EU technology sovereignty initiative: emergency measures for chips and restrictions on US cloud services.

      The European Commission's narrative regarding an "AI continent" is framed within draft legislation that would enable it to override chip supply contracts and bar US providers from accessing sensitive government data. On Wednesday, the Commission presented its much-anticipated technological sovereignty package, comprising four initiatives aimed at reducing the bloc’s reliance on American and Asian technology in areas such as semiconductors, cloud services, artificial intelligence, and open source.

      In its own summary, the Commission expressed a sense of ambition, outlining a path towards what it envisions as an "AI continent." However, the draft documents suggest a more defensive stance aimed at regaining control.

      Two of the four proposals are particularly significant. The first is a revised Chips Act, identified as Chips Act 2.0, which shifts focus from constructing factories to increasing the demand for chips manufactured in Europe. The original legislation from 2023, which provided public subsidies for manufacturing plants, did not meet its goals, a failure emphasized by Intel’s cancellation of plans for two large factories in Germany.

      The revised act extends emergency powers: as per a draft reviewed by the Financial Times, the Commission could require chipmakers to prioritize orders for essential products during shortages, cancel existing contracts, purchase chips centrally for member states, and impose fines up to €300,000 on companies that fail to disclose their supply chain capabilities.

      The urgency of the situation is clear, as the EU currently produces less than 10 percent of the world's semiconductors and relies heavily on the US and Asia for the most advanced chips essential for training AI models. Over €52 billion in public and private funding has been pledged, but progress has been limited.

      A crucial element is the proposed Cloud and AI Development Act, which would establish a unified EU framework defining four levels of cloud "sovereignty." Public authorities would need to conduct risk assessments relating to their reliance on non-EU firms, with the tiers based on factors such as control of the service and supply chain, data processing for AI inference, infrastructure location, and cybersecurity.

      The expected outcome of the current drafts would prevent member states from using US cloud providers for processing sensitive public-sector data in healthcare, finance, and judicial matters, while private-sector use would remain unaffected. Henna Virkkunen, the Commission's vice-president for tech sovereignty, explained that the intention is to prevent providers of critical workloads from having a “kill switch” over European data. She mentioned that US companies might find it challenging to achieve the highest sovereignty level due to the US CLOUD Act, which can require them to release data regardless of its storage location.

      Commission President Ursula von der Leyen stated more bluntly that the bloc cannot rely on others for the vital technologies necessary for operating hospitals and stabilizing energy grids.

      The other two initiatives are less stringent: one proposes an open-source strategy to support European alternatives and encourage public administrations to adopt open-source tools, while the other outlines a roadmap for digitalization and AI integration in the energy sector. This package builds on the Draghi competitiveness report, which highlighted the EU's dependence on non-EU suppliers for over 80 percent of its digital products, services, and infrastructure.

      The next steps will hinge on political negotiations as much as on further drafting. The proposals require the approval of all 27 member states, which are currently divided: France and Germany advocate for a stricter European-preference policy, whereas the Nordics and Ireland, home to many US cloud operations, favor a more lenient approach.

      Additionally, this package introduces the EU's first formal legal definition of "digital sovereignty," a term that Brussels has referenced for years without specificity. Whether these initiatives will lead to meaningful progress remains an open question. Previous efforts, including the 2023 Chips Act and the bloc's stalled AI gigafactory initiative along with sovereign cloud contracts, set ambitious goals that have yet to be fulfilled.