EU tightens grip on cloud sovereignty amid US tech tensions

Cloud sovereignty in Europe is a multifaceted concept that extends beyond mere data storage location to encompass full control over data processing, legal jurisdiction, and infrastructure resilience. While some major providers like Microsoft have selectively licensed platforms to European operators, others such as AWS have resisted, underscoring debates about what truly constitutes European ownership and control. This is especially critical for government use, where partial sovereignty arrangements are deemed insufficient, as the processing layers—particularly for AI—must be entirely under European authority to avoid vulnerabilities.

The strategic imperative driving Europe’s push for cloud sovereignty stems from acute concerns over geopolitical and legal risks tied to reliance on non-European providers. The US CLOUD Act exemplifies these vulnerabilities, as it subjects data—even when stored in European data centers—to American jurisdiction, raising fears of external interference in sensitive areas like defense, illustrated by worries over Lockheed Martin’s potential influence on European fighter aircraft. Consequently, the Gaia-X initiative emphasizes that true sovereignty requires providers headquartered within Europe, ensuring autonomous enforcement of data security laws without foreign obstruction.

Europe’s pursuit of cloud sovereignty is transitioning from abstract policy discussions to tangible investments and regulatory mandates, signaling its strategic priority. High-profile moves such as Airbus’s €50 million tender to migrate mission-critical systems to sovereign clouds, BMW’s expansion of the Catena-X data-sharing network, and Germany’s armed forces replacing Microsoft 365 with open-source solutions reflect a security-driven shift. Meanwhile, the EU Data Act and sector-specific regulations like DORA and NIS2 have codified sovereignty as a non-negotiable compliance factor, although many businesses still lag in implementation, often resorting to costly, last-minute decisions under regulatory pressure.

An emerging ecosystem of European sovereign cloud providers, including France’s Mistrol and the Netherlands’ Avandar—recently backed by a €2 million seed round—stands to benefit from this momentum despite being nascent players. However, the complexity of cross-border data flows involving multiple jurisdictions with divergent data protection laws complicates operationalizing sovereignty. This legal and operational labyrinth underscores why Europe’s cloud sovereignty is not merely a technological challenge but a strategic necessity to safeguard autonomous decision-making and enforceable governance in an increasingly interconnected digital landscape.

By mid-2026, the EU’s Cloud and AI Development Act (CADA) established a rigorous four-tier 'Union assurance levels' framework that progressively tightens sovereignty requirements for cloud providers serving the public sector. Starting with Level 1, providers must localize infrastructure and data within the EU and prevent foreign authorities’ access to unexploited vulnerabilities, while higher levels demand EU-based personnel, ownership, and stringent cybersecurity certifications. This tiered approach not only aims to curb reliance on non-EU providers but also aligns with critical sectors under the NIS2 Directive, reflecting a nuanced, risk-based strategy to safeguard public order and national security.

CADA’s assurance levels are more than technical standards; they have become a de facto market access gatekeeper for public-sector cloud services. Contracting authorities must procure services meeting at least Level 1, with higher levels mandated for activities tied to public order, effectively segmenting the cloud market by sovereignty criteria. This legal embedding of sovereignty, resurrecting criteria once debated and removed from the EU cloud cybersecurity certification scheme (EUCS), signals a decisive shift where sovereignty compliance is no longer voluntary but a binding condition for public procurement eligibility.

The regulatory landscape enveloping CADA is a complex compliance cascade involving the EU Data Act, NIS2, DORA, and the EU AI Act, collectively imposing overlapping obligations on cloud providers. This interlocking framework targets the EU’s strategic vulnerability stemming from American hyperscalers’ dominance—accounting for roughly 80% of EU professional cloud spending—and drives a structural shift in procurement patterns. Gartner forecasts European sovereign cloud IaaS spending to soar from $6.9 billion in 2025 to $23.1 billion by 2027, underscoring the profound market transformation catalyzed by these sovereignty-driven regulations.

