Ask ten CIOs whether their Unified Communications platform is sovereign and eight will say yes. Ask them to prove it against the Commission Cloud Sovereignty Framework and most drop two levels on the spot.
UC is a soft target because the sovereignty problem hides in the parts nobody thinks of as data. Presence signals, call metadata, meeting titles, transcripts, chat history, and the AI features layered on top. Each of these touches an SOV objective, and each is usually processed on infrastructure the CIO does not control.
Where common UC stacks sit today
Without naming vendors, the pattern is consistent.
- Most European tenants of the two dominant US collaboration suites sit at SEAL-1. EU law applies through a local contracting entity, the marketing calls the data European, but the encryption keys, the tenant administration and the AI inference sit under a US parent.
- A regional UC stack from a European vendor with EU-only hosting typically sits at SEAL-2. Data stays in the EU, but hardware, firmware and some support functions still trace back to non-EU suppliers.
- A managed sovereign UC design with EU key custody, EU-based service desk and open protocols on the media plane can reach SEAL-3. SEAL-4 exists in theory for UC and is rare in practice, usually seen only in defence and intelligence contexts.
The SOV objectives that dominate UC scoring
SOV-3, data and AI
This is the objective moving fastest. Meeting summarisation, live translation, sentiment analysis and copilot-style assistants all process the content of the meeting, not just the metadata. If that processing runs on a model hosted outside the EU, the workload is disclosing every conversation to a non-EU jurisdiction. Customer-held keys on the recording archive do not help if the transcript has already been sent to a US inference endpoint.
SOV-2, legal and jurisdictional
Call recordings, transcripts and chat archives are the highest-value evidence a regulator or a court will ask for. The framework asks whether a non-EU authority could compel access. For most global UC suites the honest answer today is yes, through the US CLOUD Act or the parent-company relationship.
SOV-4, operational
Who keeps the platform running if the vendor withdraws support, changes commercial terms, or is served an export control order? UC is a real-time service. If the tenant administration console and the escalation path to Tier 3 both sit outside the EU, operational sovereignty is a slide, not a fact.
SOV-6, technology
Open standards matter more than they used to. A UC platform built on SIP, WebRTC and documented APIs can be replaced or federated. A platform built on a proprietary media stack and a proprietary directory cannot. The framework rewards portability.
The fixes worth costing in the next renewal
A UC estate can move from SEAL-1 to SEAL-2, and often to SEAL-3, without a full replacement. The pragmatic moves are:
- Move the recording archive to EU-held storage with customer-managed keys. This alone changes the answer to several SOV-3 questions.
- Turn off any AI feature that sends content outside the EU by default. Reintroduce those features only on an EU inference path, with a written data flow.
- Move Tier 1 and Tier 2 support to an EU-employed team, and negotiate an EU-only escalation path for Tier 3.
- Add contract language that names the SOV objectives and reserves the right to re-score during the term.
- For federation with partners and customers, prefer standards-based connectivity over proprietary interconnects.
Seven UC questions for your next renewal
- Where is every category of content stored: recordings, transcripts, chat, files, presence, and meeting metadata?
- Who holds the encryption keys for each category, and can we hold them ourselves?
- Which AI features process meeting content, and on which infrastructure, in which jurisdiction?
- Which of our subprocessors sit outside the EU, and what data types cross that boundary?
- What is the geography of every support tier, including the emergency escalation path?
- How are firmware updates for handsets, gateways and session border controllers signed and delivered?
- What exit rights and data extraction obligations do we have if we decide the sovereignty position has worsened?
What this means for buyers
UC is where sovereignty leaks fastest and where most of the leak is fixable in the current contract cycle. Do not treat this as a rip and replace conversation. Treat it as a renewal conversation with a scoring model attached.
Post three looks at Contact Centre, where the same objectives apply but the stakes are higher because the content is often regulated personal data.
