Thirteen European cloud providers, including OVHcloud, Nextcloud and Proton, along with a group of Members of the European Parliament and several civil society organisations, endorsed the European Commission's Tech Sovereignty Package on 1 June, ahead of its scheduled presentation on 3 June.
The package introduces new rules for cloud infrastructure, artificial intelligence, semiconductors and open code development.
Formally, it is a technological and industrial initiative. In essence, the European Union is, for the first time, attempting to address a problem that neither the GDPR, the Digital Services Act, nor the Digital Markets Act has managed to solve: how to reduce dependence on American digital infrastructure without undermining its own open market model.
This is why, in recent weeks, the debate has shifted from technology to questions of control.
The European Union currently has one of the most assertive regulatory policies towards large technology companies.
However, as it has built regulatory influence, it has also become increasingly dependent on infrastructure controlled by companies outside Europe.
Amazon Web Services, Microsoft Azure and Google Cloud together account for approximately two-thirds of the global cloud infrastructure market, while European providers remain much smaller actors.
This is precisely why the Commission's new initiative represents a much more significant shift than previous digital regulations. Brussels is no longer simply seeking to regulate the market; it is attempting to change its structure.
The problem for Brussels is no longer technology but jurisdiction
For years, the European policy of digital sovereignty was based on a relatively simple logic: if data is physically located within the European Union, the risk is under control.
Today, that logic no longer satisfies either European governments or the growing segment of the European technology industry. The reason is the American CLOUD Act of 2018.
That law allows US authorities to demand access to data from US-based companies even when the data is physically located outside US territory.
The issue of cloud infrastructure extends beyond technology policy and becomes a matter of political autonomy
This is why European cloud companies have insisted in recent months that sovereignty is not defined by the location of the server or data centre, but by control over the infrastructure, ownership, and the legal framework under which the company operates. This changes the entire discussion.
For proponents of the new European approach, it is no longer crucial whether the data is in Frankfurt, Amsterdam, or Paris.
What matters more is who controls the infrastructure on which the data is stored and under which laws the company managing that infrastructure operates.
Therefore, the issue of cloud infrastructure extends beyond technology policy and becomes a matter of political autonomy.
Brussels seeks to favour European companies without overt protectionism
At the same time, the European Commission is carefully trying to avoid a direct conflict with the American technology giants.
The Tech Sovereignty Package does not introduce a formal obligation to purchase European solutions. It does not prohibit the use of AWS, Azure, or Google Cloud. It does not introduce the traditional "Buy European" policy.
Instead, the Commission is seeking to change the criteria.
The proposed Cloud and AI Development Act introduces the concept of a "sovereign cloud" and a risk assessment system that considers ownership, management, control of infrastructure, and exposure to non-European legislation.
The Commission is not trying to force American companies out of the European market
In this model, European companies gain a structural advantage without formally closing the market.
Brussels understands overt protectionism would cause political and legal problems within the European Union itself and would further worsen relations with Washington.
That is why it chooses a more sophisticated approach: it does not change the rules of competition, but rather the criteria for assessing security and strategic dependence.
In other words, the Commission is not trying to force American companies out of the European market; it is trying to create job and infrastructure categories where European ownership becomes an important advantage.
European companies see the last major opportunity
The support given by European cloud companies to the new package does not stem solely from political reasons.
For much of the European technology sector, this is probably the last chance to alter the balance of power in a market that has been dominated by American hyperscalers for years.
Europe's problem has never been a lack of regulation; the issue is market reality.
Amazon, Microsoft and Google have invested tens of billions of dollars in data centres, artificial intelligence development and cloud infrastructure for years.
Part of European industry believes that without a more active role from the Commission, the market will not achieve balance
European competitors simply do not have comparable financial and technological resources.
That is why part of European industry believes that without a more active role from the Commission, the market will not achieve balance.
This is evident from the composition of the coalition that supported the new package. It includes cloud providers, open-source companies, companies developing infrastructure for artificial intelligence, and organisations focused on digital rights.
Their interests are not identical, but they share the view that the current model reinforces Europe's long-term dependence on a few dominant non-European platforms.
The Commission already testing new model
More important than political statements is what the Commission has already done.
In April, it awarded contracts for cloud infrastructure to European providers that met the criteria of the Cloud Sovereignty Framework.
This contract, worth 180 million euros over six years, is intended for institutions and agencies of the European Union.
Financially, this is not a market-changing amount. Politically, the signal is much more significant.
The real test of the new strategy will be the contracts the Commission signs
For the first time, the Commission has demonstrated that it is prepared to apply its own criteria to public procurement and infrastructure projects. It is at this level that the actual scope of the entire strategy will be determined.
The real test of the new strategy will not be the documents the Commission adopts, but the contracts it signs.
If the largest contracts still go to American providers, talk of digital sovereignty will have little practical meaning.
If European institutions begin to favour domestic providers in sectors they consider strategically important, it will serve as the ultimate test of whether Brussels is ready to turn its political ambitions into concrete economic policy.
The next phase will not be technological but political
The main obstacle to the new package is unlikely to be technology; it will be politics.
Many member states remain deeply integrated with US cloud systems. Numerous European companies are developing their own AI and digital services on the infrastructure of AWS, Microsoft, and Google. Complete separation is not a realistic option.
The Commission will continue to insist that this is not about protectionism, but about risk management
At the same time, Washington will closely monitor any attempt to restrict American companies' access to the European market through standards, certification, or public procurement.
Therefore, the Commission will continue to insist that this is not about protectionism, but about risk management.
However, the real debate is no longer about terminology. It concerns how far the European Union can favour its own infrastructure without jeopardising the open economy model on which the single market is based.
The most likely outcome is not Europe's digital independence
This brings us to the most important question.
The most likely outcome of the new package is not a weakening of the market position of Amazon, Microsoft, or Google. Their technological advantage is too great to be threatened by a single regulatory initiative.
The most likely outcome of the new package is not a weakening of the market position of Amazon, Microsoft, or Google
It is much more likely that, over the next few years, a distinct category of digital businesses and infrastructure will emerge for which European ownership, control, and jurisdiction will become, in practice, an informal requirement.
This primarily concerns the public sector, defence projects, critical infrastructure, energy systems, and certain AI capacities that Brussels will assess as strategically sensitive.
Such a model would not displace American companies from the European market.
However, for the first time, it would create a protected space in which European providers would have an advantage they did not previously possess.
This is precisely why the Tech Sovereignty Package is far more significant than another European technology regulation.
After years of regulation, fines, and investigations against big tech companies, the European Union is, for the first time, trying to influence an issue it considers more important than the behaviour of digital platforms: who controls the infrastructure on which the European economy depends.
