European Data Sovereignty Policy and Market Intelligence Brief

Window covered: Monday 5 October 2026 to Monday 12 October 2026. Trailing seven days, run fresh each week. No continuity is tracked against prior editions.

1. Verdict

Routine. One real governance story broke this week (the Digital Omnibus Council mandate talks collapsing again), but it sits adjacent to the sovereignty narrative rather than inside it, and nothing changed in SEAL, CADA's substance, or the extraterritorial access picture. The most consequential-sounding claim this week (CADA cutting sovereignty levels from four to two) could not be verified against a primary source and is flagged below, not reported as fact.

2. Policy movements

What changed: Coreper (the Committee of Permanent Representatives) was due to adopt a Council negotiating mandate on the Digital Omnibus on 7 October but downgraded that to a discussion only. A second attempt, moved to Sunday 11 October under the Irish presidency, was pulled from the ambassadors' agenda on Saturday evening (10 October) with, per MLex, "no new date set or revised text prepared."

Who, and role: Coreper, under Ireland's Council presidency. Germany and France pushed the delay, principally over the Data Act's trade secret provisions: Berlin wants data covered by a trade secret shared only with the data holder's "explicit agreement," and is separately pressing for a GDPR carve-out for "low-risk data controllers" (micro-enterprises, SMEs, non-profits).

Stage and effective date: Pre-trilogue. The Council has not yet agreed its negotiating mandate, so there is no text to take into the Parliament talks and no effective date.

So what: No positioning impact on the SEAL or European-operated argument directly, this is a GDPR and Data Act compliance-burden fight, not a sovereignty-infrastructure fight. It is worth tracking for one reason: a "low-risk data controller" GDPR exemption, if it survives into the final text, would ease the compliance pressure that currently makes sovereign infrastructure an easy sell to the smallest SaaS buyers. It does nothing to the enterprise and regulated-tender buyers nLighten actually targets, who face GDPR, NIS2 and sectoral obligations regardless.

Content angle: None yet. Worth a short piece once a Council mandate text exists, scoped to "what GDPR simplification does, and doesn't, change for sovereignty-driven buyers," so it doesn't look reactive to a story that hasn't landed.

What changed: Parliament's joint-committee report timetable firmed up. ITRE and IMCO remain jointly responsible; MLex reports a joint draft report is expected on 1 December 2026, with a committee vote pencilled in for mid-March. This is a timeline confirmation, not new substance.

Who, and role: ITRE (Industry, Research and Energy) and IMCO (Internal Market and Consumer Protection) committees of the European Parliament. Parliamentary tracking sources are not fully consistent on the rapporteurs: an August entry names Reinier Van Lanschot (Greens/EFA) as IMCO rapporteur with Alexandra Geese (Greens/EFA, ITRE) as shadow; an October entry instead names Van Lanschot alongside Diego Solier (ECR, Spain) as the two committee rapporteurs. I could not confirm the current assignment against the European Parliament's own procedure file, so treat the names as provisional.

Stage and effective date: Proposal (2026/0138(COD)), still in committee consideration. No report has been tabled yet; nothing is adopted or in force.

So what: This is the file that will eventually revise the SEAL-style sovereignty assurance levels embedded in EU procurement, which makes it the single most important bill for nLighten's positioning, but nothing in it moved this week beyond a date. EDRi's 8 October piece argues CADA's "Data Centre Acceleration Zones" concept and sovereignty-tiering design are incoherent, a sign the Parliament-side fight over how strict the assurance levels should be is heating up ahead of December. See the Unverified section for a specific, unconfirmed claim about what the rapporteur's emerging position contains.

Content angle: Hold fire until 1 December. Prepare, but do not publish, a piece mapping what "European-operated vs European-owned" means if CADA's assurance levels are rewritten, so it can go out same-day once the draft report is public.

3. Market moves

None confirmed within the window. Checks across OVHcloud, IONOS, Scaleway, Exoscale, StackIT, Impossible Cloud, Gaia-X, CISPE and EuroStack turned up nothing dated in the trailing seven days; the apparent hits were older stories (OVHcloud's Q1 results and Seald acquisition from January, BSI's C5:2026 catalogue from April, the Commission's four-provider sovereign cloud tender award from April) resurfacing in search indexes. Nothing to report rather than padding with stale items.

4. Worth reading

No third item qualified. Nothing else cleared the bar of "concrete and dated," so the list stays at two rather than being padded to three.

5. Watchlist

6. Unverified