Twenty-four European cloud and digital service providers have signed a letter urging the European Commission to build genuine technological independence into its upcoming Cloud and AI Development Act, known as CADA, warning that vague definitions of sovereignty risk benefiting large foreign operators rather than local alternatives.
The letter, addressed to Executive Vice President for Tech Sovereignty Henna Virkkunen, comes from executives affiliated with CISPE, the trade association representing cloud infrastructure providers across Europe. Their central argument is straightforward: sovereignty cannot simply mean having a data center on European soil. It must mean actual control over technology, data, and protection from laws like the US CLOUD Act, which can legally compel American companies to hand over data stored anywhere in the world, including inside Europe.
The concern is not theoretical. Microsoft acknowledged in a French court last year that it could not fully guarantee data sovereignty for European customers in situations involving legally justified foreign injunctions. That admission sits uncomfortably alongside the sovereign cloud offerings that several US providers actively market across the continent.
CISPE is asking the Commission to address this through concrete measures. The group established three new requirements which mandate European providers to receive procurement shares when sensitive data needs protection and non-European contracts require large framework contracts which exclude small local businesses and government funds for cloud and AI projects must be spent on European supply chains. The association also calls for funding to develop local alternatives for critical components including processors and memory, alongside stronger environmental requirements for cloud infrastructure.
CISPE Secretary General Francisco Mingorance described CADA as a once-in-a-generation opportunity, cautioning that legitimizing what he called sovereignty-washing would deepen Europe’s reliance on overseas cloud giants rather than reduce it.
The challenge facing European providers is significant regardless of what legislation eventually passes. AWS, Microsoft Azure, and Google Cloud collectively hold around 70 percent of the cloud services market in the region, and analysts note that smaller rivals struggle to match the full-stack depth those three have built over more than a decade. Untangling existing European workloads from major US platforms could realistically take two decades, according to experts who spoke on the issue last year.
Political momentum has nonetheless shifted noticeably since early last year, with European appetite for reducing dependence on American technology infrastructure growing across both public and private sectors.
