Measure Twice, Buy Once¶

Stéfane Fermigier

Download the PDF

Abstract¶

The Commission now maintains two graded measures of cloud sovereignty: the SEAL scale of its own Cloud Sovereignty Framework, which has already chosen suppliers for one tender, and the four Union assurance levels of the Cloud and AI Development Act, which will decide what every European public body may buy. A crosswalk of all 48 questions in the Commission's own assessment against Annexes II and III finds that neither scale contains the other: a service at Union assurance level 4 can score SEAL-0, and a service at SEAL-4 is not guaranteed to reach level 2. Fourteen questions are reached by an Annex II criterion, eight appear only as audit evidence with no criterion behind them, and seventeen are reached nowhere. Eight amendments follow, the cheapest of which promotes text Annex III already contains.

Five supplier profiles placed on both assurance scales. Nothing lies on a diagonal: the relation between the two scales is not monotone.

About this paper¶

Cite this paper¶

Fermigier, S. (2026). Measure Twice, Buy Once.
Policy paper, Abilian Econ Lab.
https://econ.lab.abilian.com/papers/two-ladders/