European tech and defence firms urge Brussels to mandate homegrown digital infrastructure

More than one hundred European companies and industry associations have signed an open letter to Ursula von der Leyen and Henna Virkkunen demanding that the European Commission legislate to make homegrown technology the default choice for public digital infrastructure. The signatories, ranging from defence prime contractors Airbus and Dassault Aviation to cloud providers OVHcloud, Scaleway and Nextcloud, argue that the bloc's strategic autonomy is now at risk because critical digital supply chains remain overwhelmingly dependent on United States suppliers.

The letter and its signatories

Released on Monday, the letter carries the weight of France's public investment bank Bpifrance alongside industry groupings France Digitale, the European Digital SME Alliance and Connect Europe. Smaller but symbolically important technology firms such as the encrypted email provider Proton and the search engine Ecosia also attached their names. The breadth of the coalition, spanning aerospace, defence, finance, cloud infrastructure and consumer software, reflects a growing consensus that Europe's digital vulnerability is no longer a theoretical concern but an immediate commercial and geopolitical liability.

The document addresses von der Leyen in her capacity as Commission president and Virkkunen as the executive vice-president charged with tech sovereignty, security and democracy. That portfolio, created after the 2024 European elections, signals the political importance Brussels now attaches to digital autonomy. Yet the letter's tone suggests industry leaders believe the Commission's current initiatives, the Chips Act, the Cyber Resilience Act, the Data Act, are insufficient without a mandatory procurement lever.

Two concrete demands: Buy European and a sovereign fund

The letter makes two specific requests. First, a "Buy European" requirement for governments procuring digital goods and services, modelled loosely on the Buy American Act that has shaped US federal procurement for nearly a century. Second, a "sovereign infrastructure fund" to channel public capital into the most capital-intensive layers of the technology stack: semiconductor fabrication, quantum computing, and the data centre capacity needed to train large artificial intelligence models.

Both ideas have circulated in Brussels for years. The European Cloud Federation has long argued for procurement preferences, while the European Investment Bank and the European Innovation Council have experimented with blended finance for deep tech. What is new is the coalition's insistence that voluntary measures have failed. The Chips Act, adopted in 2023 with a headline figure of €43 billion in public and private investment, has yet to produce a single leading-edge fabrication facility on European soil. Intel's planned plant in Magdeburg remains delayed; TSMC's joint venture in Dresden is limited to mature nodes.

The transatlantic trigger

The letter explicitly cites Vice President JD Vance's address to the Munich Security Conference in February as a turning point. Vance told European allies that the United States would no longer subsidise their security while they regulated American technology companies into submission. The speech, combined with the reimposition of steel and aluminium tariffs and the threat of broader trade measures, convinced the signatories that commercial reliance on US cloud, chip and AI providers now carries an unacceptable political risk.

That risk is not hypothetical. The US Cloud Act allows American authorities to compel data disclosure from US-headquartered providers regardless of where the data resides. The Foreign Intelligence Surveillance Act permits bulk collection of non-US persons' communications. European courts have twice invalidated transatlantic data transfer frameworks, Safe Harbor in 2015 and Privacy Shield in 2020, precisely because US surveillance law offers insufficient protection for European fundamental rights. A third framework, the EU-US Data Privacy Framework, entered into force in 2023 but faces a legal challenge from the Austrian advocacy group NOYB.

Europe's digital dependence in numbers

The letter's diagnosis is supported by market data. US hyperscalers, Amazon Web Services, Microsoft Azure and Google Cloud, control more than two-thirds of the European cloud infrastructure market, according to estimates from the European Cloud Federation and independent analysts. European providers such as OVHcloud, Scaleway, Ionos and Deutsche Telekom's Open Telekom Cloud share the remainder, often by serving niche compliance-heavy segments rather than competing head-on for general-purpose workloads.

In semiconductors, Europe's share of global manufacturing capacity has fallen from roughly 20% in the 1990s to around 10% today. The continent designs chips, NXP, Infineon, STMicroelectronics are global leaders in automotive and industrial segments, but relies on TSMC in Taiwan and Samsung in South Korea for advanced fabrication. The Chips Act targets 20% of global production by 2030, but that goal assumes a level of private co-investment that has not yet materialised.

Artificial intelligence presents the starkest gap. The dominant large language models, OpenAI's GPT series, Anthropic's Claude, Google's Gemini, Meta's Llama, are all American. European efforts such as Mistral AI in France and Aleph Alpha in Germany have raised significant capital but operate at a smaller scale and depend on US cloud infrastructure for training compute. The EuroHPC joint undertaking has procured exascale supercomputers in Finland, Italy and Spain, but access is rationed and the machines are largely built with US processors and accelerators.

The EuroStack vision

The letter references EuroStack, an industry-led initiative that maps a complete European technology stack across three layers: hard infrastructure (subsea cables, data centres, semiconductor fabrication), intermediary services (cloud, connectivity, cybersecurity), and applications (AI, software, digital identity). The concept, championed by the European Digital SME Alliance and the German association Bitkom, argues that sovereignty requires control at every layer, not just the application tier where European firms have historically been strongest.

EuroStack's proponents acknowledge that building a full stack from scratch would be prohibitively expensive and strategically foolish. The goal, as Karlitschek put it, is to possess "some assets so that we can at least negotiate." That framing, leverage rather than autarky, distinguishes the current push from earlier, more protectionist iterations of European digital sovereignty. It also aligns with the Commission's own language about "open strategic autonomy", a phrase coined under the previous mandate to denote the ability to act independently when necessary while remaining integrated in global markets.

Political feasibility and internal tensions

The Commission's response will test the cohesion of the von der Leyen II college. Virkkunen's portfolio gives her a natural mandate to advance the agenda, but she must navigate competing interests. The internal market commissioner, Stéphane Séjourné, has emphasised competitiveness and simplification over new regulation. The trade commissioner, Maroš Šefčovič, is engaged in delicate negotiations with Washington to avoid a full-blown transatlantic trade war. A mandatory Buy European rule for digital procurement would almost certainly trigger a challenge at the World Trade Organization and retaliatory measures from the United States.

Member states are also divided. France has historically championed industrial policy and strategic autonomy; Germany, while supportive in principle, remains wary of protectionist measures that could fragment the single market or provoke US countermeasures against its export-oriented manufacturing base. The Nordic and Baltic states, heavily invested in US cloud infrastructure and security cooperation, tend to favour regulatory alignment with Washington over technological decoupling. Eastern European capitals, focused on immediate Russian threats, prioritise NATO interoperability, which often means US systems, over long-term digital independence.

What happens next

The Commission has not yet responded formally. Virkkunen's office is expected to publish a communication on cloud and AI infrastructure before the summer recess, which may address procurement preferences. Meanwhile, the European Parliament's industry committee (ITRE) is drafting an own-initiative report on digital sovereignty that could endorse a Buy European clause. The most concrete near-term test will be the mid-term review of the Chips Act, due in early 2026, where the 20% production target will be assessed against reality. Industry signatories say they will measure the Commission's seriousness by whether the sovereign infrastructure fund appears in the next multiannual financial framework negotiation, which begins in earnest later this year.