The European Commission unveiled a package of legislative proposals on Wednesday aimed at reducing the bloc's dependence on U.S. technology companies, including measures that could bar Amazon $AMZN, Google $GOOGL, and Microsoft $MSFT from cloud computing contracts covering sensitive government data.
At the heart of the package sits the Cloud and AI Development Act, which would sort cloud providers into four sovereignty tiers determined by the degree to which their operations — from services and supply chains to data handling and physical facilities — remain within E.U. jurisdiction. Under the act, public authorities would face obligations to keep sensitive information on cloud services owned by E.U. entities and to evaluate the sovereignty risks posed by any provider they use, the Commission said.
European Commission Executive Vice President Henna Virkkunen said it would be difficult for U.S. companies to reach the highest sovereignty tiers because of the U.S. Cloud Act. The U.S. Cloud Act presents a structural obstacle for American companies seeking top-tier sovereignty status, Virkkunen explained, because the law empowers U.S. law enforcement to compel American firms to hand over data stored on any server anywhere in the world, according to CNBC. "We want to make sure that our most critical sensitive data is stored in Europe," Virkkunen said.
Public procurement in strategically sensitive industries such as banking, energy, and healthcare would also be subject to new selection criteria beyond price, including stipulations favoring E.U.-developed software and hardware — conditions that would put American technology companies at a competitive disadvantage, according to Reuters. Amazon Web Services, Microsoft Azure, and Google Cloud together account for more than 70% of the E.U. cloud market, according to Bloomberg.
The act also aims to triple European data center capacity over the next five to seven years, the Commission said. Data centers built with European-manufactured chips or with reduced energy footprints would be eligible for priority grid connections and lower network fees under an expedited permitting pathway the Commission is proposing, according to Reuters.
Some U.S. companies have already moved to address sovereignty concerns. A joint cloud computing venture called S3NS, formed between Google and French electronics group Thales SA, was among four companies chosen by the Commission to supply cloud services to E.U. institutions, according to Bloomberg. Microsoft and Amazon have also launched sovereign cloud offerings in Europe.
The package also includes a revised Chips Act 2.0, intended to build European capacity in advanced semiconductor manufacturing for AI applications. Bringing European chipmaking back to a competitive level will require roughly €120 billion in combined public and private funding over the next decade, according to Commission projections cited by Bloomberg.
Commission President Ursula von der Leyen said in a statement: "We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure."
Before any of the measures become law, they face an extended gauntlet of negotiations involving both national governments across the bloc and the European Parliament — a ratification path that analysts expect to stretch over many months.