The Moment After the Win
I have seen founders win pitch competitions. I have watched them take home awards, launch their product, and capture the attention of the market. In every such success story, there comes a moment that crowns it all: an investor looks across the table and says, “We’re interested.”
And then, after everything you have worked for finally settles, you get the follow-up: “Please share your data room. We’ll also send you our due diligence questions.”
I have recently prepared such a questionnaire on behalf of an investor conducting due diligence on a target company. Every such questionnaire has its expected questions about licences and permits, commercial contracts, IP rights, and corporate structure. But alongside those, there is a section that investors now take far more seriously than they did a few years ago: regulatory readiness — AI governance, privacy, cybersecurity, and a concept that is quietly becoming one of the most important questions in European tech: data sovereignty.
Data sovereignty directly affects the type of clients a company can win and retain, and the markets it can stay active in. And this is where founders do not want to stumble, not because they have done something wrong, but because they have not yet done much.
Your data room will need to answer these questions. At the early stage, credibility comes from showing that you have thought about them, even if your documentation is still basic and evolving.
Three Questions Every Investor Will Ask
As you build your product, keep these three questions in mind from the start, because by the time an investor asks about them, you should have the answers.
1. Who is actually in control?
The ownership structure, governance documents, shareholder agreements, and beneficial owners should all make clear who makes decisions, who holds power, and whether anything in the structure could create a problem after the investment closes.
2. What does the company actually own?
Investors want to confirm that the product belongs to the company: intellectual property transferred to the company, technology built on components and AI models whose licence terms are compatible with commercial use and will not change due to a change of control, and signed contracts on arm’s length terms.
3. Can the company operate within complex regulatory requirements?
Investors are not expecting a finished compliance framework. They expect concrete awareness and a credible roadmap: what is required, where you currently stand, and what your path looks like. That starts with knowing what is inside your product well enough to document it, disclose vulnerabilities, and demonstrate readiness when Cyber Resilience Act and AI Act obligations come into force.
While the first two questions are familiar to most founders, the regulatory section is a different story. In my most recent due diligence, it was precisely this part that the founder was not prepared for. The questions were reasonable and standard, but they were unexpected.
The Cyber Resilience Act: Security Built In, Not Bolted On
AI governance, GDPR, and the EU AI Act have received significant attention. The Cyber Resilience Act (CRA) and data sovereignty are less discussed and less understood.
The EU adopted the CRA from one fundamental premise: even hardware and software considered less critical can serve as an attack vector, giving malicious actors an entry point into entire user systems. Cybersecurity therefore has to be built into every product with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
Are You in Scope?
Before building a compliance roadmap for the CRA, you need to answer one question: Are you putting a “product with digital elements” on the EU market, or are you delivering a standalone cloud service?
The CRA targets hardware and software made available as products, including embedded and on-premise software. Standalone SaaS is generally excluded unless it is part of, or necessary for, the product’s core functionality, qualifying it as a remote data processing solution without which the product could not perform one or more of its functions.
The Software Bill of Materials
The CRA introduces a legal requirement for manufacturers to create and maintain a Software Bill of Materials (SBOM) for all products with digital elements, transforming SBOMs from a best practice into a mandatory obligation.
But beyond compliance, the SBOM is what makes it possible to answer the questions that matter most in a security incident or a due diligence process:
- What is running in our product?
- Does any component have a known vulnerability?
- If a critical open-source library is found to be compromised tomorrow, do we know whether we are affected?
For an early-stage company, you do not need a perfect SBOM on day one. But you do need to start somewhere, and starting means knowing what is inside your product, documenting it, and building the habit of keeping that documentation accurate.
The CRA, becoming fully applicable in December 2027, requires security-by-design and security-by-default as a legal obligation for all digital products entering the EU market. Beyond the SBOM, it introduces a broader set of obligations covering secure configuration, access controls, encrypted data storage, minimal attack surface, vulnerability monitoring, and security updates throughout the product’s support period.
Data Sovereignty: The Challenge Where the Rules Are Still Being Written
CRA is the compliance challenge you can map and plan for. Data sovereignty is a different kind of challenge, one where the rules are still being written.
Data sovereignty does not yet appear in most startup diligence questionnaires, but it is shaping how governments, large institutions, and corporations in regulated industries think about ICT procurement.
At its core, data sovereignty refers to the idea that data and the infrastructure that processes and stores it should remain under the legal and operational control of the jurisdiction in which it was created. It raises practical questions: Can a foreign government compel your cloud provider to hand over your customers’ data? Who in practice controls the infrastructure your product runs on?
Why This Is No Longer Theoretical
The EU currently relies on non-EU countries for over 80% of its digital products, services, infrastructure, and intellectual property. The European Parliament has expressed concern over excessive dependencies on non-EU actors in critical areas such as cloud infrastructure, AI, and cybersecurity, noting that market concentration and foreign control threaten to undermine Europe’s competitiveness, democratic resilience, and security. Most data centres in Europe are not owned by European companies. (European Parliament Resolution of 22 January 2026 on European technological sovereignty and digital infrastructure)
In April 2026, the European Commission awarded a €180 million tender for sovereign cloud services to four European providers, enabling EU institutions, bodies, and agencies to procure cloud services meeting strict sovereignty criteria, including rigorous assurance levels ensuring that non-EU third parties have limited control over the technologies and services provided.
The Commission is also preparing a Tech Sovereignty package that includes the Cloud and AI Development Act (CADA), which will harmonise what sovereignty means for cloud and AI computing services across the single market.
What This Means for Your Startup
Why does this matter at the beginning of your journey? Because the procurement criteria of your future big customers, including public sector bodies and corporations in regulated industries, are moving in this direction. These questions are likely to appear in procurement checklists within the next few years:
- Where is our data physically stored?
- Who operates the infrastructure, and under which legal jurisdiction?
- Could a foreign authority access our data without our knowledge?
I cannot give compliance guidance on this topic today because the landscape is still forming, and most of the market remains heavily dependent on non-EU cloud vendors. Today’s best practice may look different in three years. But you should understand that this topic exists at the highest level of EU policy and be able to say who operates your infrastructure and what legal framework governs access to it.
“We have thought about this and here is our current position” is a far better answer to an investor or a big client than “we had not considered it.”
The Takeaway
Data sovereignty is not yet a hard compliance requirement for most startups. But the EU is actively shaping it, and being aware of it early is a competitive advantage.
Keep building your product in a way that it can scale in the EU market, meet the expectations of large corporations, and navigate a regulatory environment that is moving faster than most companies realise.
Barbara Grbešić, Partner at Ružđak & Grbešić Law Firm and startup mentor at BIRD Incubator, with deep experience in banking, IT governance, and corporate legal operations, specialising in legal setup, compliance, and regulatory navigation for founders building in fintech, tech, and data-driven environments.
