EU Cloud Sovereignty: A New Order for US Hyperscalers?

The European Commission has taken a firm step towards digital autonomy with its technology sovereignty package, which includes the Cloud and AI Development Act (CADA). This initiative aims to reduce dependence on foreign cloud providers, especially US hyperscalers like AWS, Google, and Microsoft, which control around 70% of the European market. However, far from an immediate exclusion, the proposed framework opens a more nuanced competitive landscape, where sovereignty becomes a key factor but not a knockout criterion.

A Gradual Change with Structural Impact

Analysts agree that the immediate impact will be limited. Fernando Pereiro, research director at Gartner, notes that "the direction is correct, but execution will be slow." Scaling European alternatives requires time, capital, and coordination. Dario Maisto, senior analyst at Forrester, adds that full migrations are costly and take years, so a sudden shift is not expected. Instead, the creation of "sovereign enclaves" for sensitive workloads, especially in the public and regulated sectors, is anticipated. Outside these areas, the market will remain global but shaped by European rules.

CADA's Sovereignty Levels: An Opportunity for Hyperscalers?

CADA establishes four levels of assurance for public procurement. Level 1, focused on data localization, is easily achievable by hyperscalers. Level 2 introduces more controversial requirements regarding data access from third countries. Level 3 leaves room for US providers to participate through joint ventures with European companies, such as S3NS (Thales) with Google. Level 4, the strictest, requires full control over the supply chain and applies only to the 1% most sensitive workloads. According to the Commission, 70% of public sector workloads would fall under Level 1, 20% under Level 2, and only 9% would require Level 3.

Industry Reactions: Between Support and Caution

The CISPE association has welcomed the definitions of Levels 3 and 4 but criticizes Levels 1 and 2 as "confusing" and allowing hyperscalers to engage in "sovereignty washing." OVHcloud, a European provider, sees the package as a step in the right direction but calls for acceleration and avoidance of exceptions. Ionos, also European, laments that the approach is mainly supply-side and lacks a demand lever, such as preferential public procurement. "If EU funds end up in hyperscaler subsidiaries, the package will have failed," it warns.

The New Role of Hyperscalers

For US giants, the change is both symbolic and structural: they go from being the default option to one among many. Pereiro states that "sovereignty becomes a determining factor for sensitive workloads," creating friction for providers with centralized operating models outside the EU. However, those that adapt—investing in local infrastructure and meeting requirements—could see more opportunities. Google, AWS, and Microsoft have expressed support and willingness to collaborate, highlighting their investments in Europe and commitment to customer choice.

Implications for Businesses and IT Professionals

For organizations, CADA provides a clearer framework for assessing sovereignty risks, putting an end to "sovereign washing." Private companies, though not directly regulated, will benefit from clearer references and viable alternatives, especially through open source and emerging European providers. IT professionals must prepare for an environment where sovereignty will be a key criterion in procurement, similar to security or performance. In this context, secure data collaboration and proactive defense will be essential to meet new requirements.

In short, the EU is not closing the door on hyperscalers but redefining the rules of the game. Sovereignty is no longer a label but a tangible requirement. As Pereiro concludes: "If your offering aligns with sovereignty requirements, you will see more opportunities, not fewer."

---

Original source: ComputerWorld. Analysis and adaptation by ForgeNEX.