[{"data":1,"prerenderedAt":414},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/delos-cloud-cada-sovereignty-gap-2026-posts_en":51,"/en/blog/delos-cloud-cada-sovereignty-gap-2026-surround-posts_en":403},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":332,"description":333,"extension":334,"faq":335,"howto":354,"image":395,"meta":397,"navigation":398,"path":399,"seo":400,"stem":401,"__hash__":402},"posts_en/en/3.blog/20.delos-cloud-cada-sovereignty-gap-2026.md","Delos Cloud under the CADA framework – Why the SAP-Microsoft \"administration cloud\" structurally fails to reach sovereignty Level 3",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"CADA & Delos Cloud",{"type":63,"value":64,"toc":321},"minimark",[65,69,98,109,114,121,153,160,164,181,184,188,195,206,209,213,220,227,246,250,253,279,282,286,299,314,318],[66,67,53],"h1",{"id":68},"delos-cloud-under-the-cada-framework-why-the-sap-microsoft-administration-cloud-structurally-fails-to-reach-sovereignty-level-3",[70,71,72,73,77,78,81,82,85,86,89,90,93,94,97],"p",{},"On ",[74,75,76],"strong",{},"3 June 2026"," the European Commission tabled the draft ",[74,79,80],{},"Cloud and AI Development Act (CADA)"," as ",[74,83,84],{},"COM(2026) 502",". Its centerpiece is ",[74,87,88],{},"Article 16"," and the ",[74,91,92],{},"Union Assurance Framework"," with four sovereignty levels. The scale applies first to cloud procurement by EU institutions and member states in sensitive areas, but the effect reaches deep into German municipal and Land administration: the ",[74,95,96],{},"Vergabebeschleunigungsgesetz"," passed in April 2026 has already anchored sovereignty assessments in German procurement law in anticipation.",[70,99,100,101,104,105,108],{},"For ",[74,102,103],{},"Delos Cloud GmbH"," – founded in 2023, marketed as a \"sovereign administration cloud\" on Microsoft Azure, and having signed the final contracts with Microsoft and Arvato Systems in June 2026 – the CADA framework marks the moment when its own marketing position gets measured against a new legal scale. The result is unambiguous: ",[74,106,107],{},"Delos structurally reaches Level 1, partially Level 2, but not Level 3",". Why that is and what public bodies, districts, and municipalities need to take away from this for their cloud procurement from autumn 2026 onwards, we unpack in the following sections.",[110,111,113],"h2",{"id":112},"the-cada-sovereignty-framework-four-levels-in-brief","The CADA sovereignty framework – four levels in brief",[70,115,116,117,120],{},"Article 16 CADA defines four ",[74,118,119],{},"Union Assurance Levels (UAL 1 to 4)",". They are not certifications, but target catalogs against which awarding authorities align their tenders.",[122,123,124,131,137,147],"ul",{},[125,126,127,130],"li",{},[74,128,129],{},"UAL 1 – data locality."," Processing and storage happen inside EU infrastructure. The provider may be a US company as long as the data centers sit in the EU.",[125,132,133,136],{},[74,134,135],{},"UAL 2 – transparency and documented independence."," In addition to UAL 1, the software supply chain must be disclosed, sub-processors are named, and technical dependencies on third countries are documented.",[125,138,139,142,143,146],{},[74,140,141],{},"UAL 3 – EU ownership and control."," Additionally, the operating entity must be EU-owned, key personnel must hold EU citizenship, and extraterritorial access rights of foreign states are excluded. This tier demands freedom from the ",[74,144,145],{},"CLOUD Act",", FISA 702, and Executive Order 12333.",[125,148,149,152],{},[74,150,151],{},"UAL 4 – full foreign-technology freedom."," Reserved for state secrets, defense, intelligence. The Commission estimates need at one per cent of all public procedures.",[70,154,155,156,159],{},"UAL 3 is the interesting tier. It is designed structurally for every administrative procedure that processes special categories under ",[74,157,158],{},"Article 9 GDPR"," – health data in social offices, biometric data in identity documents, data on ethnic origin in youth welfare, political opinions in electoral and citizen participation procedures.",[110,161,163],{"id":162},"what-delos-cloud-technically-is","What Delos Cloud technically