Review warns EU cloud rules favor local firms over cross-border competition

A recent analysis suggests that European Union efforts to secure cloud infrastructure are instead reinforcing national boundaries and limiting competition across member states. According to a report by the European Centre for International Political Economy, the push for cloud sovereignty is resulting in public contracts being awarded to providers based within the same country, rather than allowing firms from other EU nations to compete. This trend undermines the goal of creating a single, robust European market for cloud services.

In plain English

Cloud sovereignty is a policy concept intended to ensure that a nation or region maintains control over its digital infrastructure and data. In practice, however, the term is being applied in two conflicting ways that complicate procurement decisions. One interpretation focuses on security and resilience, aiming to give organizations choice and control over how their data is managed and protected. This approach prioritizes risk management and operational independence.

The second interpretation treats sovereignty as an industrial policy tool. Here, the goal shifts from security to economic protectionism, aiming to shield domestic companies from foreign competition. This perspective assumes that European firms will succeed better if they are not exposed to rivals from outside the region. The report argues that mixing these two distinct objectives creates confusion and leads to procurement outcomes that favor local incumbents regardless of technical merit or cross-border capability.

The background

The European Centre for International Political Economy examined public cloud contracts across nine EU member states. The study analyzed 8,725 cloud-related procurement contracts issued between 2018 and 2025. The data revealed that European cloud procurement was already highly concentrated at the national level before sovereignty became a central policy objective. Nearly all contracts were awarded to providers located in the same country, with negligible competition from other EU members.

When contracts explicitly invoked sovereignty requirements, every single one went to a domestic provider. The report notes that many of these domestic winners are prime contractors that actually rely on infrastructure from large hyperscale operators. In these cases, sovereignty is attached to the nationality of the service operator rather than the underlying infrastructure layer. This arrangement may not deliver the technical independence or security benefits that policymakers intend, while still excluding cross-border competitors.

What changes now

The findings cast doubt on the proposed Cloud and AI Development Act, which aims to regulate and develop cloud and AI services in the EU. The report states that the legislation includes both security and industrial policy logics, attempting to achieve both outcomes simultaneously. This dual approach may confuse procurement officials and reinforce existing national silos. If the act proceeds without clarifying these conflicting goals, it could stifle the development of a pan-European cloud services market.

The study suggests that the current trajectory favors selected national providers rather than building a competitive, Europe-wide ecosystem. Policymakers face a choice between using sovereignty as a security framework that allows for diverse provider choices, or as a protectionist measure that limits competition. The report implies that treating sovereignty as an industrial policy objective risks harming the broader digital economy by reducing market dynamism and innovation potential.

Key terms explained

Cloud sovereignty refers to the degree of control a government or organization has over its cloud infrastructure and data. Teams usually assess this by evaluating where data resides, who manages the infrastructure, and what legal jurisdictions apply. In procurement, organizations should check whether sovereignty requirements prioritize security outcomes, such as data encryption and access controls, or simply mandate domestic vendors. Clear definitions help avoid confusing technical security needs with economic protectionism. Understanding these distinctions allows buyers to select providers based on actual risk management capabilities rather than nationality alone.

Background: Data encryption

Data encryption transforms readable information into unreadable ciphertext using a mathematical algorithm and a secret key. Without the correct key, the data remains scrambled and useless to unauthorized parties. This process protects data at rest on drives and in transit over networks, though it offers no protection if an attacker gains access to the active key or the decrypted session.

Read the full guide: How Data Encryption Works: The Mechanics and Hidden Limits

What to do and how to stay safe: Cloud

• Review current cloud contracts to determine if sovereignty clauses restrict competition to domestic vendors without clear security benefits.
• Evaluate whether procurement requirements distinguish between data security controls and the nationality of the service provider.
• Monitor legislative developments regarding the Cloud and AI Development Act for changes that might impact cross-border service availability.
• Assess if domestic prime contractors rely on foreign infrastructure, which may reduce the actual sovereignty gains from local procurement.

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many contracts were analyzed in the study?

The study analyzed 8,725 cloud-related procurement contracts issued between 2018 and 2025 across nine EU member states.

Did any sovereignty-linked contracts go to non-domestic EU providers?

No, the report found that every contract invoking sovereignty vocabulary went to a domestic provider rather than one based in another EU country.

What is the Cloud and AI Development Act?

It is a proposed EU regulation that aims to achieve both security resilience and industrial policy objectives regarding cloud and AI services.