EU unveils $139B tech sovereignty plan targeting US cloud dominance

The European Commission on Wednesday proposed rules that would restrict US cloud providers from handling sensitive government data, targeting a market where Amazon, Microsoft and Google control more than 70% of spending.

"We want to make sure that our most critical sensitive data is stored in Europe," European Commission Executive Vice-President Henna Virkkunen, who oversees tech sovereignty, told reporters in Brussels.

The Cloud and AI Development Act, or CADA, creates a four-tier sovereignty classification for cloud providers. US companies face structural barriers to reaching the highest tiers because the US CLOUD Act allows American law enforcement to access data held by US firms regardless of where it is stored, Virkkunen said. The legislation also mandates that member governments store critical data on EU-owned cloud infrastructure.

The package, which also includes a Chips Act 2.0 requiring an estimated €120 billion ($139 billion) in public and private investment by 2035, represents the bloc's most aggressive attempt to reduce dependence on foreign technology. The proposals still require approval from the European Parliament and the Council of the European Union, a process that could take months.

Cloud Sovereignty Creates a Four-Tier Barrier

Under CADA, cloud providers must undergo mandatory sovereignty risk assessments evaluating whether their supply chain, data processing and physical infrastructure fall under EU control. The four-tier system effectively creates a compliance ladder that US hyperscalers cannot fully climb due to the CLOUD Act's extraterritorial reach.

Some American companies have already moved to adapt. Google formed a joint venture with French electronics giant Thales SA called S3NS, which was recently selected as one of four providers approved to serve EU institutions. Microsoft and Amazon have also launched "sovereign cloud" offerings in Europe. But Catherine di Lorenzo, partner at law firm A&O Shearman, called CADA a "significant shift" whose requirements "go well beyond data residency and include ownership structures, immunity from extraterritorial laws, operational control, and supply-chain transparency."

Chips Act 2.0 Targets €120 Billion Semiconductor Gap

The companion Chips Act 2.0 upgrades the bloc's 2023 semiconductor strategy, which EU auditors had already flagged as unlikely to meet its target of doubling the EU's global chip market share by 2030. The new version allows the European Commission to directly invest in cross-border semiconductor projects, bypassing the need for companies to seek subsidies from individual member states.

The Commission said it would prioritize building an advanced semiconductor foundry within the EU to support AI computing demand. Total investment needed to revive the EU's chip sector by 2035 is estimated at €120 billion, combining public funds and private capital. Funding through existing programs runs through 2028, after which the next EU budget will determine continued support.

For US hyperscalers, the stakes are substantial. AWS, Azure and Google Cloud generated an estimated $50 billion-plus in combined European cloud revenue in 2025, according to Synergy Research Group data. CADA's sovereignty tiers threaten to wall off the fastest-growing segment — government and regulated-industry workloads — which typically command premium pricing. European providers such as OVHcloud, Deutsche Telekom's T-Systems and the S3NS joint venture stand to gain market share, though none currently have the scale to fully replace the US trio. For semiconductor investors, ASML, Infineon and STMicroelectronics are the primary beneficiaries of the €120 billion Chips Act 2.0, though the payoff remains years away — the Commission itself said significant effects won't materialize until 2030.

This article is for informational purposes only and does not constitute investment advice.