EU takes aim at AWS, Azure and Google Cloud with new sovereignty package for AI and Cloud

The European Commission has presented the European Technological Sovereignty Package, a landmark set of legislative and strategic measures that marks a fundamental shift in how the bloc approaches its digital future. The package takes direct aim at Europe's reliance on non-European suppliers for core digital infrastructure, from semiconductors to cloud computing, and signals Brussels' most assertive push yet to compete in the global technology race.

The announcement comes at a moment of acute geopolitical tension. From cloud computing to AI platforms, Europe's overreliance on US tech giants has become an increasingly uncomfortable reality in the era of transactional trade politics from Washington.

According to Politico, the package was motivated in no small part by US President Donald Trump's use of Europe's dependence on American firms as a geopolitical lever, including the shutdown of Microsoft Office services to the International Criminal Court, which served as a sharp wake-up call for European policymakers.

Rather than picking an open fight with US digital giants, the Commission is instead playing a longer game: build up Europe's own players so they can eventually challenge their American and Asian counterparts on equal footing.

"We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure. This is about protecting our citizens, defending our interests and making our own choices. Europe has the talent, the research excellence, the industrial base and the Single Market. Together, we must turn these strengths into technological sovereignty," said Ursula von der Leyen, President of the European Commission.

The European Technological Sovereignty Package comprises four distinct measures: two legislative proposals calls the Chips Act 2.0 and the Cloud and AI Development Act (CADA), alongside an Open Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy.

According to the European Commission, these measures collectively support Europe's ambition "to become an AI continent, strengthen its digital autonomy and help build a more sustainable digital future."

The revised Chips Act departs significantly from its 2023 predecessor, which poured public subsidies into fabrication plants but fell short of its targets, a gap underlined when Intel scrapped plans for two mega-factories in Germany. The new act shifts the emphasis from building factories to building demand for European-made chips, prioritising next-generation semiconductor capacity specifically designed for AI workloads.

The Commission said it would prioritise establishing a foundry for advanced semiconductor manufacturing capabilities within the bloc, and plans to speed up permitting, deepen cooperation with like-minded partners, and introduce a new excellence label for Europe's semiconductor regions.

The centrepiece of the package is CADA, which introduces a single EU-wide sovereignty framework for cloud and AI services. The proposal aims to triple Europe's data centre capacity over the next five to seven years.

Its most significant provisions impose sovereignty requirements on cloud providers operating in sensitive sectors such as banking, energy, healthcare, and justice and the strictest restrictions target non-EU providers handling sensitive public-sector workloads.

The urgency behind CADA is stark. US providers AWS, Microsoft Azure, and Google Cloud currently account for around 70 per cent of Europe's cloud market. The US Cloud Act means American authorities can compel those providers to hand over data regardless of where it is physically stored, a vulnerability that has grown more acute as trust in Washington has eroded.

CADA also mandates sovereignty risk assessments for government procurement of cloud and AI services, evaluating risks related to foreign control, data access, and potential disruption.

The third pillar builds on Europe's existing strength as home to more than three million open-source developers. The strategy seeks to scale up European-built alternatives in cloud, AI, internet technologies, cybersecurity, and semiconductors.

It will encourage wider adoption of existing open-source solutions in both public and private sectors, support European organisations in contributing to open-source development, and strengthen the continent's open-source ecosystem.

The Commission said the strategy would also address the security and long-term maintenance of open-source software, increase Europe's footprint in global open-source governance, and promote digital skills across the bloc.

The fourth element applies the sovereignty framework to the energy sector, ensuring that the digital systems underpinning Europe's power grids - from smart grids to AI-driven energy management - are resilient and not dependent on potentially unreliable foreign suppliers.

The package carries significant implications for both European and non-European technology firms. For European companies, it represents a substantial opportunity: preferential public procurement, investment support, and a regulatory framework deliberately designed to favour homegrown alternatives.

For US hyperscalers and non-EU tech companies, the measures introduce new compliance obligations and potential market restrictions, particularly in sensitive sectors. The CADA's sovereignty risk assessments could effectively create a two-tier cloud market in Europe — one for sovereign, European-controlled providers, and another for foreign operators permitted only in lower-risk environments.

According to Politico, the Commission was careful to stress that it was not picking a fight with US digital giants, even as the package is clearly aimed at reducing the structural dependencies they benefit from. The publication characterised the approach as a long-game industrial strategy rather than a direct confrontation.

While the ambition of the package is sweeping, its path to implementation is lengthy. The legislative proposals — CADA and Chips Act 2.0 — must now pass through the European Parliament and receive approval from EU member states, a process that could take years before full enforcement becomes a reality.

The package nonetheless marks a decisive pivot in European policy: from a bloc known primarily as a technology regulator, the EU is now staking a claim as a technology builder. Whether Europe's talent, infrastructure, and political will can match its ambition — against US and Chinese rivals spending significantly more on AI and digital infrastructure — remains the defining question for the years ahead.