Europe’s Cloud Sovereignty Policies Risk Market Fragmentation
New procurement rules may inadvertently favor domestic providers over a unified European cloud market.
1Sovereignty Policy Paradox
The European Centre for International Political Economy report analyzes 8,725 cloud contracts from 2018 to 2025. It reveals that the push for cloud sovereignty is driving member states to favor domestic providers. This trend actively undermines the development of a unified, competitive Europe-wide cloud services market for all member nations.
2National Procurement Concentration
Data shows that European cloud procurement was already highly concentrated within national borders before sovereignty became a primary policy objective. The study found that every contract invoking sovereignty terminology was awarded to a domestic provider. This pattern effectively eliminates cross-border competition, reinforcing existing silos rather than fostering a broader European digital ecosystem.
3Infrastructure Dependency Reality
Many domestic providers winning these contracts rely heavily on infrastructure managed by large hyperscale operators. Sovereignty is currently being attached to the nationality of the prime contractor rather than the underlying infrastructure layer. This creates a false sense of security, as the core technology remains dependent on non-European global cloud giants.
4Conceptual Policy Confusion
The proposed Cloud and AI Development Act conflates two distinct objectives: security resilience and industrial protectionism. While security focuses on data control and risk management, the industrial objective seeks to shield European firms from global competition. This dual logic creates regulatory ambiguity, potentially leading to market fragmentation instead of genuine innovation.
5Assurance Levels and Restrictions
The legislation introduces four assurance levels framed as security criteria. However, these requirements enforce sovereignty through mandates concerning EU-located infrastructure and software supply chain control. By restricting third-country involvement, the framework risks becoming a vehicle for protectionism that favors selected local providers while simultaneously limiting options for public sector buyers.
6The Risk of Market Lock-in
ECIPE warns that these policies may lock in existing national biases, preventing the emergence of pan-European rivals to major US cloud providers. Instead of encouraging growth, the current framework risks solidifying a fragmented landscape. This outcome contradicts the original goal of building a robust, scalable, and truly integrated European cloud market.
7Redefining Sovereignty Metrics
Experts suggest defining sovereignty as a demonstrated outcome rather than a simple ownership status. Real sovereignty should prioritize a buyer's ability to secure data and switch providers when necessary. A provider's passport or headquarters location does not inherently guarantee the technical resilience or portability that public sector organizations actually require.
8Calls for Technical Neutrality
A more coherent approach would maintain resilience objectives while enforcing technological neutrality. This includes prioritizing interoperability, data portability, and multi-cloud options. CISPE has also urged for legislation that focuses on effective control over technology, rather than vague criteria that may inadvertently favor incumbents or create an illusion of sovereignty.