Europe’s cloud sovereignty rules could do more harm than good
Report warns that sovereignty is being used to favor selected national providers and could stifle pan-Europe clouds
Europe’s ambition to achieve cloud sovereignty is resulting in member states preferring domestic providers over a unified Europe-wide cloud market, according to a critical report on the EU's proposed Cloud and AI Development Act (CADA). A study by the European Centre for International Political Economy (ECIPE) examined public cloud contracts across nine EU countries and discovered that each one relying on the new "sovereignty" terminology opted for a domestic provider instead of one based in another EU nation.
This study found that European cloud procurement was already heavily concentrated at the national level before sovereignty emerged as a policy priority, based on the analysis of 8,725 cloud-related procurement contracts from 2018 to 2025. Almost all of these contracts went to providers located in the same country, with very little cross-border competition within the EU.
Moreover, the report argues that these domestic victories often belong to prime contractors that depend on infrastructure provided by the major hyperscale operators, where sovereignty is tied to the nationality of the operator rather than the infrastructure layer on which the service depends. The confusion surrounding cloud sovereignty stems from its dual use to represent two distinct issues.
One perspective treats sovereignty as a security and resilience objective, focusing on data security and risk management. The other perspective views sovereignty as an industrial policy objective, emphasizing the importance of Europe-based firms thriving without facing competition from non-European providers. CADA incorporates both concepts, but confusingly, it seeks to achieve both objectives simultaneously.
The legislation frames the four EU assurance levels as criteria for security, resilience, and trustworthy cloud provision, but these criteria actually aim to enforce sovereignty through requirements related to EU-located infrastructure, restrictions on third-country control, and control over software supply chains. Consequently, the goal of cloud sovereignty may be compromised and used as a tool to favor specific providers, restrict competition, and fragment digital markets, warns ECIPE.
Instead of enabling pan-European rivals for the dominant US cloud providers to grow and succeed, the framework may inadvertently encourage member states to choose providers within their own borders, leading to fragmentation across Europe. A more coherent approach would retain the resilience objectives but temper their use through technological neutrality requirements that maintain interoperability, portability, and multi-cloud options, according to the report authors.
They have proposed several policy recommendations, including defining sovereignty as a proven outcome rather than an ownership status. ECIPE Director and co-author of the study, Fredrik Erixon, clarified that "real sovereignty means a public buyer can demonstrate its data is secure and that it can switch providers if needed. A provider's passport does not indicate that."
However, some stakeholders, such as the Cloud Infrastructure Service Providers in Europe trade association, argue that legislation should promote genuine tech sovereignty rather than the perceived illusion. This group contends that sovereignty should be defined by control, not mere EU presence, and that effective ownership of underlying technology and protection from extraterritorial laws, such as the US CLOUD Act, are necessary.
Additionally, this group warned that CADA's criteria for cloud sovereignty are drafted too vaguely, potentially benefiting the existing American cloud operators that already dominate Europe's cloud market.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
