The EU is right to put a lot of new effort into building stronger capabilities, resilience and operational control in the digital economy. In an age of artificial intelligence (AI) and a rapid deepening of the deep-tech economy, both competitiveness and security depend on developing autonomous capabilities with companies that can compete globally throughout the tech stack. The cloud stands at the centre of it. The problem, however, is that European policy is getting increasingly complex. Different policy initiatives compete against each other and work with concepts and ambitions that do not hang together.
The right approach is to develop a stronger sovereignty framework for European business. In recent years, there have been several new initiatives, such as the Data Act and developments under the Digital Markets Act (DMA), that have sought to give users more choice and control over the cloud services they procure. The ambition is tied to the fact that there is already great economic value for companies and countries that is generated by using cloud services. Now the role of these services is rapidly increasing as organisations improve their operations through AI.
It is important that European businesses have the choice and control they need – that they are sovereign to contract on their stack as they see fit. Business sovereignty is the fundamental core of every reasonable definition of technological sovereignty and it means freedom from both geographic isolation and commercial vendor lock-in. Organisations must have the architectural freedom to choose their preferred cloud infrastructure without facing artificial financial penalties or restrictive licensing from dominant legacy software providers.
However, now the ambition seems to be shifting. The Cloud and AI Development Act (CADA) has ushered in a different idea of what sovereignty means. While it builds on some old discussions, it contradicts what has been the core element of Europe’s external cloud policy since the European Cloud Partnership from 2014, which argued that “non-European cloud providers should be able to access the European cloud market on equal terms”. This approach reflected an understanding of political sovereignty grounded in the EU’s ability to set and enforce common rules, regardless of a provider’s geographical origin, and that access to frontier tech is a key aspect of business sovereignty.
Now the geographic origin is becoming front and centre in new policies. In CADA’s tiered levels of procurement openness based on sovereignty assurance requirements, the higher levels make ownership, geographical control and nationality the central feature for market access. Several developments can explain this shift, but the coarse definition of sovereignty seriously risks undermining the business sovereignty that other policies pursue. Choice and control will have to be sacrificed if the application of CADA leads to serious market exclusions for the most competitive suppliers of cloud services. Moreover, extending CADA to strategic private sectors would undermine the security and resilience that motivated CADA in the first place.
Regulating to Compete: The Contradiction in Europe’s Approach
Unfortunately, the need for Europe to build capability and security in cloud services routinely gets conflated with a desire to reduce competition – especially from the hyperscalers. Concerns about lacklustre digital innovation by Europe-headquartered companies have encouraged Brussels to rely increasingly on regulation to shape the market it wants to see evolving. But more regulation does not in and of itself generate better European competitiveness or more autonomous capabilities. This is especially the case now as the complexity of Europe’s cloud regulation frameworks has grown beyond control and added substantial regulatory burdens on both suppliers, producers and users – the very opposite of the simplification that European governments are asking for.
Brussels also appears to overlook the extent to which technological interdependence runs in both directions, including in some of the most sensitive areas of national security. Europe is not an innocent bystander but has agency to support outcomes that are beneficial for both the economy and security. While Europe remains dependent on some American technology providers, there is also a substantial dependence on EU tech in the United States – and there are substantial reciprocity risks if the EU intentionally cuts out US tech suppliers because of their headquarter geography. The US may then expose EU tech providers to the same type of restrictions.
For instance, US defence and homeland security agencies have long relied on European companies for mission-critical capabilities awarding contracts worth billions of dollars, including subcontracts across programmes and suppliers. Companies from France, Italy, Finland, Germany, Spain and other European countries continue to contribute to secure communications, threat screening, critical infrastructure protection and navigation systems, including underpinning the US military’s next-generation communication networks.
