Brussels is considering rules that could push sensitive public-sector data away from US cloud giants and into European kit.
The European Commission is expected to present its “Tech Sovereignty Package” on 27 May. The package will include measures to strengthen the bloc’s strategic autonomy in key digital areas.
As part of the preparations, Commission officials are discussing limits on the exposure of sensitive public-sector data to non-EU cloud platforms.
Tensions with US President Donald Trump’s administration have sharpened calls for Europe to move away from US cloud providers. Those providers dominate the European market, leaving Brussels twitchy about critical workloads in foreign paws.
“The core idea is defining sectors that have to be hosted on European cloud capacity,” one of the officials said.
The official said cloud companies from third countries, including the US, could be affected. The proposals would not ban overseas cloud platforms from government contracts entirely.
Instead, they would limit their use for processing sensitive public-sector data, depending on how sensitive that data is.
The officials said the talks were still ongoing and had not been finalised.
“US cloud providers could face restrictions in certain sensitive and strategic sectors” within EU member states’ public bodies as a result of the proposals, one official said.
The officials said financial, judicial and health data handled by governments and public-sector organisations may need high levels of sovereign cloud infrastructure. The discussions do not cover private-sector companies.
One official said the “Tech Sovereignty Package” would not propose rules about private firms’ use of cloud platforms.
Once presented by the Commission, the package would need approval from all 27 member states. The “Tech Sovereignty Package” will include the Cloud and AI Development Act and the Chips Act 2.0. Both bills aim to encourage sovereign, homegrown products and services in cloud, AI, and chips.
Asked for comment, a Commission spokesperson said the package was “about Europe waking up and getting its act together.”
The spokesperson said it would “improve opportunities for sovereign cloud offerings, including through public procurement, and support the entry into the market of a more diverse set of cloud and AI service providers.”
EU member states’ public-sector organisations can currently use cloud platforms from overseas companies. Those providers are often US-based because the country dominates the sector. They can process highly sensitive data, including health and financial data, provided they comply with the rules.
However, scrutiny of that reliance has grown as transatlantic relations have turned distinctly grumpy. Under the 2018 Cloud Act, US law enforcement can request user data from American companies, regardless of where the data is stored.
European governments told CNBC in February they were exploring homegrown and open-source alternatives to US tech platforms. They were increasing budgets for digital sovereignty.
France said in January it would roll out Visio, a video conferencing tool developed by the government. It said Visio would be available to all state services by 2027, replacing US tools such as Microsoft Teams and Zoom.
The same month, the EU said it faced a “significant problem of dependence on non-EU countries in the digital sphere…potentially creating vulnerabilities, including in critical sectors.”
In April, the Commission awarded a €180 million tender to four European sovereign cloud projects. The projects will supply EU institutions and agencies.
One involves a joint venture between the French aerospace company Thales and Google Cloud.
