The European Commission is considering new rules that would restrict the use of U.S. cloud platforms for processing sensitive government data across EU countries, according to officials who spoke with CNBC [1]. The proposed measures are part of the upcoming 'Tech Sovereignty Package,' which is expected to be presented on May 27 [1]. This package aims to bolster the European Union's strategic autonomy in key digital sectors, including cloud computing and artificial intelligence [1].
Currently, U.S. cloud providers dominate the European market, but there have been increasing calls within Europe to shift the region's most critical workloads to homegrown providers, especially in light of heightened tensions with the U.S. administration [1]. The core idea under discussion is to define sectors—such as financial, judicial, and health data—where sensitive public-sector information must be hosted on European cloud infrastructure [1]. While the proposals would not outright ban overseas companies from government contracts, they would limit their use in processing sensitive data, depending on the level of sensitivity [1].
The officials noted that these discussions are ongoing and have not yet been finalized [1]. The proposed rules would not affect private-sector companies' use of cloud platforms, focusing solely on public-sector organizations [1]. The 'Tech Sovereignty Package' will also include the Cloud and AI Development Act (CADA) and the Chips Act 2.0, both aimed at encouraging sovereign, homegrown solutions in these areas [1].
If the package is presented, it would require approval from all 27 EU member states before becoming law [1]. A Commission spokesperson stated that the package is about strengthening European digital sovereignty, but did not provide further details [1].
CONCLUSION
The European Commission's consideration of restricting U.S. cloud providers for sensitive government data signals a significant shift towards digital sovereignty in the EU. If implemented, these measures could have a substantial impact on U.S. cloud companies' access to the European public sector market. The final outcome will depend on ongoing discussions and approval by all EU member states.