is",[70,165,166,168,169,172,173,176,177,180],{},[74,167,103],{}," was founded in 2023 as a fully owned SAP subsidiary, funded with around two billion euros. The platform is a ",[74,170,171],{},"physical instance of Microsoft Azure"," operated in data centers in Berlin and Frankfurt. Operations sit with ",[74,174,175],{},"Arvato Systems"," (a Bertelsmann subsidiary). Software licenses and security updates come from ",[74,178,179],{},"Microsoft",". Azure Foundational Services, Azure Mainstream Services, and Microsoft 365 run on the platform. Target customer base: German federal, state, and municipal administration.",[70,182,183],{},"Legally, Delos is a German GmbH with German personnel and German headquarters. Technically and operationally, however, the platform is not sustainably operable without Microsoft – for updates, patches, feature development, core know-how. This is exactly where Level 3 of the CADA definition fails.",[110,185,187],{"id":186},"why-delos-structurally-fails-to-reach-level-3","Why Delos structurally fails to reach Level 3",[70,189,190,191,194],{},"UAL 3 demands not just EU ownership but ",[74,192,193],{},"controllability of the software supply chain",". A provider that structurally sources its codebase, security updates, and operational know-how from a US company cannot guarantee freedom from extraterritorial access – not for legal reasons (the German Delos instance may be shielded from CLOUD Act requests) but for operational ones. Whoever controls the update chain controls the platform.",[70,196,197,198,201,202,205],{},"Delos co-CEO ",[74,199,200],{},"Georges Welz"," himself put this on the record in a 2024 Heise interview: in a hypothetical US trade conflict the platform could run independently \"for a few months\". The ",[74,203,204],{},"Open Source Business Alliance (OSBA)"," cited exactly this dependency in an open letter to the German Ministry of the Interior as an argument against a Delos-first approach. The Baden-Württemberg state ministry acknowledged in a 2024 response to the Landtag that the Delos platform could \"not fully ensure digital sovereignty\".",[70,207,208],{},"Those statements were still political debate in 2024. With CADA they become an exclusion criterion for tenders from UAL 3 upwards starting in 2027. Whoever buys the platform today with long-running contractual commitments risks a forced migration within two years of CADA entering into force.",[110,210,212],{"id":211},"sovereignty-with-an-expiration-date-why-this-becomes-legally-relevant","\"Sovereignty with an expiration date\" – why this becomes legally relevant",[70,214,215,216,219],{},"Until June 2026, the phrase \"sovereignty with an expiration date\" was a journalistic label. With the CADA draft it becomes a procurement-law test. A target sovereignty level of UAL 3 that only holds as long as the US supplier stays cooperative is not UAL 3. Signing such contracts produces ",[74,217,218],{},"structural procurement-law risk"," – complaints from losing bidders, annulment applications, in the worst case rescission.",[70,221,222,223,226],{},"This already applies in anticipation: ",[74,224,225],{},"§ 121 GWB"," as amended by the Vergabebeschleunigungsgesetz demands that sovereignty aspects be considered in security-relevant procurement. Whoever signs a ten-year Delos contract in 2026 for a procedure with UAL 3 requirements must prove that sovereignty. The proof is hard to produce.",[70,228,229,230,235,236,240,241,245],{},"Context: the ",[231,232,234],"a",{"href":233},"/en/blog/cloud-act-2026","CLOUD Act access situation"," has not eased in 2026, the ",[231,237,239],{"href":238},"/en/blog/bundestag-operation-sovereignty-microsoft-exit-2026","Bundestag Operation Sovereignty decision"," has sent the political signal for federal bodies, and the ",[231,242,244],{"href":243},"/en/blog/cada-eu-tech-sovereignty-package-public-sector-2026","CADA structure presented in June 2026"," has delivered the procurement-law scale. Together, the three form consistent pressure to act.",[110,247,249],{"id":248},"what-public-bodies-and-municipal-it-must-now-lock-into-contracts","What public bodies and municipal IT must now lock into contracts",[70,251,252],{},"Four clauses belong in every cloud tender from July 2026 