European firms fear US tech kill switch but lack backup plans

Three quarters of companies in Europe's three largest economies believe a US government or corporate decision could cut them off from the digital infrastructure they rely on every day. A survey commissioned by the Swiss privacy-focused provider Proton found that 74% of British, German and French enterprises fear severe disruption if American Big Tech pulls the plug on critical cloud or AI services, a level of anxiety roughly equal to the share that fear a conventional cyberattack. Yet the same research reveals a striking disconnect: most of those companies have no tested plan for what happens if that access vanishes.

The preparedness gap

Proton's figures show that 54% of European firms could not remain operational for more than a single day if they lost access to their cloud provider. While two thirds say they would switch providers if a foreign government restricted access to an essential digital service, only 28% have a continuity solution for a cloud outage and just 24% have one for loss of AI tools. Fewer than half, 44%, test their continuity plans under real conditions. The numbers lay bare a gap between the rhetoric of technological sovereignty and the reality of daily dependence on US hyperscalers.

The survey also captures a shift in boardroom priorities. According to Proton's chief operating officer Raphaël Auphan, 56% of European firms now say geopolitical risk carries the same weight as cyber risk in purchasing decisions. He points to two recent flashpoints: the withdrawal of Fable 5 and the denial of Microsoft services to officials of the International Criminal Court. Both episodes reinforced the perception that access to US-controlled infrastructure can be revoked for political reasons.

Proton sees a surge in structured migration plans

That anxiety is translating into commercial momentum for European alternatives. Proton, which offers email, VPN, password management and cloud storage, reports signups up nearly 80% in the Nordic region alone, itself one of the most dependent on US technology, with similar growth across the continent. More telling than the volume, Auphan says, is the nature of the conversations. Organisations are approaching Proton with structured dependency-reduction roadmaps stretching as far as 24 months into the future. "The question isn't whether European organisations will move away from the US, but rather how fast such a migration will be," he concludes.

Why the migration will be slow

Analysts are less optimistic about the pace. The core of the problem is simple: the vast majority of cloud and AI infrastructure is owned by Google, Microsoft and Amazon. Those companies not only offer products that many European firms consider superior; they also outspend European rivals by an order of magnitude. Penny Naas, senior vice president for innovation and competitiveness at the German Marshall Fund, notes that US providers are investing roughly ten times more in research, development and new data centres than their European counterparts. Microsoft alone has put €3.2 billion into German data centres over the past two years, while the entire German cloud industry invested just under €2 billion in domestic offerings.

Naas describes EU-based cloud providers as "increasingly niche," together accounting for less than 2% of the European market. She argues that local obstacles, permitting, electricity costs, access to cutting-edge chips, matter, but the fundamental issue is insufficient private capital. "European demand is then met by the US providers," she says. Philipp Eckhardt, head of financial markets and information technologies at the Centre for European Policy, agrees. He sees no significant shift underway. American providers "set the gold standard" for digital products, and switching would mean accepting less competitive alternatives.

Cognitive dissonance and free-rider problems

Eckhardt identifies two behavioural brakes. First, a form of cognitive dissonance: many organisations believe a kill switch could hit others but not themselves. Second, a free-rider dynamic. A company that invests in reducing its dependency bears the full cost, while the benefits, a more resilient ecosystem, accrue to competitors as well. "Consequently, no company will invest until others do… nobody changes their behaviour," he says. In his view, only regulation can break the impasse, for example by obliging critical infrastructure providers to diversify or develop backup solutions.

The EU's recently unveiled Technological Sovereignty Package is widely seen as a step in that direction. Aimilia Givropoulou and Sivan Pätsch of OpenForum Europe call it "the most ambitious plan the EU has made to address its digital dependencies." They highlight three elements: open source embedded in a coherent industrial policy framework; the value-capture problem explicitly named and backed by policy action; and the Cloud and AI Development Act, which introduces sovereignty assurance levels giving public bodies a structured way to assess risk.

The Sovereignty Package and its exemptions

The package includes the Chips Act 2.0 and the Cloud and AI Development Act. Yet the legislation contains deliberate off-ramps. The Chips Act allows public procurement from countries with which the EU has strategic partnerships. The Cloud and AI Development Act creates four sovereignty assurance tiers; the lowest tier permits non-EU providers if a public body "explicitly requires" them. Article 30 exempts contracting authorities from the regulation's requirements if compliance would entail "disproportionate cost." Eckhardt argues these exemptions are necessary: blanket sovereignty rules would make procurement more expensive, increase bureaucratic burden and risk wasting taxpayer money. But they also mean the EU cannot claim full technological sovereignty any time soon.

Chloe Teevan, associate director of geostrategy at the European Centre of Development Policy Management, adds a geopolitical dimension. Europe has deliberately cultivated partnerships with middle powers, India, South East Asia and others, to diversify critical supply chains. "It is vital that when the EU signs new trade agreements with countries like India, it does not undermine those agreements by making meaningful cooperation impossible," she says. The procurement question therefore has many facets and cannot be reduced to a binary EU-versus-US choice.

What companies should do now

While the policy framework matures, Proton advises enterprises to act on their own. Auphan sets out two priorities. First, diversify beyond US jurisdiction wherever possible: "Don't use one US-owned platform for all your email, cloud storage and collaboration. Only diversifying outside the US jurisdiction provides a solution." Second, test full kill-switch scenarios, where many or all digital services go offline simultaneously, before they happen. "Critically, test the kill switch before you need it," he says. "Our research shows that most organisations have some form of continuity plan, but fewer than half have ever tested it under real conditions."