A report warns that Europe's cloud sovereignty rules are being used to favor selected national providers and could stifle pan-European cloud development.
Europe's drive for cloud sovereignty is leading member states to favor providers from their own countries, rather than building a Europe-wide cloud services market, according to a report critical of the EU's proposed Cloud and AI Development Act (CADA). A study by the European Centre for International Political Economy (ECIPE) examined public cloud contracts in nine EU member states and found that every contract invoking the new vocabulary around "sovereignty" went to a domestic provider rather than one based in another EU country.
The report says European cloud procurement was already highly concentrated at the national level before sovereignty became a key policy objective. Its analysis of 8,725 cloud-related procurement contracts awarded between 2018 and 2025 found that nearly all went to providers in the same country, with negligible cross-border competition within the EU. The report also claims that these domestic wins often go to prime contractors that rely on infrastructure supplied by the large hyperscale operators. In such cases, sovereignty attaches to the nationality of the operator, not to the infrastructure layer on which the service depends.
ECIPE argues that the debate suffers from a conceptual confusion, with cloud sovereignty being used to represent two different problems. The first treats sovereignty as a security and resilience objective, focused on securing data and managing risks. In this view, sovereignty means that the user has choices over the provider and design of their cloud services. The second treats sovereignty as an industrial policy objective, where it means Europe-headquartered firms becoming more successful by being shielded from competition with non-European providers. The report states that CADA combines both logics and, confusingly, aims to achieve both outcomes.
According to the report, the legislation frames the four European Union assurance levels as criteria for security, resilience and trustworthy cloud provision. In practice, however, the criteria aim to enforce sovereignty through requirements concerning EU-located infrastructure, restrictions on third-country control, and control over software supply chains. ECIPE warns that the goal of cloud sovereignty therefore risks becoming a vehicle for policies that favor selected providers, restrict competition and fragment digital markets.
Rather than allowing pan-European rivals to the large US cloud providers to grow, the framework may have the opposite effect by encouraging member states to favor providers within their own borders, leading to fragmentation across Europe. The report's authors argue that a more coherent approach would keep the resilience objectives but temper their use with technological neutrality requirements that preserve interoperability, portability and multi-cloud options. Among its policy recommendations, the report proposes defining sovereignty as a demonstrated outcome rather than an ownership status.
"Real sovereignty means a public buyer can show its data is secure and that it can switch provider if it has to. A provider's passport does not tell you that," said Fredrik Erixon, ECIPE Director and co-author of the study. "Europe's cloud market is already national in practice. CADA risks locking that in."
**Vague drafting**
Not everyone agrees. Earlier this year, the tech trade association CISPE (Cloud Infrastructure Service Providers in Europe) urged the European Commission to legislate for real tech sovereignty rather than "the illusion of it." CISPE argued that sovereignty must be defined by control, not by whether a provider merely has an EU presence. In its view, that means effective ownership of the underlying technology and protection from extraterritorial laws such as the US CLOUD Act, under which Washington can compel American technology companies, including the big cloud operators, to hand over any data they hold, including data stored overseas.
CISPE had previously warned that the European Commission's criteria for cloud sovereignty were drafted so vaguely that they would favor incumbents, meaning the large American operators that already dominate Europe's cloud market.