Virkkunen: a definition of sovereign cloud across the union is needed, that's why we have 4-tiered definition. When it comes to the risk itself, member states do know best though. If this doesn't work, though, then we can take more action.
On costs: it depends on the member states risk assessments, and the services they are currently using. From our experience in the Commisssion, EU cloud providers aren't necessarily more expensive ⬇️