While CADA’s legislative process remains in its early stages, political consensus is clear: a sovereignty-based tiering system for public-sector cloud services is inevitable. The ongoing negotiations focus on calibrating the assurance levels rather than questioning their fundamental premise. This reflects a broader EU ambition to build domestic cloud capacity through procurement incentives and stringent sovereignty rules, addressing structural deficits in data center infrastructure and reducing overreliance on non-EU providers, thereby reshaping the European cloud sovereignty landscape for years to come.

Europe’s pursuit of cloud sovereignty is entangled in the complex interplay between EU data protection laws like GDPR and extraterritorial foreign statutes such as the US CLOUD Act, which grants American authorities the power to compel data disclosure regardless of where data is stored. This legal friction is exemplified by the Dutch government’s 2026 blocking of Kyndryl’s acquisition of Solvinity, driven by fears that U.S. jurisdiction over Kyndryl’s parent company could expose sensitive Dutch data, underscoring how digital sovereignty has become a national security issue prompting stricter investment screening and procurement laws.

The challenge of defining what truly constitutes ‘European control’ over cloud infrastructure remains unresolved, with debates centering on whether local subsidiaries with governance boards suffice or if full ownership and licensing of technology by European entities are necessary to meet EU assurance standards. Early-stage sovereign cloud initiatives like France’s Mistrol and the Netherlands’ Avandar illustrate nascent efforts to establish platforms fully owned and operated within Europe, aiming to circumvent foreign legal reach and provide clearer legal certainty.

Operational realities complicate Europe’s sovereignty ambitions, as demonstrated by the Swedish Transport Agency’s unsuccessful attempt to impose stringent EU data sovereignty clauses on Microsoft, which refused essential contractual changes including data localization and compliance with Swedish public access laws. This episode highlights the persistent dependency on dominant U.S. cloud providers who resist accountability, forcing European agencies to adopt pragmatic risk mitigation strategies such as enhanced security assessments and closer collaboration with authorities to uphold sovereignty within constrained frameworks.

The growing importance of digital sovereignty is reshaping European dealmaking and AI infrastructure strategies, with experts like Alexandre Grellier emphasizing that the decisive factor is not server location but the legal jurisdiction governing platforms. Organizations seeking to shield transactions from foreign jurisdictional exposure are migrating to fully EU-owned and operated platforms that embed AI within sovereign, well-governed environments, aligning with heightened regulatory expectations around compliance, data security, and AI governance to future-proof their operations.

By mid-2026, the European Union had firmly embedded cloud sovereignty into public-sector procurement through CADA's four-tier assurance levels, which impose stringent criteria on data residency, personnel, third-country control, security, and software supply chains. This legal framework revives previously debated sovereignty requirements, now making them a decisive factor for cloud providers seeking access to Europe's public sector market. As a result, major cloud providers are compelled to recalibrate their operational strategies, often through partnerships with European operators or by enhancing compliance capabilities, to maintain eligibility and market presence.

Europe's regulatory approach to cloud market concentration reached a critical juncture in June 2026 when the European Commission designated Amazon Web Services and Microsoft Azure as 'gatekeepers,' granting new powers to curb their dominance. This move addresses the oligopolistic landscape where the top three US hyperscalers—Amazon, Microsoft, and Alphabet—offer non-interoperable services, effectively locking customers into costly and technically challenging transitions between providers. In contrast to Canada's continued heavy reliance on AWS despite operational risks and multi-million-dollar contracts, Europe is actively fostering sovereign alternatives and regulatory interventions to reduce dependency on these dominant players and promote a more competitive and sovereign cloud ecosystem.

The political consensus around sovereignty-based tiering of the public-sector cloud market signals an irreversible shift in how cloud services will be procured and operated in Europe. While the precise calibration of CADA's assurance levels remains under discussion, the principle that sovereignty criteria will dictate market access is settled, compelling cloud providers to innovate through compliance or strategic partnerships. This evolving landscape not only reshapes provider strategies but also catalyzes the emergence of local European cloud operators as viable sovereign alternatives, aiming to break the oligopoly and address interoperability challenges inherent in the current market structure.

