The European Union is weighing new restrictions on the use of U.S.-based cloud providers for sensitive government data as Brussels intensifies efforts to strengthen Europe's control over critical digital infrastructure.
The discussions are taking place ahead of the European Commission's planned "Tech Sovereignty Package," expected to be unveiled on May 27. The package is set to include measures tied to cloud infrastructure, artificial intelligence and semiconductor production across the bloc.
European Commission officials familiar with the matter told CNBC that internal discussions include limiting the role of non-EU cloud providers in processing sensitive public-sector information. The proposals under consideration would not completely block overseas companies from government contracts, but could restrict their involvement in handling highly sensitive data.
Officials are reportedly discussing requirements for certain categories of government data, including health, judicial and financial records, to be hosted on sovereign European cloud infrastructure.
The move comes as European policymakers increasingly examine the bloc's dependence on American technology companies in critical sectors. U.S. cloud firms currently dominate large parts of Europe's cloud market, including infrastructure used by governments and public institutions.
Concerns around data sovereignty have intensified in Europe since the introduction of the U.S. CLOUD Act in 2018. The law allows American authorities to request access to data held by U.S.-based companies regardless of where the information is stored. Legal experts at CMS said the legislation has fueled debate over potential conflicts between American law enforcement powers and Europe's GDPR privacy protections.
The cloud sovereignty debate has gained additional momentum during a period of geopolitical strain between Europe and the United States, while Russia's war in Ukraine has accelerated broader European efforts to secure critical infrastructure and reduce external dependencies.
European governments have already started rolling out domestic alternatives to some U.S. technology services. France announced earlier this year that it plans to expand use of "Visio," a state-developed video conferencing platform intended for government agencies, according to reporting by CNBC.
The European Commission has also increased investment in sovereign cloud projects. In April, Brussels awarded a 180 million euro tender to four European cloud infrastructure initiatives designed to support EU institutions and agencies.
Across Europe, businesses and public institutions have been reassessing their reliance on American cloud providers. Technology publication The Register reported earlier this year that several European firms were under pressure to move sensitive workloads toward EU-based infrastructure amid rising concerns over jurisdiction, compliance and strategic autonomy.
The debate extends beyond governments. Analysts and technology groups have warned that Europe's dependence on foreign cloud providers could create vulnerabilities in sectors tied to finance, communications and public administration. Industry commentary published by Kubermatic noted that discussions around "digital sovereignty" have become increasingly central to Europe's technology strategy.
The European Commission has described the upcoming package as part of a broader effort to strengthen Europe's competitiveness and support sovereign technology providers inside the bloc. A Commission spokesperson told CNBC the initiative is intended to encourage a more diverse cloud and AI market within Europe.
Any final proposal would require approval from all 27 EU member states before becoming law.
