![\"Abstract](\"https:\/\/www.europesays.com\/uk\/wp-content\/uploads\/2026\/06\/Abstract-Data-Display-1-900x600.png\")
<\/p>\n<\/p>\n
The European Commission is moving forward with rules that could restrict US cloud services from handling sensitive government data, targeting financial records, health data, and judicial information held by public-sector bodies across all 27 member states. This is not a broad ban; private-sector cloud use remains untouched. But for AWS, Microsoft Azure, and Google Cloud, which together command roughly 70% of cloud infrastructure revenues in Europe, even a targeted public-sector restriction represents a significant shift in how the EU does business with American tech.<\/p>\n
The proposals are the centrepiece of the long-awaited Tech Sovereignty Package, built around the Cloud and AI Development Act (CADA). Led by Executive Vice-President Henna Virkkunen, the package has faced repeated delays due to intense institutional debate. Following a brief slip past its late-May target, the finalised strategy is set for imminent official presentation. Once unveiled, the package will still require unanimous approval from all 27 member states before taking effect.<\/p>\n
What makes this moment fundamentally different from past EU sovereignty rhetoric is that the Commission has already built, tested, and deployed a concrete scoring system for cloud sovereignty<\/a>. The upcoming legislation will determine exactly how high that statutory bar gets set.<\/p>\n Why US cloud law makes the EU nervous<\/p>\n Under the 2018 US CLOUD Act, American companies can be compelled by domestic law enforcement to hand over user data regardless of where that data is physically stored. A server in Frankfurt provides no legal insulation if the company operating it is headquartered in Seattle. For government-held financial, judicial, and health data, this extraterritorial exposure is the core of the Commission\u2019s concern. Where data lives matters less than who can be legally ordered to produce it.<\/p>\n Thibaut Kleiner<\/a>, Director for Future Networks at DG CONNECT, previously framed the strategic stakes plainly:<\/p>\n \u201cUnless we get our acts together, we are going to be in the mode of becoming a technological colony of some kind, where we are not able to develop our own products.\u201d<\/p>\n<\/blockquote>\n He also acknowledged that the initiative has run into sustained lobbying built around the argument that moving away from US tech is too difficult and too expensive. These tensions sit at the heart of why digital governance is a European imperative, as the continent attempts to assert regulatory control over architectural ecosystems it did not build.<\/p>\n Moving sovereignty from principle to metric<\/p>\n Before the Commission developed its Cloud Sovereignty Framework<\/a>, there was no standardised way to translate \u201csovereignty\u201d into procurement criteria. The new framework changed that by measuring providers across eight dimensions\u2014including legal jurisdiction, operational resilience, supply chain transparency, open architecture, and EU law compliance.<\/p>\n These metrics score providers on a five-tier scale called the Sovereignty Effectiveness Assurance Level (SEAL):<\/p>\n What the commission\u2019s own tender revealed<\/p>\n The Commission did not wait for formal legislation to put these criteria to work. It utilised the framework to award a massive six-year, \u20ac180 million cloud procurement contract<\/a> to four European provider groups.<\/p>\n The tender was explicitly designed to encourage the market to develop sovereign digital solutions. However, it also exposed a deep pragmatic compromise. Purely European tech stacks \u2014 such as Scaleway, STACKIT, and the Post Telecom\/OVHcloud alliance \u2014successfully achieved SEAL-3 status. Meanwhile, the Proximus consortium qualified at SEAL-2 because its framework relies on S3NS \u2014 a joint venture utilising US-origin Google Cloud technology under European operational management.<\/p>\n By anchoring the tender\u2019s minimum eligibility baseline at SEAL-2, the Commission proved its own stated position: that non-European tech, when wrapped in strict local operational controls, can meet baseline requirements. It allowed the EU to maintain a diversified, multi-vendor ecosystem and avoid vendor lock-in, but it drew sharp criticism from European cloud CEOs who wanted a total exclusion of foreign-exposed stacks.<\/p>\n What changes for big tech \u2014 and what remains open<\/p>\n The upcoming CADA rules will not lock US hyperscalers out of Europe entirely. Instead of a binary system of exclusion, the draft strategy leans toward a risk-based, tiered access model. Member states will be required to conduct formal \u201csovereignty risk assessments,\u201d defining specific public-sector workloads that must be hosted on verified sovereign capacity.<\/p>\n The unresolved legislative battle comes down to where the law will mandate those thresholds:<\/p>\n The debate highlights how deeply European regulators are scrutinizing the gap between where data is processed and who owns the underlying code. Similar boundary-testing has increasingly surfaced across consumer platforms \u2014 such as the ongoing regulatory scrutiny over whether certain cross-border data tracking features violate the GDPR \u2014 proving that data residency is no longer a sufficient defense.<\/p>\n Market realities and the blueprint ahead<\/p>\n The scale of the industrial challenge is massive. European cloud providers collectively hold only about 15% of regional cloud infrastructure revenues, compared to the 70% dominated by the US hyperscalers. Yet, momentum is shifting; high-profile migrations, such as France\u2019s Health Data Hub moving workloads to Scaleway, point in the exact direction the Commission wants to go.<\/p>\n\n
\n
\n