onwards whose target level is UAL 3.",[122,254,255,261,267,273],{},[125,256,257,260],{},[74,258,259],{},"Proof of ownership and control"," of the operating entity. The bidder submits an audited overview of shareholder structure and voting rights. Proof obligation throughout contract duration.",[125,262,263,266],{},[74,264,265],{},"Exclusion of extraterritorial access."," The bidder contractually declares that no disclosure obligation under CLOUD Act, FISA 702, Executive Order 12333, or comparable legislation applies. Breaches trigger extraordinary termination and damages.",[125,268,269,272],{},[74,270,271],{},"Full sub-processor disclosure"," with jurisdiction naming. Changes are subject to notification before taking effect, with the right of the client to reject.",[125,274,275,278],{},[74,276,277],{},"Exit clause"," with data extraction in open format within 30 days after contract end, at no additional cost. Formats: OpenDocument for documents, JSON/CSV for structured data, iCal for calendars, vCard for contacts.",[70,280,281],{},"Whoever adopts these clauses into their own procurement practice automatically re-evaluates Delos. For simple collaboration and citizen communication, Delos may continue to fit. For social welfare offices, youth welfare, election administration, civil registry, and every procedure with special data categories under Article 9 GDPR, a different route must be chosen.",[110,283,285],{"id":284},"sovereign-alternatives-what-actually-reaches-ual-3-today","Sovereign alternatives: what actually reaches UAL 3 today",[70,287,288,289,293,294,298],{},"On the application layer: ",[231,290,292],{"href":291},"/en/blog/euro-office-microsoft-365-alternative-2026","openDesk"," from the Zentrum für Digitale Souveränität, ",[231,295,297],{"href":296},"/en/blog/nextcloud-vs-onedrive-sharepoint","Nextcloud Enterprise",", Element Server for messaging, OnlyOffice or Collabora for office editing. On the infrastructure layer: IONOS Sovereign Cloud, plusserver, StackIT, OVHcloud SecNumCloud, Aruba, Open Telekom Cloud – depending on configuration UAL 2 or UAL 3. On the hardware layer, relevant: Fujitsu servers from German production, Nutanix without US backchannel, Proxmox-based in-house solutions.",[70,300,301,302,305,306,309,310,313],{},"We maintain a current overview of sovereign alternatives at ",[231,303,304],{"href":304},"/en/alternativen",". Whoever wants to run the migration numbers concretely finds the cost structure of a managed UAL 3 migration at ",[231,307,308],{"href":308},"/en/pricing",", and direct contact at ",[231,311,312],{"href":312},"/en/contact",".",[110,315,317],{"id":316},"conclusion","Conclusion",[70,319,320],{},"3 June 2026 introduced a new procurement-law scale via the CADA draft. Delos Cloud, marketed as an SAP-Microsoft construct, reaches Level 1 on that scale, partially Level 2, but not Level 3. For public bodies signing long-running contracts today, this is a structural risk factor, not a detail. The four clauses above and the twelve-day path in the HowTo section provide the operational frame with which a municipal IT department or Land authority can align its 2026 tenders to CADA – without waiting for formal CADA adoption in late 2027.",{"title":322,"searchDepth":323,"depth":323,"links":324},"",2,[325,326,327,328,329,330,331],{"id":112,"depth":323,"text":113},{"id":162,"depth":323,"text":163},{"id":186,"depth":323,"text":187},{"id":211,"depth":323,"text":212},{"id":248,"depth":323,"text":249},{"id":284,"depth":323,"text":285},{"id":316,"depth":323,"text":317},"2026-07-14T00:00:00.000Z","The new CADA Cloud Sovereignty Framework defines four tiers. Why Delos Cloud stalls at Level 1 and what German public bodies must lock into contracts.","md",[336,339,342,345,348],{"q":337,"a":338},"What is the CADA Sovereignty Framework and since when does it apply?","The Cloud and AI Development Act (CADA, COM(2026) 502) was tabled by the European Commission on 3 June 2026 as part of the EU Tech Sovereignty Package. It is not yet in force – trilogue negotiations between Parliament and Council are ongoing, with adoption targeted for late 2027. Article 16 CADA already defines four Union Assurance Levels (Level 1 to 4) for cloud procurement by member states and EU