Europe’s cloud sovereignty rules could do more harm than good

Europe's drive for cloud sovereignty is leading to member states favoring providers from their own nation instead of building a Europe-wide cloud services market, according to a report critical of the EU's proposed Cloud and AI Development Act (CADA). A study by the European Centre for International Political Economy (ECIPE) looked at public cloud contracts in nine EU member states and found that every one that invoked the new vocabulary around sovereignty" went to a domestic provider, rather than one based in another EU country. It says that European cloud procurement was already highly concentrated nationally before sovereignty became a key policy objective, based on analysis of 8,725 cloud-related procurement contracts between 2018 and 2025. Nearly all went to providers in the same country with negligible intra-EU cross-border competition. Furthermore, the report claims that those domestic wins often turn out to be from prime contractors that are relying on infrastructure provided by the big hyperscale operators, where sovereignty attaches to the nationality of the operator, not to the infrastructure layer on which the service depends. At issue is a conceptual confusion over cloud sovereignty, which is being used to represent two different problems, according to ECIPE. One treats sovereignty as a security and resilience objective, securing data and managing risks. Sovereignty here means that the user has choices over the provider and design of their cloud service needs. The second treats sovereignty as an industrial policy objective, where sovereignty is more about the notion of Europe-headquartered firms becoming more successful if they are not exposed to competition with non-European providers. CADA includes the two different logics and, confusingly, aims to achieve both outcomes, the report states. The legislation frames the four European Union assurance levels as criteria for security, resilience and trustworthy cloud provision, but the criteria actually aim to enforce sovereignty through requirements concerning EU-located infrastructure, restrictions on third-country control, and control over software supply chains. The goal of cloud sovereignty is therefore at risk of becoming a vehicle for policies that favor selected providers, restrict competition and fragment digital markets, ECIPE warns. Instead of allowing pan-European rivals for the big US cloud providers to grow and flourish, the framework may thus have the opposite effect in encouraging member states to favor providers within their own borders, leading to fragmentation across Europe. A more coherent approach would keep the resilience objectives, but temper their use through technological neutrality requirements that preserve interoperability, portability, and multi-cloud options, the report authors state. It makes a number of policy recommendations, including defining sovereignty as a demonstrated outcome, not an ownership status. Real sovereignty means a public buyer can show its data is secure and that it can switch provider if it has to. A provider's passport does not tell you that", said ECIPE Director and co-author of the study, Fredrik Erixon. Europe's cloud market is already national in practice. CADA risks locking that in." Vague drafting But not everyone might agree. Earlier this year, tech trade association CISPE (Cloud Infrastructure Service Providers in Europe) urged the European Commission to legislate for real tech sovereignty, rather than the illusion of it. It argued that sovereignty must be defined by control, not by whether a provider merely has an EU presence, and that means effective ownership of the underlying technology and protection from extraterritorial laws like the US CLOUD Act, under which Washington can compel American tech companies such as the big cloud operators, to hand over any data they hold, including data stored overseas. The same group had earlier warned that the EC's criteria for cloud sovereignty had been drafted so vaguely as to favor incumbents - meaning the big American operators that already dominate Europe's cloud market. (R)