Europe’s cloud sovereignty drive is fundamentally a geopolitical and security imperative, fueled by the structural dominance of American hyperscalers like Amazon Web Services and Microsoft Azure, which control about 70% of the EU cloud market. This dependency exposes European data to conflicting legal regimes such as the US CLOUD Act versus the EU’s GDPR, prompting the EU to enact the Sovereignty Package and the Cloud and AI Development Act (CADA) in mid-2026. These frameworks establish multi-level sovereignty assurances to protect sensitive public-sector workloads and critical infrastructure, marking a strategic pivot away from reliance on foreign providers deemed a 'strategic vulnerability.'

The political stakes of cloud infrastructure have escalated to the point where European governments treat cloud acquisitions as national security matters, exemplified by the Dutch government’s 2026 blocking of Kyndryl’s acquisition of Solvinity due to fears that US authorities could access sensitive data under extraterritorial laws. This highlights that physical data location alone is insufficient for sovereignty; control over operating entities and legal jurisdiction is paramount. Consequently, procurement frameworks like the Dutch Defence and Security Procurement Act now prioritize resilience and sovereignty, reflecting a broader shift to treat cloud infrastructure as a critical utility akin to electricity.

Beyond legal jurisdiction, escalating cyber threats from state-sponsored actors and organized ransomware groups targeting critical infrastructure have intensified the urgency for sovereign cloud ecosystems. Governments and regulated industries increasingly demand control over cloud infrastructure to mitigate risks posed by foreign legal reach and sophisticated cyberattacks, driving substantial investment growth—from $6.9 billion in 2025 to a projected $23.1 billion in 2027 in European sovereign cloud IaaS spending. Notably, the UK’s £1.1 billion commitment to sovereign AI infrastructure and the European Commission’s 2026 contracts underscore this strategic prioritization of resilient, sovereign digital ecosystems.

Despite significant investments, challenges persist because major cloud providers underpinning sovereign initiatives, such as Google Cloud, remain foreign-controlled and thus non-sovereign. The transient nature of data—constantly moving across applications, environments, and jurisdictions—means that sovereignty extends beyond mere data residency to encompass comprehensive oversight of data flows and platform control. As infrastructure becomes increasingly geopolitical, organizations must understand not only technical capabilities but also who controls their platforms, where data travels, and which laws apply, elevating data sovereignty from a compliance issue to a critical strategic and security concern.

By mid-2026, European organizations face an intricate compliance landscape where regulations such as CADA, the EU Data Act, NIS2, DORA, and the EU AI Act interlock to create a multifaceted operational imperative for cloud sovereignty that extends well beyond public-sector entities. This regulatory cascade compels businesses to rethink procurement strategies, as evidenced by Gartner's projection of sovereign cloud IaaS spending nearly tripling from $6.9 billion in 2025 to $23.1 billion by 2027, signaling a structural shift towards prioritizing sovereignty in cloud infrastructure investments.

The dominance of US hyperscalers introduces significant jurisdictional risks due to laws like the CLOUD Act, which can compel data disclosure regardless of physical location, rendering mere EU data hosting insufficient for true sovereignty. Alexandre Grellier highlights that the decisive factor in 2026 is the legal jurisdiction under which cloud platforms operate, not just server location, pushing European organizations to favor fully EU-owned and operated platforms that offer clearer legal certainty and mitigate foreign surveillance risks.

Digital sovereignty has evolved into a strategic priority reshaping dealmaking and operational workflows, with organizations needing to embed AI developed in-house on sovereign platforms to ensure compliance and resilience. Grellier emphasizes that adopting modern, sovereignty-aligned deal infrastructure is essential not only to meet 2026 regulatory demands but also to structurally prepare for the decade ahead, as investment decisions increasingly hinge on data jurisdiction, AI integration, and cloud sovereignty.

Despite growing awareness and substantial government and private investments—such as the UK government’s £1.1 billion commitment to sovereign AI infrastructure and Airbus’s €50 million tender for migrating mission-critical environments—many European businesses still lag in translating sovereignty aspirations into action. This gap between intent and implementation often leads to rushed, costly compliance-driven decisions under regulatory pressure, underscoring the need for organizations to urgently assess data residency, recovery capabilities, and infrastructure strategies that account for geopolitical, legal, and cyber risks in a world where infrastructure is as political as it is technical.