Sovereign-Audit is a structured audit that assesses your dependency on cloud providers (Microsoft 365 in particular) and your real ability to retrieve your data and switch provider. We do not certify "sovereignty": we measure, document and prioritise.
Digital dependency is rarely measured, and the subject is becoming regulatory
Regulation (EU) 2023/2854 (Data Act) contains a chapter dedicated to switching between data processing services, with obligations to remove the technical and contractual obstacles to switching provider. Few organisations today know where they stand on this point.
Break-glass accounts, identity federation, Copilot, native encryption, custom Teams apps: every technical choice creates a little more dependency, without any explicit decision having been taken.
Cloud contracts contain data recovery and exit clauses, but they are signed once and never reviewed in the light of how the tenant is actually used.
The Data Act, SecNumCloud and Gaia-X define a vocabulary and portability requirements, but turning that into an operational finding on YOUR tenant takes a method and time that in-house IT teams do not have.
A structured method, backed by a catalogue of 32 dependency and portability controls
Discussion with management or the IT manager to define the scope (Microsoft 365 tenant, entities, subsidiaries, key providers) and the dependency issues specific to your organisation.
Review of the Microsoft 365 configuration (identity, backup, data residency, encryption, applications) and of the contractual reversibility clauses with your providers.
Each control is assessed with a clear status (covered, partial, absent, to be verified contractually), with a mapping to the Microsoft 365 domains concerned.
The findings are linked, where relevant, to the requirements of the EU Data Act and to the SecNumCloud/Gaia-X reference vocabulary - without ever presenting this as a certification obtained.
Delivery of a clear report to management, with a prioritised action plan to reduce the most critical points of dependency.
A clear set of documents that your management and IT teams can put to use
Documented assessment of the 32 controls of the catalogue, with a status for each control.
An overview of where your dependency on Microsoft is concentrated.
A tool for re-reading your existing cloud contracts with your legal teams.
Correspondence between your findings and the vocabulary of the reference frameworks.
Recommendations ranked by criticality and ease of implementation.
Documents in formats your teams can work with.
Sovereign-Audit draws on existing public frameworks - we issue no certification
European legislation containing a chapter dedicated to switching between data processing services (cloud portability and interoperability). Sovereign-Audit draws on this chapter to structure the audit questions, without presenting a specific article as an obligation already enforceable against your organisation without legal verification.
The organisational controls relating to supplier relationships and to business continuity structure part of the dependency analysis.
Voluntary qualification framework of the ANSSI. Its contractual reversibility clause serves here as a reading grid, even though standard Microsoft 365 is not SecNumCloud-qualified.
Voluntary, non-binding European framework that provides a common vocabulary of sovereignty and interoperability between cloud players, used here as a reading grid.
Each engagement is scoped on a quote basis, according to the size and complexity of your environment
SME, single Microsoft 365 tenant
SME/mid-cap, several entities or subsidiaries
Organisations with a remediation plan
No price is set in advance on this page
The exact scope (number of entities, tenant size, depth of contractual analysis) is defined with you before any quote.
Not only large groups or "sensitive" sectors: dependency on a cloud provider affects very different companies, for different reasons. Here are the official criteria, without confusing legal obligation and good practice.
The US CLOUD Act (federal law, Public Law 115-141) applies to US "providers of electronic communication services or remote computing services" and allows them to be compelled to hand over data in their "possession, custody, or control" to US justice, even if that data is stored outside the United States (provision codified at 18 U.S.C. § 2713). In practical terms: a French SME that hosts its email or its ERP with a US provider, or a European subsidiary of a US group, may be concerned solely because of that link of control, even if its data is hosted in France or in the EU. Official text (Congress.gov)
The Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025, is a cross-sector text that "applies to all sectors". Its chapter on switching between cloud providers gives every customer, whatever its size, the right to "effectively switch between providers of data processing services" (portability, interoperability), with no general exemption for small businesses. European Commission - Data Act
The NIS2 Directive covers 18 sectors (energy, transport, health, finance, water management, digital infrastructure, electronic communications, digital platforms, waste management, manufacturing of critical products, postal services, space, public administration). For these sectors, "as a general rule, medium-sized and large entities will have to take appropriate cybersecurity risk-management measures" - which includes managing the risk linked to their suppliers, including their cloud providers. European Commission - NIS2
The ANSSI SecNumCloud qualification "recognises trusted cloud offerings" through a security visa. It is not a generalised legal obligation for private companies: it is a voluntary qualification, recommended for protecting sensitive data or hosting sensitive information systems in the cloud. ANSSI - cyber.gouv.fr
In summary, four typically concerned profiles
1. An SME that hosts email, ERP or CRM with a US hyperscaler (or a European
subsidiary of a US group): concerned by the CLOUD Act, regardless of its size.
