Europe unveils tech sovereignty package amid growing concerns over reliance on U.S. tech: 'We want to be sure nobody has a kill switch'

The European Commission has proposed a comprehensive set of regulations, including the Cloud and AI Development Act (CADA), aimed at establishing tech sovereignty and reducing dependence on foreign providers. These measures seek to secure critical infrastructure and sensitive public sector data by mandating specific levels of sovereignty for cloud services used within the bloc. For the cloud computing market, this represents a significant regulatory shift that could restrict the dominance of U.S. providers and force a restructuring of how data is stored and managed across Europe.

The proposed Cloud and AI Development Act (CADA) is designed to mitigate risks associated with the European Union's heavy reliance on third-country providers for cloud services. According to Commission President Ursula von der Leyen, the initiative is essential to ensure that technologies powering hospitals, energy grids, and secure services remain under European control. The framework will establish varying levels of sovereignty requirements for cloud computing, specifically targeting sensitive workloads within public organizations to prevent foreign entities from having a "kill switch" over critical infrastructure.

Executive Vice-President Henna Virkkunen highlighted that U.S. cloud providers may face significant hurdles in meeting the highest sovereignty tiers due to the U.S. Cloud Act. This American legislation allows U.S. law enforcement to request data from domestic companies regardless of its physical storage location, a conflict that the EU aims to resolve by ensuring the most sensitive data is stored and managed exclusively within Europe. Legal experts, such as Catherine di Lorenzo of A&O Shearman, noted that the new rules extend beyond simple data residency to include ownership structures, immunity from extraterritorial laws, operational control, and supply-chain transparency.

In addition to cloud-specific regulations, the package includes the Chips Act 2.0, which focuses on bolstering homegrown semiconductor manufacturing and design to support AI development. The Commission plans to prioritize the construction of an advanced semiconductor foundry within the bloc to address overdependence on foreign supply chains. While some analysts, like Keegan McBride of the Tony Blair Institute, view the package as a vital step for digital prosperity, they also warn that a strictly "Europe-first" approach could limit the continent's global competitiveness if it fails to export its technology to the wider world.