, Delos may continue to fit. For social welfare offices, youth welfare, election administration, civil registry, and every procedure with special data categories under Article 9 GDPR, a different route must be chosen.

Sovereign alternatives: what actually reaches UAL 3 today

On the application layer: openDesk from the Zentrum für Digitale Souveränität, Nextcloud Enterprise, Element Server for messaging, OnlyOffice or Collabora for office editing. On the infrastructure layer: IONOS Sovereign Cloud, plusserver, StackIT, OVHcloud SecNumCloud, Aruba, Open Telekom Cloud – depending on configuration UAL 2 or UAL 3. On the hardware layer, relevant: Fujitsu servers from German production, Nutanix without US backchannel, Proxmox-based in-house solutions.

We maintain a current overview of sovereign alternatives at /en/alternativen. Whoever wants to run the migration numbers concretely finds the cost structure of a managed UAL 3 migration at /en/pricing, and direct contact at /en/contact.

Conclusion

3 June 2026 introduced a new procurement-law scale via the CADA draft. Delos Cloud, marketed as an SAP-Microsoft construct, reaches Level 1 on that scale, partially Level 2, but not Level 3. For public bodies signing long-running contracts today, this is a structural risk factor, not a detail. The four clauses above and the twelve-day path in the HowTo section provide the operational frame with which a municipal IT department or Land authority can align its 2026 tenders to CADA – without waiting for formal CADA adoption in late 2027.