The report also questions what those domestic wins actually mean. It claims they often come from prime contractors relying on infrastructure owned by the big hyperscale operators, so sovereignty attaches to the operator's nationality rather than the infrastructure the service runs on.

ECIPE argues CADA conflates two different ideas of sovereignty: one about security and resilience, where users keep choice over providers and cloud design, and one about industrial policy, where Europe-headquartered firms succeed by being shielded from non-European competition. The legislation, it says, pursues both at once, framing the EU's four assurance levels as security criteria while they actually enforce requirements on EU-located infrastructure, third-country control and software supply chains. The think tank warns sovereignty could become a vehicle for favouring selected providers and fragmenting digital markets, and recommends defining sovereignty as a demonstrated outcome rather than an ownership status. "Real sovereignty means a public buyer can show its data is secure and that it can switch provider if it has to. A provider's passport does not tell you that", said ECIPE director and co-author Fredrik Erixon.

There is a counterpoint, though. Earlier this year the trade association CISPE urged the European Commission to legislate for what it called real tech sovereignty rather than the illusion of it, arguing sovereignty should be defined by control, including effective ownership of the underlying technology and protection from extraterritorial laws such as the US CLOUD Act, which can compel American companies to hand over data they hold, including data stored overseas. CISPE had also previously warned that the Commission's sovereignty criteria were drafted so vaguely as to favour the incumbent big American operators.