The European Commission's own figures are stark: 80% of the European Union's key digital projects depend on providers outside the bloc. The number has been circulating for some time. It gained fresh urgency this summer as American tech firms tightened their grip on cloud computing, artificial intelligence tools and digital platforms, and as Chinese competitors began pressing into the same space with increasing ambition.
The dependency is structural, not superficial
Cristina Caffarra, a competition economist and co-founder of the Euro Stack Initiative, argues that European policymakers have spent two decades focused on the wrong layer of the problem. Brussels has regulated the behaviour of dominant platforms, fining them for antitrust violations and imposing rules on data handling and content moderation. These interventions treated the issue as one of market conduct. Caffarra says the real issue is market structure.
"The nature of the power that was being rolled over us was infrastructure, and that is hardware, software, connectivity, operations, controls - all of these dimensions in a layer of infrastructure that ultimately we do not own and do not control and on which our entire life depends," Caffarra told the podcast The Dip. She describes the current arrangement as a "digital colony," a phrase that captures the depth of the asymmetry better than most diplomatic language coming out of Brussels.
The point matters because the infrastructure layer is where value accumulates. Applications and services sit on top of cloud platforms, data centres, connectivity networks and semiconductor designs. Control the stack, and you set the terms for everyone else. Europe, by and large, does not control the stack. Between 85% and 90% of cloud capacity in Europe is owned by American hyperscalers, principally Amazon Web Services, Microsoft Azure and Google Cloud. The chips that power artificial intelligence training are designed almost entirely by Nvidia, a company subject to United States export controls.
What the kill switch means in practice
Raphaël Auphan, chief operating officer of the Swiss privacy-focused technology company Proton, has seen the dependency up close. Proton, which grew from a project at CERN in Geneva into a company of more than 650 employees with users worldwide, offers encrypted email, VPN and calendar services. Auphan previously worked at Qwant, the French privacy-focused search engine. He has spent his career inside European alternatives to American digital services, which gives him a clear view of how hard it is to build them.
Auphan cites a survey Proton conducted last year: 74% of publicly listed companies in Europe, from large caps down to smaller firms, rely on United States-based email services. The figure is striking because email is among the most basic and longest-standing digital tools a company uses. If European businesses cannot find a home-grown provider for something as mature as email, the prospects for sovereignty in newer, more complex domains look faint.
The risk Auphan describes is not theoretical. He says organisations have approached Proton after concluding that their American providers could become unreliable. "We have an international organisation with 5,000 users worldwide," he said, referring to a recent client. "They came to us really worried. If you have a Google Workspace infrastructure, you cannot be sure that Google will run for you with the current administration." The concern is that a company or institution could be told, through a price increase or a direct notification, that it can no longer use a service it depends on. Auphan calls this the "kill switch."
Why the Commission draws criticism from both sides
Caffarra is unsparing about the European Commission's record. "The European Commission is the last we should be listening to over here," she said. "They have regulated for the best part of 20 years. We failed the results. And when it comes to building, they have not built anything. The ones who are going to be building, the companies, it's not the European Commission, it's an institution of bureaucrats and lawyers. They've never run a lemonade stand. What exactly do you think they're going to build?"
The criticism is pointed but not entirely fair. The Commission does not build companies; that is not its function. Its tools are regulatory and financial. Through the Digital Markets Act and the Digital Services Act, Brussels has tried to force dominant platforms to open up and behave more fairly. Through Horizon Europe and related funding programmes, it has directed billions of euros towards research in semiconductor design, cloud infrastructure and artificial intelligence. The question is whether regulatory pressure and grant funding can compensate for the structural absence of European-owned infrastructure at scale.
Caffarra's frustration is widely shared among those who believe that regulation without investment simply entrenches dependency. If European companies build AI applications on top of American cloud infrastructure, the value still flows upwards. The American provider can raise prices, change terms or restrict access. Brussels can fine a platform for abusing its dominance, but a fine does not create an alternative provider. It does not give a European customer somewhere else to go.
China complicates the picture
The conversation about digital sovereignty has often been framed as a binary: Europe can choose American providers or build its own. Caffarra adds a third actor. China, she argues, has "a combination of incredible capability, authoritarianism and sheer will" and has moved into a position where it could capture a significant share of the infrastructure and services market, particularly in artificial intelligence. The framing matters. If the choice becomes American infrastructure versus Chinese infrastructure, European autonomy shrinks further, not expands.
China's AI capabilities are advancing quickly, from large language models to industrial applications. For European companies seeking alternatives to American cloud providers, Chinese options may appear attractive on price and performance. But Chinese firms operate under a national security law that requires them to assist the state with intelligence work. European institutions and companies handling sensitive data would face a different but comparable sovereignty risk. The real alternative, Caffarra and Auphan both argue, has to be European.
The meaning of digital sovereignty
Digital sovereignty is a term that appears in dozens of European Commission strategy documents and white papers. It can become hollow through repetition. Auphan offers a practical definition: it means having a choice. "Digital sovereignty is about having the choice of alternatives here in Europe for alternative players to the US tech players," he said. The investment in those alternatives carries a short-term cost and a long-term return. The short-term return is reduced exposure to the kill switch. The long-term return is a European digital ecosystem that generates its own value, its own employment and its own strategic options.
Caffarra frames sovereignty not as a defensive posture but as an economic necessity. Without infrastructure that Europeans control, she argues, the continent is "like somebody building an extension on somebody else's house. And one day the owner of the house would say, 'Nice extension. I'm going to jack up the rent even further.'" The analogy captures the core problem: the landlord sets the terms, and the tenant, however capable, cannot reconfigure the building.
What building alternatives actually requires
Proton's trajectory shows what is possible and what is slow. The company has grown from a research project to a substantial operation with more than 650 staff. It offers encrypted services that compete directly with offerings from Google and Microsoft. But email and calendar tools, however well built, sit at the top of the stack. Proton itself depends on infrastructure below: data centres, network connectivity, semiconductor supply. A genuinely sovereign European digital capacity would need to extend down through those layers.
Several initiatives are attempting exactly this. Gaia-X, the European cloud project launched in 2020, aims to create a federated data infrastructure that complies with European data protection rules. It has attracted criticism for moving slowly and for including American hyperscalers among its participants. The European Chips Act, which entered into force in September 2023, commits roughly €43 billion in public and private money to increase Europe's share of semiconductor production. The targets are modest: the Act aims for Europe to produce 20% of the world's chips by 2030, up from roughly 10% today. The European Chips Act is a start, but it does not address the immediate dominance of American cloud providers in European markets.
Caffarra insists the talent exists. "Europe is amazing," she said. "At the level of actual tech companies, individuals, Europe has incredible talent. We are an economic superpower. We have incredible capabilities. We are rich. And we are still allowing others to talk down to us." The question is whether that talent can be organised, funded and directed at the infrastructure layer quickly enough to matter. The American hyperscalers are not standing still. Neither are Chinese firms. Every year that passes without European alternatives at the cloud and semiconductor level deepens the dependency that Caffarra describes.
People mentioned
-
Cristina Caffarra
Organisations
Proton · Euro Stack Initiative · European Commission
