Study finds EU cloud sovereignty rules favor domestic providers over cross-border competition
An ECIPE report warns that Europe’s push for cloud sovereignty is fragmenting the market by directing contracts to national vendors rather than building a unified pan-European services sector.
Key points
- Analysis of 8,725 contracts shows nearly all cloud procurement stays within national borders.
- The proposed Cloud and AI Development Act mixes security goals with industrial protectionism.
- Domestic winners often rely on infrastructure from major global hyperscale operators.
A report by the European Centre for International Political Economy (ECIPE) states that Europe’s drive for cloud sovereignty is causing member states to favor providers from their own nations instead of developing a Europe-wide cloud services market. The study criticizes the EU’s proposed Cloud and AI Development Act (CADA) for enabling this fragmentation.
According to the ECIPE report, every public cloud contract in nine examined EU member states that invoked sovereignty language went to a domestic provider rather than one based in another EU country. This finding highlights a trend where sovereignty rhetoric is used to shield local vendors from cross-border competition within the bloc.
Market Fragmentation and Conceptual Confusion
The ECIPE analysis reviewed 8,725 cloud-related procurement contracts between 2018 and 2025 and found that European cloud procurement was already highly concentrated nationally before sovereignty became a key policy objective. Nearly all contracts went to providers in the same country, with negligible intra-EU cross-border competition observed during this period.
The report argues that the current approach suffers from a conceptual confusion regarding cloud sovereignty. It notes that the term is being used to represent two distinct problems simultaneously. One definition treats sovereignty as a security and resilience objective, focusing on securing data and managing risks by giving users choices over provider and service design.
The second definition treats sovereignty as an industrial policy objective. In this view, sovereignty is about ensuring Europe-headquartered firms become more successful by limiting their exposure to competition from non-European providers. The report states that CADA confusingly aims to achieve both of these different outcomes within the same legislative framework.
Infrastructure Dependencies and Policy Implications
The ECIPE report claims that domestic wins in these procurement processes often involve prime contractors that rely on infrastructure provided by big hyperscale operators. This creates a situation where sovereignty attaches to the nationality of the operator rather than the underlying infrastructure layer on which the service depends.
This reliance on global infrastructure challenges the notion that selecting a domestic provider ensures true technical sovereignty. The report suggests that using sovereignty to favor selected national providers could stifle the development of pan-European clouds. It warns that this approach may do more harm than good by preventing the emergence of a competitive, unified market.
What should you do?
Security and technology professionals should monitor legislative developments regarding the Cloud and AI Development Act to understand how procurement rules may evolve. Organizations should assess their current cloud contracts to determine if they rely on domestic operators who use global hyperscale infrastructure. Reviewing vendor supply chains can help clarify the actual level of control and data governance provided.
What to do and how to stay safe: Cloud and AI Development Act
- Review cloud procurement policies to ensure they distinguish between security requirements and industrial policy goals.
- Audit vendor supply chains to identify reliance on global hyperscale infrastructure behind domestic service providers.
- Monitor updates to the Cloud and AI Development Act for changes in sovereignty definitions and compliance requirements.
- Evaluate cross-border data transfer mechanisms to maintain resilience without relying solely on national providers.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many contracts did the ECIPE report analyze?
The report analyzed 8,725 cloud-related procurement contracts between 2018 and 2025 across nine EU member states.
What are the two definitions of sovereignty identified in the report?
The report identifies sovereignty as either a security objective for data protection and user choice, or an industrial policy objective to protect European firms from competition.
Does the report say domestic providers use their own infrastructure?
No, the report claims domestic winners often rely on infrastructure provided by big hyperscale operators, meaning sovereignty attaches to the operator's nationality.
