Evaluating Sovereignty Claims of US Hyperscalers in Europe: A Comprehensive Audit of Legal, Technical, and Governance Controls for Digital Autonomy

European public authorities and regulated sectors increasingly rely on cloud services offered by US-based hyperscalers operating within the European Union. These services are often presented as “sovereign” through claims related to data residency, regional service isolation, and compliance with European regulatory frameworks. This study examines whether such sovereignty claims hold under legal scrutiny when assessed against enforceable jurisdictional control rather than formal compliance statements. The research analyses the interaction between European legal obligations and extraterritorial US legislation, including the CLOUD Act and FISA 702. Using a qualitative audit-based approach, the paper evaluates legal enforceability, technical control mechanisms, and corporate governance structures underpinning sovereign cloud offerings. Specific attention is given to administrative access models, encryption and key custody arrangements, incident response authority, subcontractor involvement, and audit transparency. The findings show a recurring gap between declared sovereignty features and operational reality. Physical data localisation alone does not establish effective jurisdictional isolation when centralised management planes, remote administrative access, or parent-level governance structures remain subject to foreign legal compulsion. Certification schemes and contractual assurances provide limited protection where independent verification and technical enforcement are absent. The paper concludes with recommendations aimed at European policymakers, regulators, and public-sector procurers. These include enforceable requirements for exclusive EU-based administrative control, verifiable isolation of management layers, customer-held encryption keys, and audit regimes aligned with legal jurisdiction rather than geographic storage location. The study contributes to legal and policy debates on digital sovereignty by offering a structured framework for assessing sovereign cloud claims beyond marketing narratives and formal compliance assertions.