Europe’s exports to the US of critical technology and infrastructure are a core part of European policies for sovereignty, security and competitiveness. Mutual dependence establishes an economic basis for how various concerns could and should be managed. There will always be concerns, and they have clearly grown in recent years. But the structure of heavy two-way technology integration makes it possible for both sides to pursue policies, responding to the concerns that achieve the results without having to use sovereignty concepts based on ownership and nationality and that ultimately will lead both markets to block out each other.
Business Sovereignty: Managing Interdependence Rather Than Eliminating It
A key difference between the two sovereignty concepts – business sovereignty and geographic sovereignty – lies in the role of choice and the opportunity of individual businesses to contract their cloud and tech stack as they see fit. The task for the EU is to distinguish vulnerabilities that warrant intervention from the ordinary dependencies that characterise an interconnected digital economy. And the central priority here is business sovereignty: the capacity of businesses and other organisations to choose, secure, operate and adapt their digital services, manage interdependencies, and switch providers when necessary.
This is a functional understanding of sovereignty, in which control is assessed through the technical, operational and contractual controls and safeguards available to an organisation, rather than inferred from the geographical origin of its providers. Sovereignty, in this sense, lies in the ability to manage interdependence rather than eliminate it, preserving the freedom to choose technologies suited to organisations’ needs without giving up performance. This approach also supports the type of strategic autonomy that builds stronger capabilities without seeking to control a full stack.
Firms and organisations also have different types of needs. While some require the full suite of a Europe-based sovereign cloud or technology stack, others have different levels of needs for geographic sovereignty and can work with different arrangements. The problem is when new regulation in effect can mean that geographic sovereignty means less business sovereignty. It leads to a pretence of security and control – a false sovereignty.
For instance, restricting access to providers that can help detect and mitigate threats across interconnected networks risks weakening cybersecurity. Hence, geographical control may strengthen legal autonomy, but it would come at the expense of organisations’ ability to choose the technologies and safeguards that best protect their operations. Recent global IT outages show the peril of forcing monolithic structures upon the market, through geographical mandates of commercial licensing. Like many other organisations, we had to shut down our website amid the PHP programming flaws, illustrating the risk of relying on single vendors. The principal interest must reasonably be to allow freedom, choice, and the ability for users to design the security arrangement they need.
This distinction between business sovereignty and geographical sovereignty is also important in procurement and the new rules that CADA seeks to impose. Sovereignty standards in European procurement already encourage high levels of single-bidder tenders and very high levels of national supply, restricting opportunities for other EU suppliers. For public authorities, sovereignty is an objective of security, operational control, and resilience, allowing users and partners in Europe to have both agency and choice. The security that can be achieved always rests on whether users can manage the risks associated with the technologies they procure. Achieving these objectives requires assessing whether dependencies can be managed through verifiable technical, operational and contractual safeguards.
A functional approach allows government agencies to establish security requirements proportionate to the risks involved, while preserving competition among providers capable of meeting them. The openness is itself important for resilience, as greater supplier choice, technological diversity and alternative operating arrangements reduce reliance on a single source of supply.
While public authorities and private businesses face different obligations and risk profiles, both operate within interconnected technological ecosystems in which complete independence is neither attainable nor realistic. Business sovereignty focuses on how capabilities, performance, resilience and choice can be strengthened together. Policies like CADA, which reinforce the geographic model of sovereignty, also matter beyond the public sector. By influencing the technologies, operating models and contractual arrangements available in the market, procurement policies also shape the choices available to private organisations.
In Europe now, the cloud market allows for integrated partnerships between varieties of technology companies that collaborate to provide a customer with services that respond to its demand. Business sovereignty is therefore a better framework for an interconnected economy, especially since it enables dependencies to be managed according to actual risks. There are restrictions, which we will come to, but the principles should be clear: the starting point for sovereignty at the level of business and is essentially defined by architectural freedom of choice. The market already offers a range of solutions to meet organisations’ security, operational and commercial needs. Organisations can opt for standard cloud regions with customer-managed encryption, or partnerships in which European firms operate alongside foreign providers locally.
