EU technology sovereignty initiative limits US cloud services and introduces Chips Act 2.0.

      TL;DR: The European Commission has introduced a tech sovereignty initiative that limits US cloud companies from handling sensitive governmental data and launches Chips Act 2.0 to enhance semiconductor production in Europe. The Cloud and AI Development Act establishes four tiers of sovereignty for public cloud deployment.

      Earlier this year, after the Trump administration imposed sanctions on the top prosecutor of the International Criminal Court, Microsoft temporarily deactivated his email account. This brief bureaucratic incident was revealing for European lawmakers. If one American corporation could instantly sever communication for a senior international figure, what else might they be able to disrupt?

      On Wednesday, the European Commission provided an answer through new legislation. Its tech sovereignty package represents the most comprehensive effort to decrease the bloc's reliance on foreign technology, focusing on cloud computing, artificial intelligence, semiconductors, and open-source software.

      "We want to ensure that nobody has a kill switch," stated Commission Executive Vice-President Henna Virkkunen to CNBC.

      The cloud regulation

      The cornerstone of this initiative is the Cloud and AI Development Act (CADA), which sets forth an EU-wide framework that identifies four tiers of cloud "sovereignty." Public authorities must evaluate their dependency on non-EU companies and align their workloads with the relevant tier.

      This will have significant practical implications. At the highest tiers, providers are required to demonstrate ownership and control from within the EU, hire personnel who are EU nationals, and prove independence from legal jurisdictions of third countries. This last requirement directly challenges the US Cloud Act, which permits American authorities to request user data from US companies regardless of its storage location. For Amazon Web Services, Microsoft Azure, and Google Cloud, complying with these requirements would be challenging, if not unfeasible, given their current structures.

      The restrictions will apply to sensitive public-sector workloads in sectors such as healthcare, finance, and the judiciary, but private-sector cloud usage remains unaffected.

      The package also features a successor to the initial Chips Act, which took effect in 2023. Chips Act 2.0 shifts its focus from merely establishing fabrication plants to boosting demand for European-manufactured semiconductors and securing the design capabilities that are predominantly outside Europe.

      The Commission has stated it will "prioritize" establishing a semiconductor manufacturing foundry within the bloc. Reports suggest there are discussions around a €30 billion facility capable of producing semiconductors at the advanced 3nm node, with funding coming from the Commission, individual member states, and private companies.

      The updated strategy aims for a total investment of €120 billion by 2035. Achieving this figure will depend on the political commitment that has historically fluctuated regarding the long-term investments needed for semiconductor manufacturing.

      Tripling data center capacity

      CADA also establishes an infrastructure goal: to triple the EU’s data center capacity within five to seven years, aiming to fully support European businesses and public administrations by 2035. The Commission estimates that this will require around €200 billion in mostly private investments.

      To foster deployment, the Act will simplify permitting procedures and identify suitable locations for new facilities. The objective is to guarantee that European entities can execute AI workloads on European infrastructure, rather than routing them through US cloud data centers subject to US laws.

      A point of discussion is whether GPU-as-a-service setups and other intermediary forms will be regarded as genuinely sovereign, or if the Commission will necessitate complete European control over the hardware infrastructure.

      The disparity between aspiration and implementation

      Europe has previously announced digital sovereignty initiatives. The original Chips Act pledged €43 billion to expand the EU’s global semiconductor market share to 20% by 2030, a target now viewed by many analysts as unattainable. The €180 million sovereign cloud contract awarded earlier this year pales in comparison to the spending of US hyperscalers in a single quarter.

      What distinguishes this package is its regulatory enforcement. CADA does not just motivate the development of European alternatives; it imposes restrictions on using non-EU providers for specific categories of government data, creating compliance obligations that cannot be satisfied merely by hosting American cloud services in Europe. The sovereignty tiers necessitate structural independence, rather than simply data residency.

      The geopolitical rationale is quite clear. As the Commission frames it: “With increasing geopolitical fragmentation and the weaponization of supply chains, technological dependencies are turning into strategic vulnerabilities.” Whether Europe can develop the industrial capacity to correspond with that assertion remains the question it has been contemplating for a decade. However, this time, it has established a legal framework to pursue that goal.