The European Union is redefining its approach to digital sovereignty. The European Commission’s sovereignty package, presented in June, combines an open-source strategy with two legislative initiatives: the Chips Act 2 and the Cloud and AI Development Act, known as CADA.
CADA is intended to support the construction of data centres by simplifying approvals and investment. The Commission wants to triple the EU’s computing capacity by 2035, strengthening its position in cloud computing and artificial intelligence. However, the draft does not restrict who may build the data centres. Critics argue that this could reinforce the position of established US technology companies rather than create stronger alternatives in Europe. The legislation remains under negotiation between the member states and the European Parliament.
The EU has also been reconsidering its ambitions in advanced AI. AI gigafactories, announced in February 2025, were designed to provide the computing power needed to develop highly capable frontier models. But Jim Hagemann Snabe, the Commission’s special adviser for industrial AI, has argued that Europe should devote less effort to competing directly with the United States and China in the development of these models.
Commission President Ursula von der Leyen subsequently endorsed that direction. In her State of the Union address on 16 September, she said Europe needed its own computing capacity, particularly for national security, but did not necessarily need to develop the most advanced models itself. Instead, she argued that the EU should focus on applying AI in industry, the economy and society, using high-quality data to create customised industrial models.
Cloud services remain another central element of the sovereignty debate. According to a study for the European Parliament, AWS, Microsoft Azure and Google Cloud together control about 70 percent of the EU market, while European providers account for 13 percent. The Commission sees public procurement as a way to increase demand for European cloud services.
After developing eight sovereignty criteria for its own cloud-services tender, the Commission commissioned four consortia consisting mainly of European providers in April. CADA would establish a four-level classification for sovereign clouds, with requirements concerning issues such as data location and control of infrastructure. The lowest level would apply to less sensitive data, while the highest level would exclude providers from outside Europe altogether.
Nevertheless, US hyperscalers could potentially qualify for the third level through arrangements such as joint ventures or recognition of certain countries as trusted partners. The Commission estimates that the first three levels would cover 99 percent of public-sector cloud use cases. Member states and public authorities would still decide which level of sovereignty they require, meaning that the system’s impact will depend heavily on national procurement decisions and the outcome of the legislative negotiations.
The Commission is also preparing a separate regulatory step. In November, it is expected to designate AWS and Azure as gatekeepers under the Digital Markets Act. The Commission had already reached a preliminary view before the summer that both companies could meet the relevant criteria. European cloud providers hope the designation will improve competitive conditions, although it remains uncertain how effectively the DMA can regulate the cloud market.
Open source is another part of the EU’s sovereignty strategy. Thibaut Kleiner, a senior Commission official responsible for future networks and cloud computing, said Europe had few alternatives if it wanted to close the gap with other regions, given the cost of starting from scratch. He pointed to the existing European open-source ecosystem and the need for greater coordination to create a functioning single market.
The Commission’s open-source strategy was broadly welcomed by the community, particularly because it gives open source a formal role in the EU’s digital policy. The main criticism concerns its lack of binding requirements. Five countries—Germany, France, the Netherlands, Italy and Luxembourg—are participating in a European Digital Infrastructure Consortium focused on the importance of open source for digital sovereignty. Whether that position will be reflected in the final CADA rules remains unresolved.
Sources: netzpolitik.org.