It has been a few months since I last wrote about sovereignty. In that time, the conversations I have had with organizations across Europe have become more specific and more urgent. A year ago, many were still asking what sovereignty meant for them. Today, they are asking what level of control they actually need, how to demonstrate it, and how to achieve it without compromising their security. Behind those questions sits something larger: a decision about what kind of digital society Europe wants to be. Europe is working to bring clarity to that question, and in doing so, it is leading the global debate on digital sovereignty.
What Is At Stake
When Europe sets a standard, the rest of the world tends to follow. It happened with data protection through GDPR, and I believe it is happening again with sovereignty. Europe's standards carry weight because they rest on fundamental rights and on a long-term view of how technology should serve society.
At its core, sovereignty is about people. It is about whether citizens can trust that the services they depend on, from hospitals to energy grids, are resilient, secure and properly governed. That trust comes down to control: over data, over who can access it, and over how, where, and under which laws jurisdictions those services are operated. Not every service needs the same degree of each. There is no black-and-white answer: the higher the stakes for society, the higher the bar should be.
From Framework to Legislation
In October 2025, the European Commission published its Cloud Sovereignty Framework to guide how EU institutions procure sovereign cloud services, alongside a €180 million tender. It was not designed as a directive for the broader market. Its eight objectives and tiered scoring system offered, for the first time, a concrete way to assess sovereignty. The framework quickly became a reference point well beyond the institutions it was written for. The debate began to move from broad principles to practical assessment.
In June 2026, the Commission went further. The proposed Cloud and AI Development Act, known as CADA, is a central part of the European Tech Sovereignty Package. Where the framework gave buyers a way to score providers, CADA does something more tangible. It introduces four Union Assurance Levels, each building on the one before, so that the protection a service provides matches the risk involved. Under the proposal, every cloud service bought by the public sector would need to meet at least the first level, with only narrow exceptions. Public bodies would then assess each activity to see whether more is needed, and anything connected to public order, from justice to critical infrastructure, would require one of the higher levels.
We welcome the effort behind CADA. A common set of levels can help public bodies make more consistent decisions about sovereignty, and a risk-based approach recognizes that different services need different degrees of control. It follows the same logic Europe applied in the EU AI Act, which sets obligations according to the risk of how AI is used rather than treating every application the same.
Getting the Balance Right
As CADA is debated in the European Parliament and the Council, the most important thing to get right will be the balance between sovereignty and security. Security depends on seeing the whole picture. Attacks are spotted by connecting signals across many organizations and regions, and the more the picture is fragmented, the harder it becomes to see what is coming.
Taken to the extreme, sovereignty can work against the very protection it is meant to provide. A service that operates in isolation is unlikely to offer the strongest defense, because the threats are global and so is the knowledge needed to stop them. That is not an argument for less control. It is an argument for designing sovereignty so that organizations keep control of their data and stay connected to the intelligence that protects them. When a breach happens, the people affected will not ask where a service was built. They will ask why it failed to protect them.
CADA should also preserve meaningful choices for European organizations. Being sovereign is also about optionality: knowing that options exist and having the freedom to decide what works best for each organization.
Four Principles to Guide What Comes Next
Whatever form CADA finally takes, we believe any approach to sovereignty should rest on four principles, increasingly shared across our industry. They matter for CADA, and for every sovereignty policy that comes after it.
The first is capability. Defining sovereignty is only part of the task. Europe also needs the means to make it work: access to advanced technology and continued innovation, along with the infrastructure and skills to put them to use. CADA rightly treats building that capacity as part of its agenda. That focus should stay, so that public bodies have a real range of options.
The second is collaboration. No single company or government can build sovereignty alone. Regulators, standards bodies, technology providers, and the organizations that rely on their services all have a role to play. Their input matters most for the parts of CADA still to be decided, including the method public bodies will use to assess risk and choose the right level. That method will guide public procurement for years to come, and it should reflect both what the public sector needs and the technical realities of delivering secure services.
The third is resilience. Critical services have to withstand and recover from cyber incidents, infrastructure failures, and geopolitical instability, even as AI changes the threats they face. That calls for avoiding single points of failure and keeping the flexibility to adapt. Sovereignty should strengthen that resilience, not become a separate objective measured apart from a service's ability to keep running.
The fourth is trust. As I wrote in my last blog on digital sovereignty, trust has to be earned, and it cannot rest on contractual promises alone. It starts with working with providers whose values align with your own, and it depends on being able to verify their claims. CADA's higher assurance levels follow the same logic, relying on independent certification rather than self-declaration. In practice, it should be possible to see who can access data, under what conditions, and who controls the encryption keys. Providers must also be clear about the limits of what they offer. Assurance only counts when organizations understand what is guaranteed and can check that it holds.
We intend to contribute directly as CADA moves through the legislative process, and these are the principles we will bring to that discussion. They are also the principles we hold ourselves to in what we build.
Putting It Into Practice
In June 2026, together with Deutsche Telekom, we announced Sovereign Cortex, our first sovereign security operations solution, built on four commitments to our customers. We are now extending those commitments to secure access and network security for hybrid workforces with Sovereign Prisma SASE, from keeping customer data in Europe to placing encryption keys in our customers' hands. Threat intelligence flows into these services so they stay effective, but customer data and systems data do not flow back out. The details matter, and you can read the full announcement here. But the broader point is that sovereignty has to be visible in how a service actually runs.
No single product can deliver sovereignty on its own. It depends on the technology, expertise, and operational arrangements behind every service an organization uses. That is why we keep investing in teams based in Europe and working with trusted European partners. There is more to come.
Where We Stand
The organizations I speak with want to know what level of control they need and how to achieve it without compromising their security. The answer lies in understanding their options, controls they can verify, assurance that reflects the risks they face, and services that remain secure and resilient. Sovereignty and security belong together, and CADA is an opportunity to make that real.
Our commitment to Europe goes beyond what regulation requires. Europe has the values, the talent, and the ambition to build a digital future that is secure by design and built to last. The task now is to turn that ambition into systems people can depend on every day, and to do it together. We are proud to be part of that work alongside the institutions, partners, and policymakers shaping it, and we intend to keep earning their trust along the way.
Forward-Looking Statements
This blog contains forward-looking statements that involve risks, uncertainties and assumptions, including, without limitation, statements regarding the benefits, impact, or performance or potential benefits, impact or performance of our products and technologies or future products and technologies. These forward-looking statements are not guarantees of future performance, and there are a significant number of factors that could cause actual results to differ materially from statements made in this blog, including, without limitation: developments and changes in general market, political, economic, and business conditions; risks associated with managing our growth; risks associated with new products and subscription and support offerings; shifts in priorities or delays in the development or release of new offerings, or the failure to timely develop, release and achieve market acceptance of new products and subscriptions as well as existing products and subscription and support offerings; failure of our business strategies; rapidly evolving technological developments in the market for security products and subscription and support offerings; our customers’ purchasing decisions and the length of sales cycles; our competition; our ability to attract and retain new customers; and our ability to acquire and integrate other companies, products, or technologies. We identify certain important risks and uncertainties that could affect our results and performance in our most recent Annual Report on Form 10-K, our most recent Quarterly Report on Form 10-Q, and our other filings with the U.S. Securities and Exchange Commission from time-to-time, each of which are available on our website at investors.paloaltonetworks.com and on the SEC's website at www.sec.gov. All forward-looking statements in this blog are based on information available to us as of the date hereof, and we do not assume any obligation to update the forward-looking statements provided to reflect events that occur or circumstances that exist after the date on which they were made.