European Commission proposes tech sovereignty package targeting US cloud dominance

The European Commission on 3 June 2026 tabled a legislative package that marks the most concerted attempt yet to loosen the grip of American and Chinese technology providers on the continent's critical digital infrastructure. Two regulations sit at the centre of the proposal: a Cloud and AI Development Act (CADA) that establishes graduated sovereignty requirements for cloud services handling sensitive public-sector workloads, and a Chips Act 2.0 that doubles down on the bloc's ambition to manufacture advanced semiconductors on European soil. Both must survive negotiation among the 27 member states and the European Parliament before they take effect.

The kill-switch problem

The Commission's language is unusually blunt. Henna Virkkunen, the executive vice-president responsible for tech sovereignty, told reporters the EU wants to ensure that cloud providers of critical workloads do not possess a "kill switch", the ability to cut off access to data or services under foreign legal compulsion. The reference is unmistakably aimed at the US Cloud Act of 2018, which obliges American companies to surrender user data to US law enforcement regardless of where the data resides. That statute has long been a sore point in transatlantic data-flow negotiations, and the Commission now intends to bake immunity from such extraterritorial reach into its highest sovereignty tier.

Virkkunen acknowledged that US hyperscalers, Amazon Web Services, Microsoft Azure, Google Cloud, will find it "difficult" to qualify for that top tier. The Cloud Act's mandatory disclosure provisions sit in direct conflict with the CADA's requirement that providers of the most sensitive workloads be immune from third-country legal orders. The result is a de facto regulatory barrier: European public bodies handling health data, energy-grid controls, or classified administrative records will be steered toward providers that can demonstrate European ownership, operational control, and supply-chain transparency, not merely data residency.

Beyond data residency

Catherine di Lorenzo, a partner at the law firm A&O Shearman, described the CADA as a "significant shift" because its sovereignty framework reaches far beyond the data-localisation rules that have dominated EU digital policy since the General Data Protection Regulation. The act proposes four levels of sovereignty, each adding requirements: legal immunity from extraterritorial laws, ownership and control structures free from third-country influence, operational autonomy including the ability to maintain services without external support, and full supply-chain transparency down to hardware and firmware. A provider that merely stores data in Frankfurt but answers to a US parent company would not clear the higher thresholds.

This matters because the European public-cloud market is overwhelmingly American. According to IDC figures from late 2025, the three US hyperscalers collectively hold roughly 70% of EU cloud infrastructure spending. European alternatives, OVHcloud, Scaleway, Ionos, and a handful of national champions, have struggled to match the breadth, pricing, and innovation cadence of their American rivals. The CADA does not ban US providers outright, but it creates a segmented market in which the most lucrative and strategically important public-sector contracts are reserved for firms that can meet the top sovereignty tiers. That is a powerful incentive for structural change, whether through European joint ventures, licensing arrangements, or the emergence of genuinely independent European cloud stacks.

Chips Act 2.0 and the foundry gap

The semiconductor side of the package is no less ambitious. The original Chips Act, adopted in 2023, aimed to double the EU's share of global semiconductor manufacturing capacity to 20% by 2030, backed by €43 billion in public and private investment. Progress has been uneven. Intel's planned mega-fab in Magdeburg has faced delays and subsidy renegotiations; STMicroelectronics and GlobalFoundries are expanding in France and Italy, but at mature process nodes. The EU still lacks a foundry capable of producing chips at the 3-nanometre or 2-nanometre nodes that power today's most advanced AI models. That capacity resides almost entirely in Taiwan (TSMC), South Korea (Samsung), and the United States (Intel's nascent foundry services).

Chips Act 2.0 explicitly "prioritises" building a foundry for advanced semiconductor manufacturing within the bloc. The wording signals a shift from the first act's broad supply-chain resilience measures, stockpiling, design capabilities, pilot lines, to a targeted industrial policy bet on leading-edge fabrication. The Commission has not disclosed a budget figure for this second act, but industry sources estimate that a competitive 2-nm foundry would require €20, 30 billion in capital expenditure alone, before operating costs. Whether member states will pool that scale of funding, and whether a European foundry can catch up to TSMC's decade-long process lead, remains an open question.

The geopolitical calculus

Ursula von der Leyen framed the package in stark terms: "We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure." The statement reflects a broader shift in EU strategic thinking since Russia's full-scale invasion of Ukraine in 2022. Energy dependence on Russian gas was weaponised; the fear now is that digital dependence on US or Chinese platforms could be similarly exploited, whether through sanctions, export controls, or covert access mandates. The US Cloud Act is one vector; China's National Intelligence Law, which compels Chinese companies to assist state intelligence work, is another. The Commission's sovereignty tiers are designed to be agnostic on paper but in practice they filter out both jurisdictions from the most sensitive workloads.

Not everyone agrees with the direction. Keegan McBride of the Tony Blair Institute for Global Change welcomed the package as an "important step" but warned that "a full retreat into a Europe-first tech approach will leave the continent weaker." His argument is that great powers project technology globally, they build, deploy, and export, rather than merely securing domestic supply. Europe's current trajectory, in his view, risks creating a protected but sub-scale market that cannot sustain the R&D intensity required to stay at the frontier. The US CHIPS and Science Act, by contrast, couples domestic manufacturing incentives with a strategy to maintain global leadership in design and equipment. The EU has no equivalent export-oriented industrial strategy for semiconductors or cloud.

Industry reaction and lobbying ahead

The legislative process will now enter its most contested phase. The US tech giants have already signalled their intent to engage heavily in the parliamentary and Council negotiations. Microsoft and Amazon have both launched "EU sovereign cloud" offerings in the past two years, Microsoft's Cloud for Sovereignty, Amazon's Dedicated Local Zones, that attempt to meet data-residency and operational-control requirements while remaining under US corporate ownership. The CADA's higher tiers, with their demand for legal immunity from the Cloud Act, cannot be satisfied by corporate restructuring alone. That sets up a clash: the Commission and several member states, notably France and Germany, want the sovereignty tiers to have teeth; others, including Ireland and the Netherlands, host significant US data-centre investments and may push for loopholes or extended transition periods.

European cloud providers, meanwhile, see an opportunity. OVHcloud, the continent's largest independent host, has lobbied for a "trusted cloud" label that aligns closely with the CADA's upper tiers. A coalition of mid-sized European firms, including Scaleway, Cleura, and T-Systems, has argued that public procurement rules should mandate the highest sovereignty tier by default for all critical public-sector workloads. The Commission's proposal stops short of that mandate, leaving the classification of workloads to national authorities under an EU-wide framework. That delegation could lead to fragmentation: a German health authority might classify patient data as tier-four, while a French counterpart assigns it tier-three, creating a patchwork that complicates cross-border digital services.

The talent and energy constraints

Two practical constraints loom over both acts. First, talent. The EU faces a shortage of several hundred thousand ICT specialists, and the semiconductor sector alone estimates it needs 350,000 additional workers by 2030. The Chips Act 2.0 includes provisions for a European Chips Skills Academy and joint degree programmes, but education pipelines take years to yield graduates. Second, energy. Advanced fabs and hyperscale data centres are voracious consumers of reliable, low-carbon electricity. Germany's industrial power prices remain among the highest in the OECD; France's nuclear fleet offers baseload but faces ageing-reactor risks. The Commission has linked the package to its broader Energy Union and Net-Zero Industry Act agendas, but the permitting timelines for new grid connections and renewable capacity often exceed the investment horizons of private firms.