# Europe’s Cloud Sovereignty Policies Risk Market Fragmentation New procurement rules may inadvertently favor domestic providers over a unified European cloud market. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-19 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/e3c2a5a1-b726-4bd7-a7d7-f185b9441b2f ## Sovereignty Policy Paradox The European Centre for International Political Economy report analyzes 8,725 cloud contracts from 2018 to 2025. It reveals that the push for cloud sovereignty is driving member states to favor domestic providers. This trend actively undermines the development of a unified, competitive Europe-wide cloud services market for all member nations. ## National Procurement Concentration Data shows that European cloud procurement was already highly concentrated within national borders before sovereignty became a primary policy objective. The study found that every contract invoking sovereignty terminology was awarded to a domestic provider. This pattern effectively eliminates cross-border competition, reinforcing existing silos rather than fostering a broader European digital ecosystem. ## Infrastructure Dependency Reality Many domestic providers winning these contracts rely heavily on infrastructure managed by large hyperscale operators. Sovereignty is currently being attached to the nationality of the prime contractor rather than the underlying infrastructure layer. This creates a false sense of security, as the core technology remains dependent on non-European global cloud giants. ## Conceptual Policy Confusion The proposed Cloud and AI Development Act conflates two distinct objectives: security resilience and industrial protectionism. While security focuses on data control and risk management, the industrial objective seeks to shield European firms from global competition. This dual logic creates regulatory ambiguity, potentially leading to market fragmentation instead of genuine innovation. ## Assurance Levels and Restrictions The legislation introduces four assurance levels framed as security criteria. However, these requirements enforce sovereignty through mandates concerning EU-located infrastructure and software supply chain control. By restricting third-country involvement, the framework risks becoming a vehicle for protectionism that favors selected local providers while simultaneously limiting options for public sector buyers. ## The Risk of Market Lock-in ECIPE warns that these policies may lock in existing national biases, preventing the emergence of pan-European rivals to major US cloud providers. Instead of encouraging growth, the current framework risks solidifying a fragmented landscape. This outcome contradicts the original goal of building a robust, scalable, and truly integrated European cloud market. ## Redefining Sovereignty Metrics Experts suggest defining sovereignty as a demonstrated outcome rather than a simple ownership status. Real sovereignty should prioritize a buyer's ability to secure data and switch providers when necessary. A provider's passport or headquarters location does not inherently guarantee the technical resilience or portability that public sector organizations actually require. ## Calls for Technical Neutrality A more coherent approach would maintain resilience objectives while enforcing technological neutrality. This includes prioritizing interoperability, data portability, and multi-cloud options. CISPE has also urged for legislation that focuses on effective control over technology, rather than vague criteria that may inadvertently favor incumbents or create an illusion of sovereignty. ## Sources covering this story - https://www.theregister.com/off-prem/2026/10/19/europes-cloud-sovereignty-rules-could-do-more-harm-than-good/5303890 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._