Some of Europe’s own defense officials are pushing back against a law meant to reduce Europe’s dependence on foreign cloud providers, and their reasoning cuts right to the heart of why sovereignty policy is harder to write than it sounds. According to the Financial Times, officials from several EU countries, including eastern and Nordic member states, worry that stricter sovereignty rules under the proposed Cloud and AI Development Act could cut their own military systems off from cloud infrastructure at Amazon, Microsoft, and Google.
The European Commission introduced CADA in June, covering data center capacity, public-sector cloud procurement, and the EU’s broader reliance on non-European cloud and AI providers. The proposal sets up a four-level sovereignty framework based on infrastructure location, operational control, ownership, and exposure to foreign jurisdictions, with stricter requirements kicking in at higher assurance levels. Under Article 29, member states would need to identify public-sector activities tied to national security, defense, border management, and law enforcement, and under Article 30, those activities would generally need to run on cloud services meeting Levels 2 through 4.
That’s where the friction starts. NATO‘s own January 2026 Digital Strategy calls for federated, multi-classification cloud infrastructure that member nations build around shared, interoperable systems, exactly the kind of setup that runs into trouble if individual countries lock themselves into strict national sovereignty tiers that clash with NATO’s own architecture requirements. Defense officials cited in the FT report specifically flagged interoperability with NATO systems as a concern, on top of worries about losing access to established hyperscaler capabilities.
The stakes aren’t abstract. NATO recently awarded Accenture a roughly €200 million contract to build a common cloud operating model for classified operations across the alliance, a system meant to support around 29,000 users running through 2033. The EU’s own Defence Fund has separately allocated €40 million toward military cloud services spanning land, air, maritime, cyber, and space domains, with specific requirements around self-healing infrastructure and NATO-aligned interoperability standards.
CADA doesn’t ban US providers outright, it allows exceptions when compliant alternatives aren’t available. But the Commission’s own impact assessment shows just how dependent Europe already is: AWS, Microsoft, and Google control roughly 70% of Europe’s cloud infrastructure market, while European providers’ combined share has fallen from 29% in 2017 to around 15% today. Closing that gap is exactly what CADA sets out to do, and defense officials are now the ones asking publicly whether it can happen without disrupting the systems they already rely on.