institutions. German awarding authorities have been aligning to this scale since July 2026 in anticipation, because the Vergabebeschleunigungsgesetz (procurement acceleration law) passed in April 2026 already anchors sovereignty assessments in public procurement.",{"q":340,"a":341},"What four sovereignty levels does CADA define?","Level 1 requires data processing and storage in EU infrastructure. Level 2 additionally demands documented independence from third countries and transparency across the software supply chain. Level 3 further requires EU ownership and control of the operating entity, EU citizenship of key personnel, and exclusion of extraterritorial access rights. Level 4 excludes any foreign technology altogether – the Commission estimates that only one per cent of public services need this tier (state secrets, defense). Level 3, by contrast, becomes the default requirement for administrative procedures handling sensitive personal data.",{"q":343,"a":344},"What is Delos Cloud technically?","Delos Cloud GmbH is a joint venture set up by SAP in 2023 and funded with around two billion euros. It runs a physical instance of Microsoft Azure in data centers in Berlin and Frankfurt, operated by Arvato Systems and licensed from Microsoft. The offering covers Azure Foundational and Mainstream Services plus Microsoft 365. Marketing positioning – \"sovereign cloud for the German administration\". Legally, the operator is a German company with German personnel, but the license, update and security chains still run through Microsoft contracts.",{"q":346,"a":347},"Does Delos Cloud meet the CADA Level 3 requirements?","No. Level 3 requires, alongside EU ownership, freedom from extraterritorial access rights and controllability of the software supply chain. Delos is structurally dependent on Microsoft software licenses, Microsoft security updates, and Microsoft operational know-how. Delos co-CEO Georges Welz publicly acknowledged in a Heise interview that in a hypothetical US trade conflict the platform could only run independently \"for a few months\". This \"sovereignty with an expiration date\" is no longer sufficient under CADA Level 3 criteria. Level 1 and – with caveats – Level 2 are realistic. Level 3 requires a provider that controls the full software supply chain itself.",{"q":349,"a":350},"What does this concretely mean for a German municipality or mid-sized city in procurement?",{"Municipal IT leadership should from now on explicitly declare the target level in every cloud tender":351},{" For general citizen services and civil-registry processes handling personal data, Level 2 is the default; for social welfare offices, youth welfare, public order agencies, and election administration, Level 3 must be set":352},{" The clause template must demand":353},"proof of EU ownership of the operator, exclusion of CLOUD Act, FISA 702 and Executive Order 12333 access, disclosure of all sub-processors and their jurisdiction, and an exit clause providing data extraction in open formats within 30 days. Delos qualifies for the first category, not the second.",{"name":355,"description":356,"totalTime":357,"steps":358},"From zero to a CADA-Level-3-ready cloud tender in twelve days","A pragmatic path for a municipal IT department or Land authority to align a 2026 cloud tender cleanly with the Union Assurance Levels.","P12D",[359,362,365,368,371,376,379,384,387,390],{"name":360,"text":361},"Classify use cases by data sensitivity","On days 1 and 2 tabulate every planned cloud workload with procedure name, subject area, data category under Article 9 GDPR, and legal basis. Civil register, social benefits, youth welfare, tax records are candidates for Level 3. Council minutes, building files, accounting are usually Level 2. Public forms and information portals are Level 1.",{"name":363,"text":364},"Set the target sovereignty level per procedure","On day 3 record the target Union Assurance Level per procedure. Classification is countersigned by the data protection officer and the department head. The table becomes the basis for all subsequent tender documents and direct awards.",{"name":366,"text":367},"Run the provider matrix against the levels","On day 4 test candidate providers against the