The European Commission is preparing landmark legislation aimed at reducing the bloc's dependence on foreign technology, but European companies are warning that the proposed framework may fall short of delivering genuine digital sovereignty. The Cloud and AI Development Act, tentatively scheduled for release on May 27, is designed to define which sectors must rely on European cloud infrastructure to protect sensitive data and operations from foreign powers. However, industry figures argue that without a rigorous definition of what counts as truly sovereign, American technology giants will retain a significant foothold in Europe's most sensitive digital infrastructure.
The concern centres on how Brussels will draw the line between European and foreign technology. Early signals have not reassured European providers. Last month, the Commission awarded €180 million in contracts described as "sovereign" cloud solutions that included a partnership between France's Thales and Google. Critics were swift to respond, with European cloud lobby group CISPE describing the decision as an open door for American firms including Microsoft and Amazon. Sweden-based provider Evroc added that a definition broad enough to accommodate foreign software running on European infrastructure creates false assurance while leaving the underlying risks intact.
The Commission has developed an internal benchmarking tool that categorises digital services across four assurance levels, assessed against eight criteria including legal exposure to foreign authorities and the origin of components. Officials have indicated this framework may form the basis of the upcoming legislation. Meanwhile, France and Germany are working in parallel to develop common sovereign tech criteria, expected to be published in June, with both countries agreeing that the key question is not the nationality of the company but the degree to which added value and control remain within Europe.
The stakes are considerable. European governments are actively seeking to reduce their reliance on US products and services amid concerns that long-standing strategic dependencies could be leveraged by the Trump administration. At the same time, American tech lobby groups have raised objections to what they describe as a disproportionate emphasis on geography over capability and security in the Commission's scoring approach.
The legislation has already been delayed several times, and Commission officials have acknowledged it may not land in May as planned.
At DMX Associates, we are monitoring developments in European digital policy and their implications for technology, procurement, and investment strategy across the region. Stay up to date via our website and LinkedIn page.
