Europe’s cloud sovereignty rules could do more harm than good

Europe’s drive for cloud sovereignty is leading to member states favoring providers from their own nation instead of building a Europe-wide cloud services market, according to a report critical of the EU’s proposed Cloud and AI Development Act (CADA).

A study by the European Centre for International Political Economy (ECIPE) looked at public cloud contracts in nine EU member states and found that every one that invoked the new vocabulary around “sovereignty” went to a domestic provider, rather than one based in another EU country.

It says that European cloud procurement was already highly concentrated nationally before sovereignty became a key policy objective, based on analysis of 8,725 cloud-related procurement contracts between 2018 and 2025.

Nearly all went to providers in the same country with negligible intra-EU cross-border competition.

Furthermore, the report claims that those domestic wins often turn out to be from prime contractors that are relying on infrastructure provided by the big hyperscale operators, where sovereignty attaches to the nationality of the operator, not to the infrastructure layer on which the service depends.

At issue is a conceptual confusion over cloud sovereignty, which is being used to represent two different problems, according to ECIPE.

One treats sovereignty as a security and resilience objective, securing data and managing risks.

Sovereignty here means that the user has choices over the provider and design of their cloud service needs.

The second treats sovereignty as an industrial policy objective, where sovereignty is more about the notion of Europe-headquartered firms becoming more successful if they are not exposed to competition with non-European providers.

CADA includes the two different logics and, confusingly, aims to achieve both outcomes, the report states.

The legislation frames the four European Union assurance levels as criteria for security, resilience and trustworthy cloud provision, but the criteria actually aim to enforce sovereignty through requirements concerning EU-located infrastructure, restrictions on third-country control, and control over software supply chains.

The goal of cloud sovereignty is therefore at risk of becoming a vehicle for policies that favor selected providers, restrict competition and fragment digital markets, ECIPE warns.

Instead of allowing pan-European rivals for the big US cloud providers to grow and flourish, the framework may thus have the opposite effect in encouraging member states to favor providers within their own borders, leading to fragmentation across Europe.