Business sovereignty is not a cure-all solution but requires organisations to understand and manage these trade-offs across the technology stack, while retaining the ability to choose the solutions they need. Table 1 illustrates the main dependencies at each layer, the safeguards businesses can use to manage them, and the extent to which switching to an EU-owned provider addresses these risks. It shows that many technological dependencies persist under the geographically defined approach to sovereignty with newer constraints emerging. Effective control depends on the technical and contractual arrangements available to organisations. Several of these safeguards can be verified rather than assumed: customer-held encryption keys and confidential computing with remote attestation can be checked cryptographically by the customer, while logged administrative access and contractually binding data residency can be confirmed through independent audit.
Table 1: Cloud dependencies by layer and the effect of EU ownership
Source: ECIPE elaboration.
Why Geography Is a Poor Proxy for Control
CADA extends ownership and jurisdictional criteria to cloud computing. Article 16 and Annex II introduce assurance levels based partly on geographical location, ownership and independence from third-country control, while Articles 29 and 30 connect these requirements to public procurement. Geographical location and ownership are being pushed as defining criteria for determining the assurance level a cloud service provider can attain.
However, as industry voices have argued, the idea of a sovereignty product makes little sense when business solutions combine technologies and services from many sources and across borders. Nor does nationality settle legal exposure. EU-headquartered providers operating internationally are subject to foreign legal compulsion too. For instance, in September 2025, the Ontario Court of Justice ordered the French cloud provider OVHcloud to disclose data stored in France. Legal exposure follows where data can be compelled and who controls it, and is better mitigated through customer-held encryption keys and binding commitments to challenge unlawful access requests than through ownership requirements.
The emergence of European neo-clouds illustrates a broader weakness in the geography-based conceptualisation of sovereignty. These firms can expand European computing capacity and compete with established foreign providers while relying on advanced AI chips and on software platforms and related technologies developed and maintained outside Europe. Their competitiveness depends on access to global supply chains, particularly where European alternatives are limited or unavailable. If any reliance on non-EU technology counts against a provider’s sovereignty credentials, the rules will penalise precisely the European firms that are adding new capacity and competing with incumbents.
Furthermore, the reliance on a geographical concept of sovereignty ignores how modern enterprises manage risks in practice. Specialised neo-clouds compete for compute-intensive workloads, while edge computing lets firms process data closer to where it is generated, reducing reliance on centralised infrastructure. Hybrid and multi-cloud setups allow organisations to spread existing and new workloads across providers without moving everything.
In fact, about 88 per cent of organisations surveyed in 2026 operated in hybrid or multi-cloud environments, and 81 per cent of those surveyed relied on two or more cloud providers for critical workloads. Organisations are already distributing workloads. Part of this shows that relying on one provider for existing workloads does not stop firms from turning to others for new ones. This means that an organisation can depend on an external technology provider and still retain meaningful control over its technological choices.
Business sovereignty also helps draw the line between two kinds of dependence that are often conflated: artificial restrictions such as egress fees or overly restrictive licensing terms, and dependence that results from a customer’s own technical choices. The first limits choice and opportunity; it generates substantial costs for users, estimated to be more than one billion euro annually. The other underlines contractual freedom. Because business sovereignty measures sovereignty by what the customer can do – switch, adapt, choose, secure, and operate – it identifies which restrictions matter. Moreover, it points to solutions that restore control without changing the architecture.
This is why CADA presents fundamental concerns. It has already been noted in the debate that CADA risks leading to over-selection and spillover. The first is that public authorities will end up selecting higher assurance levels than their particular risks require. The consequences of choosing a level that subsequently proves insufficient can become more visible than those of imposing requirements that exceed the risks involved. Public buyers can very likely hold the incentive to adopt more stringent requirements as a precaution, even where a lower level would be sufficient. The second concern is spillover, where requirements adopted in public procurement come to influence private-sector decisions, including where the same risks are not present.
