The Stakes of Digital Sovereignty

The push for greater cloud sovereignty isn’t merely a technical debate; it’s a fundamental question of economic and strategic independence. For years, European businesses have relied heavily on a handful of US-based cloud providers, creating a dependency that raises concerns about data security, regulatory compliance, and the potential for foreign influence. The EU aims to mitigate these risks by fostering a robust and independent European cloud ecosystem.

While the specifics of CAIDA are still under development, its core objectives are clear: to reduce the market share of US cloud giants and stimulate investment in European data center capacity. However, CISPE and its members argue that simply having a physical presence in Europe isn’t enough. True sovereignty requires genuine operational control and protection from external interference.

Defining True Cloud Sovereignty

The letter emphasizes that sovereignty must be defined by substantial European involvement, not just a geographical foothold. A data center located within the EU, but operated and controlled from the United States, doesn’t equate to genuine sovereignty. The coalition is advocating for stringent requirements ensuring that data is shielded from access by foreign governments or third parties, safeguarding sensitive information and upholding European privacy standards.

Beyond data protection, the letter calls for prioritizing European cloud providers in public sector procurement processes and recognizing the value of open-source software. Furthermore, it urges the EU to invest in critical cloud and AI infrastructure, including the development of key components like memory and chips, and to mandate strict environmental sustainability standards.

“It’s important to realize that the proposal is not just about the technical aspects but the non-technical ones as well — factors like territorial laws,” explains Axel Laniez, head of public affairs at Clever Cloud. “The legal framework surrounding data access and control is just as crucial as the physical infrastructure.”

However, the path to digital sovereignty isn’t without its challenges. Some European companies have voiced concerns that overly strict regulations could hinder their ability to compete and access essential cloud services. As Computerworld reports, a rapid shift away from established US suppliers could negatively impact profitability for some businesses.

CISPE’s efforts to promote a fairer cloud market have already yielded results. Last year, the organization secured concessions from Microsoft, paving the way for increased competition in Europe. This demonstrates the potential for collective action to influence the behavior of major players in the cloud industry.

Overcoming the Hyperscaler Advantage

Despite these gains, significant hurdles remain. Zbyněk Sopuch, CTO of Czech security company Safetica, points out that US hyperscalers currently control approximately two-thirds of the EU cloud market. “The gap is both economic and a real dependency risk,” he states. “I don’t think the most protectionist version of this legislation will pass. Any measure that significantly restricts market access would require broad alignment across EU member states on how far digital sovereignty should go — and that alignment is not there.”

Historically, public sector organizations have been hesitant to migrate away from established US cloud providers due to concerns about compatibility and disruption. However, Laniez believes this is changing. “There are now real options from Europe, and we’re already seeing public organizations thinking of switching.”

The call for public investment in AI represents a significant opportunity for Europe to catch up with the United States. While US companies currently lead in AI development, Laniez argues that Europe possesses advantages in ethical standards and data privacy, thanks to regulations like GDPR.

Sopuch anticipates a compromise solution, likely involving a framework that indirectly favors European providers through incentives, procurement preferences, and sovereignty requirements, rather than outright excluding US companies. While replacing the entrenched hyperscalers will be a long-term endeavor, the EU is determined to create a more balanced and resilient cloud landscape.

What role should open-source technology play in bolstering European cloud sovereignty? And how can the EU effectively balance the need for protectionism with the benefits of a globally interconnected cloud ecosystem?

Frequently Asked Questions About EU Cloud Sovereignty