In developments that are bringing EU digital sovereignty back into the spotlight, multiple EU institutions have launched initiatives aiming to bring the EU to the forefront of the technological stage. In this Law-Now, we provide an overview of the European Commission's and European Parliament’s digital-sovereignty initiatives and their potential impact on the digital landscape.
Cloud and AI Development Act initiative
The European Commission is reviving the topic of cloud sovereignty with the Cloud and AI Development Act to be proposed by EU Commissioner Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy in the European Commission. When enacted, this law would ensure that strategic EU use cases can rely on sovereign cloud solutions with the public sector playing a crucial role as an "anchor client" for these sovereign and sustainable cloud solutions. The Cloud and AI Development Act is an element of the AI Continent Action Plan, with which the EU Commission is aiming to boost AI development through increased funding in data centres and AI development.
This initiative by the European Commission will focus on research and innovation, deployment, and fast-tracking the construction of cloud infrastructure to triple the EU's data processing capacity by 2030. A recommendation on a common EU-wide cloud policy for public administration and public procurement will be introduced to promote consistent implementation.
The new approach on cloud sovereignty may give preferential access to European cloud service providers in public procurement procedures. The EU Commission also intends to facilitate access to capital for cloud service providers and offer incentives to make data centres sustainable. The construction of cloud infrastructure will be fast-tracked, potentially impacting the operations and market positioning of US cloud providers.
A public consultation on the Cloud and AI Development Act has been opened on April 9, 2025, and will close on June 4, 2025. Through this consultation, the EU Commission aims to collect stakeholders’ opinions on the EU’s capacity in cloud and edge computing infrastructure and the use of cloud services in the public sector. The EU commission will take this feedback into account while drafting the Cloud and AI Development proposal, which it aims to have ready by December 2025.
Draft report on EU Digital Sovereignty
The European Parliament’s Committee on Industry, Research, and Energy (ITRE) is currently working on a report on European technological sovereignty and digital infrastructure, which was authored by MEP Sarah Knafo, (member of the far-right French party Reconquête).
While committee reports in the European Parliament do not have legislative power, they can significantly influence the European Commission by highlighting issues and recommending actions, thereby increasing pressure on the Commission to take action.
The draft report on European technological sovereignty and digital infrastructure addresses the EU's dependence on foreign technologies and infrastructure. This dependence is seen as a significant risk to the EU's competitiveness, security, and strategic independence. The report highlights the urgent need for the EU to achieve technological sovereignty by enhancing its digital infrastructure and supporting European companies in key sectors such as cloud infrastructure, cybersecurity, AI, semiconductors, and communication networks.
Key issues
To illustrate the threats to an EU digital sovereignty, the report states that:
- 92% of the west's data are stored in the US, with US companies holding 69% of Europe's cloud market share compared to 13% by European companies. This exposes European data to US extraterritorial legislation, such as the US Foreign Intelligence Surveillance Act (FISA) and the US Clarifying Lawful Overseas Use of Data Act (Cloud Act).
- The EU's share in global AI investment (7%) is significantly lower than that of the US (40%) and China (32%).
- The EU produces only 10% of the world's semiconductors, making it vulnerable to supply disruptions.
- Fibre optic networks cover only 64% of EU households, and high-quality 5G network coverage extends to merely 50% of EU territory.
Recommendations
To address these issues, the draft report calls for the reform of European public procurement to allow EU Member States to restrict strategic procurement procedures to European companies that meet sovereignty criteria. The draft report also states that the European Cybersecurity Certification Scheme for Cloud Services (EUCS), which is still under discussion, provides insufficient guarantees on the hosting of sensitive European data. Therefore, the draft report recommends that EUCS certification for level ‘high’ should be aligned with the the French SecNumCloud certification requirements on data ‘immunity’ in relation to extraterritorial laws and corporate control laws. Furthermore, the report suggests facilitating the rollout of 5G by relaxing conditions on the concentration of firms to encourage infrastructure sharing. Finally, the authors of the report propose to modify the European Chips Act as to boost manufacturing by foreign companies in the EU and the acquisition of know-how, and to ensure technological independence.
To support private investment, the report recommends making it easier for European technology companies to access private financing and allowing life insurance and pension funds to invest in strategic and emerging sectors. The report also calls for a review of the legal framework of important projects of common European interest (IPCEIs) to include exemptions for strategic mergers and acquisitions. Additionally, the report proposes reducing the regulatory burden on European companies, suggesting that two regulations should be removed for each new regulation, a method that is comparable to the US ‘One-In, Two-Out’ model.
Next steps
The deadline for tabling amendments to the draft report was 20 March 2025. Following this, the draft report will be discussed and potentially revised based on the amendments submitted. The ITRE committee is scheduled to vote on the report on 25 June 2025. Once finalised and adopted, the report will likely guide future policies and regulations aimed at strengthening Europe's technological sovereignty and digital infrastructure.
Conclusion
Both the Cloud and AI Development Act soon to be proposed by the EU Commission and the draft report on EU digital sovereignty signal a significant shift towards prioritising European technological independence and security.
Businesses should prepare for potential changes in public procurement processes and increased support for European cloud service providers. By staying informed and adaptable, businesses can also leverage these digital sovereignty developments to enhance their market positioning and ensure compliance with new regulations.
For more information on these policy proposals, contact your CMS client partner or these CMS experts:
Social Media cookies collect information about you sharing information from our website via social media tools, or analytics to understand your browsing between social media tools or our Social Media campaigns and our own websites. We do this to optimise the mix of channels to provide you with our content. Details concerning the tools in use are in our Privacy Notice.