But the fundamental concern is that a geographic limit on choice will most certainly impact negatively on the sovereignty of businesses and organisations to contract with multiple partners and distribute cloud-computing services across many suppliers. At the higher assurance levels in CADA, and in the ideas that some governments now purport to extend CADA to strategic private sectors, it is nigh on impossible to work with non-EU headquartered cloud suppliers. But how is a secure, competitive, distributed, flexible, and multi-supplier cloud environment going to work if some of the best global companies in the sector cannot participate?
These are live concerns. CADA (Recital 66) expressly recognises that public procurement requirements can influence the assurance levels adopted by private entities in regulated industries, with wider effects on the market over time. This could occur through several routes. First, Article 31(3) provides a potential legal route for extending the assessment framework to certain highly critical private-sector activities through delegated measures. Second, cloud providers seeking public contracts will need to ensure that software vendors, system integrators, and subcontractors involved in delivering their services can satisfy the relevant requirements. Third, providers serving both public and private customers will potentially find it more efficient to apply similar technical arrangements, supply-chain restrictions or contractual conditions across their services, rather than maintain separate offerings for different customers. Requirements introduced to address particular public-sector risks will likely influence the choices available to private businesses whose activities do not present the same risks.
These concerns become more significant when considered alongside initiatives proposed by national governments to extend the role of geographical preferences in public procurement. A French draft position paper calls for CADA’s public procurement preference mechanism to cover the entire digital sector, extending beyond innovative cloud and AI solutions and applying to contracting entities as well as contracting authorities.
It would build on Article 32 of CADA, which already requires contracting authorities to include “Union added value” criteria, such as software or hardware designed or manufactured in the Union, in the quality evaluation of tenders for innovative cloud and AI services. It links Europe’s digital lag to its productivity gap with the US and points to dependence on non-European technology providers. The paper proposes making market access conditional on transfers of skills and know-how, requiring non-European actors to anchor R&D, talent development and technological expertise in Europe.
The French proposal goes beyond determining the appropriate level of assurance for a particular service. It would also assess suppliers according to where they organise their activities and create economic value. The paper proposes giving EU value creation a minimum weight of 20 per cent in the procurement score, alongside a framework of metrics from which contracting authorities could select those most relevant to the particular contract. One metric would require at least 50 per cent of Tier-1 technological subcontracting expenditure to be carried out in Europe, with the subcontractor’s parent company headquarters located in the EU.
This illustrates how geography-based conceptualisations are being favoured, not only in the cloud sector but across the entire digital sector. The focus therefore shifts towards where suppliers are located and who owns them, extending beyond the regulation of individual services to shaping entire technology supply chains, according to geographical criteria.
Conclusions
Together, all these developments illustrate the weaknesses in a geographically defined approach to sovereignty and why business sovereignty is the reasonable approach for a Europe that builds stronger cloud and AI capabilities and improves its security and control.
First, businesses and other user organisations need choice and the freedom to contract their cloud environment as they see fit. Business sovereignty allows for distributed multi-supplier solutions, contracting flexibly with different parties on varieties of workloads and throughout the tech stack.
Second, the concept of business sovereignty encourages more and better autonomous European cloud capabilities because it motivates investment in Europe, including investment by non-EU headquartered companies.
Third, business sovereignty connects with other key EU policies, such as the Data Act, and does not disrupt the cloud policy framework that the EU gradually has built over the years.
For European procurement rules – in the form of CADA or other versions – it means that choice should be a central feature. The risk is that CADA exacerbates limitations in European cloud procurement that come from existing sovereignty standards and vendor lock-in through nationality or commercial practice. Cloud policy should be judged by whether it widens what European businesses and public entities can do to build effective cloud solutions that are resilient and flexible. If policy moves in the opposite direction, the paradox will continue: more control over cloud providers, ultimately means less choice for user that rely on them.