The European Union is contemplating regulations that would curb its member governments’ reliance on American cloud service providers for managing confidential information, according to sources privy to the discussions who shared details with Verum.

The European Commission, the EU’s executive arm, is slated to unveil its ‘Tech Sovereignty Package’ on May 27, introducing various initiatives designed to strengthen the bloc’s strategic independence in crucial digital domains.

As part of the preparations for this package, internal debates within the Commission focus on reducing the vulnerability of sensitive public-sector data to cloud platforms operated by entities outside the EU, two Commission officials, who requested anonymity due to restrictions on discussing private deliberations, informed Verum.

Amid escalating tensions with U.S. President Donald Trump’s administration, there have been increasing demands for Europe to shift away from U.S. cloud providers, which currently hold a dominant position in the European market, and instead embrace locally developed providers for its most essential operations.

‘The fundamental concept involves identifying sectors that must be hosted on European cloud infrastructure,’ one of the officials explained. They noted that cloud solution providers from third countries, including the U.S., might be affected.

Proposals would not completely ban overseas companies’ cloud platforms from government contracts but would restrict their use in processing sensitive data at public sector organizations, depending on the sensitivity level, they added. The officials clarified that discussions are ongoing and not yet finalized.

‘U.S. cloud providers could face limitations in certain sensitive and strategic sectors’ within EU member states’ public bodies due to the proposals, one official stated.

The officials told Verum there are discussions about requiring financial, judicial, and health data processed by governments and public-sector organizations to utilize high levels of sovereign cloud infrastructure.

The discussions do not pertain to private-sector companies, and the ‘Tech Sovereignty Package’ would not propose rules regarding their use of cloud platforms, one of the officials noted.

Once presented by the Commission, the package would require approval from all 27 member states. The ‘Tech Sovereignty Package’ will include the Cloud and AI Development Act (CADA) and the Chips Act 2.0, legislation aimed at promoting sovereign, homegrown solutions and products in both areas.

When asked for comment, a Commission spokesperson told Verum the package was ‘about Europe waking up and getting its act together.’

They added that it would ‘improve opportunities for sovereign cloud offerings, including through public procurement, and support the entry into the market of a more diverse set of cloud and AI service providers.’

Growing Calls to Diversify

EU member states’ public sector organizations can currently utilize cloud platforms provided by overseas companies — often U.S.-based due to the country’s dominance in the sector — to process highly sensitive data, including health and financial data, provided they comply with regulations.

However, scrutiny of this reliance has intensified as transatlantic relations have deteriorated in recent months. Under the 2018 Cloud Act, U.S. law enforcement can request user data from American companies, regardless of where the data is stored.

European governments told Verum in February they were exploring homegrown and open-source alternatives to U.S. tech platforms and increasing budgets for digital sovereignty.

France announced it would roll out Visio in January — a video conferencing tool developed by the government — which it said would be available to all state services by 2027, replacing U.S. tools like Microsoft Teams and Zoom.

The same month, the EU said it faced a ‘significant problem of dependence on non-EU countries in the digital sphere…potentially creating vulnerabilities, including in critical sectors.’

In April, the Commission awarded a 180 million euro tender to four European sovereign cloud projects to supply EU institutions and agencies, with one involving a partnership with a joint venture between French aerospace company Thales and Google Cloud.