target levels. Delos Cloud, Microsoft Cloud for Sovereignty, and AWS European Sovereign Cloud realistically reach Level 1, partially Level 2. IONOS Sovereign Cloud, Aruba, OVHcloud SecNumCloud, StackIT, plusserver, and Open Telekom Cloud reach Level 2 and selected offerings Level 3. For Level 3, additionally evaluate openDesk, Nextcloud Enterprise, and Element Server on the application layer.",{"name":369,"text":370},"Draft contract clauses","On days 5 and 6 formulate the four core clauses for Level 3 tenders. First, proof of ownership and control of the operating entity. Second, explicit exclusion of CLOUD Act, FISA 702 and Executive Order 12333 access. Third, full disclosure of all sub-processors and their jurisdiction with change notification. Fourth, an exit clause providing data extraction in open formats within 30 days at no additional cost.",{"name":372,"text":373},"Align tender documents with CADA vocabulary",{"On day 7 revise the standard tender documents to anchor the \"Union added value\" award criterion (Article 4 of the CADA draft) with a weighting between ten and twenty per cent":374},{" Scoring rubric":375},"share of EU value creation, share of EU innovation, share of hardware components designed in the EU.",{"name":377,"text":378},"Audit existing Delos Cloud contracts","On day 8 review every existing Delos Cloud contract for fit to the target level. For procedures that will require Level 3 in future, sketch a migration path to a Level-3-capable alternative within 24 months. Contract duration is tied to this window.",{"name":380,"text":381},"Estimate migration budget and update BSI IT-Grundschutz",{"On day 9 rough-estimate migration costs per procedure":382},{" 2026 benchmark":383},"switching from Microsoft 365 to openDesk costs fifty to one hundred twenty euros per workstation one-off plus twelve to twenty-four euros per month recurring. In parallel, extend the BSI IT-Grundschutz Compendium modules SYS.1.6 (containers) and OPS.2.2 (cloud use) with a CADA reference.",{"name":385,"text":386},"Involve the state data protection authority","On day 10 consult the competent Land data protection authority before final award. For procedures processing special categories under Article 9 GDPR, consultation under Article 36 is mandatory anyway. The CADA level assignment becomes a standalone chapter of the data protection impact assessment.",{"name":388,"text":389},"Publish the tender and manage clarifications","On day 11 publish the revised tender documents. Expect bidder questions on Level 3 evidence, on exit clauses, and on the interpretation of \"Union added value\". Answers are collected centrally and issued to all bidders simultaneously.",{"name":391,"text":392},"Award review with a double sovereignty check",{"On day 12 review the incoming bids":393},{" The award requires two separate proofs":394},"the Union Assurance Level (technical and organizational) and the Union-added-value assessment (economic and strategic). The award decision is documented in a sovereignty file kept for the court of auditors' review.",{"src":396},"https://images.unsplash.com/photo-1544197150-b99a580bb7a8?w=1200&q=80",{},true,"/en/blog/delos-cloud-cada-sovereignty-gap-2026",{"title":53,"description":333},"en/3.blog/20.delos-cloud-cada-sovereignty-gap-2026","1k533dijMgnTI4NSmj4P_KM92GXRukP42LhBNNR-P8M",[404,409],{"title":405,"path":406,"stem":407,"description":408,"children":-1},"Nextcloud for SMEs – The Secure Alternative to OneDrive and SharePoint","/en/blog/nextcloud-for-smes","en/3.blog/2.nextcloud-for-smes","Nextcloud provides everything SMEs need for file management, team collaboration, and communication — on their own servers, GDPR-compliant.",{"title":410,"path":411,"stem":412,"description":413,"children":-1},"Three months after the Hanover freeze – What the 60,000-license fiasco reveals about Microsoft 365 in schools and how school authorities can prepare cleanly for the 2026/27 school year","/en/blog/hanover-license-fiasco-microsoft-365-schools-2026","en/3.blog/21.hanover-license-fiasco-microsoft-365-schools-2026","On 21 April 2026 Hanover froze 60,000 M365 licenses. Three months later, the case shows what school authorities must change before the 2026/27 school year.",1784618209448]