What does digital sovereignty actually decompose into in a contract?

Strip away the rhetoric and "sovereignty" in a supplier relationship separates into five properties. They are independent: you can have any one without the others, and vendors count on you confusing them.

Does the US CLOUD Act reach data hosted in Europe?

Yes, when the provider is subject to US jurisdiction. This is not an opinion, it is the operative text of the statute. The CLOUD Act of 2018 added Section 2713 to Title 18 of the US Code, and it reads:

Are data residency and jurisdiction the same thing?

No, and the whole sovereign-marketing industry lives in the space between the two. Residency is a fact about geography. Jurisdiction is a fact about corporate law. A contract can fix the first with one sentence ("Customer Data shall be stored and processed exclusively in data centres located within the EEA") and…

Who controls the encryption keys, controls what exactly?

Whoever can decrypt your data holds the residual power over it, whatever the contract says. That is why key custody deserves its own clause and its own architecture review, not a line in the security annex.

What does the European and Italian framework actually look like in 2026?

Four instruments matter, and they are at very different stages of maturity. This is the August 2026 state of play, verified against primary or official sources.

Digital sovereignty: what it actually means in a contract

Digital sovereignty is not a philosophy, it is five contract clauses. How to decompose it, test it against the Cloud Act, and negotiate it.

Everyone writes about digital sovereignty as if it were a philosophy seminar. Autonomy, values, strategic independence. Then the supplier contract lands on your desk and none of those words appear in it. What appears instead: a governing law clause, a data processing annex, a subprocessor list, and a termination section you will read for the first time the day you need it. I review these contracts for clients as an independent consultant, and I wrote a book, GEOPOLITECH, about how technology and jurisdiction collide. My conclusion after both exercises is the same: sovereignty is not a value statement. It is a bundle of five separable legal and technical properties, and a contract either grants you each one explicitly or it does not. This article decomposes the bundle, uses the US CLOUD Act as the acid test that separates marketing from substance, maps the European frameworks that actually exist in August…