2. Any European company, of any size, that uses a cloud service
(SaaS, PaaS or IaaS): concerned since 12/09/2025 by the new portability rights of the
Data Act.
3. A medium-sized or large company in one of the 18 NIS2 critical sectors (energy, health,
transport, finance, digital infrastructure...): must manage supplier risk, cloud
included.
4. A public body or a company that hosts sensitive data: recommended target
(not systematically mandatory) of the SecNumCloud qualification.
These criteria come from the official texts and pages cited above. This is not legal advice: your exact situation depends on your sector, your size and your contracts - to be confirmed by a lawyer if needed.
What is a genuine legal obligation, what is a recommended good practice, and what is coming soon - explained simply, backed by official sources.
If your company has personal data (employees, customers) hosted with a cloud provider located outside the European Union, it is your company - not the provider - that remains legally responsible under the GDPR for the protection of that data. You must make sure that this transfer rests on a recognised safeguard: either the country is deemed safe by the European Union ("adequacy decision"), or you sign with the provider the standard contractual clauses provided by the European Commission. These are standard documents to be incorporated into your contract, not a negotiation you have to invent yourself.
Source: CNIL, framework for data transfers outside the EU under the GDPR (Chapter V, Articles 45 and 46) - cnil.fr, accessed on 18/07/2026.
Since 12 September 2025, a European regulation (the "Data Act") requires providers of cloud services to facilitate switching: they must gradually reduce exit charges and provide your data in a format that you can reuse elsewhere. In practical terms, if a provider tells you "this is not possible" or charges you disproportionate sums to retrieve your own data, this has no longer been normal since that date. The precise timetable for the full removal of these charges is set by the regulatory text - to be checked by your lawyer or your provider if an amount is billed to you.
Source: European Commission, "Data Act" (Regulation (EU) 2023/2854, Chapter VI) - digital-strategy.ec.europa.eu, accessed on 18/07/2026.
SecNumCloud is a qualification issued by the ANSSI (the French cybersecurity agency) that makes it possible to recognise the cloud offerings considered trustworthy for hosting sensitive data. It is not a legal obligation for a private company. It is mainly binding on administrations and on bodies that manage information systems that are sensitive for the State. For an SME, it is a useful benchmark for comparing cloud offerings with one another, not a standard to be complied with by law.
Source: ANSSI (cyber.gouv.fr), "Cloud" page - cyber.gouv.fr, accessed on 18/07/2026.
The CNIL recommends - without this being a quantified and detailed obligation in law - that you list the cloud services actually used in your company, check the provider's security level before signing, write down in black and white in the contract who does what for security, and encrypt sensitive data. The principle to remember: the provider secures its infrastructure, but it is up to you to configure the access and accounts of your teams properly. A misconfiguration on your side is not covered by the provider's security.
Source: CNIL, "Cloud security (cloud computing)" - cnil.fr, accessed on 18/07/2026.
The European Commission has put forward for discussion a draft regulation, the "Cloud and AI Development Act", to strengthen European cloud and artificial intelligence capacities and reduce dependency on large non-European providers. This text is not yet in force: it is a proposal under examination, not a rule to apply today. It provides for a system of trust levels to assess the sovereignty of a cloud offering. To be followed, without drawing any immediate operational conclusion.
Source: European Commission, "Cloud and AI Development Act" - digital-strategy.ec.europa.eu, page updated on 03/06/2026, accessed on 18/07/2026.
This section gives you clear benchmarks, not legal advice. For a specific situation (ongoing contract, specific data transfer), have it validated by your legal department or a lawyer.
Five questions asked by SME managers, each answered in 2 minutes with its official source
These answers summarise official pages consulted in July 2026 (European Commission, CNIL, ANSSI, Gaia-X). They do not constitute legal advice and do not replace an analysis dedicated to your situation.
Contact us to receive a quote tailored to your scope.
Free analysis of your domain: syaga.eu/scan. The free tool “Is my Microsoft 365 under attack?” is coming.
contact@syaga.eu See the FAQ