Worries about Europe’s reliance on a handful of American tech giants took legislative shape this month, when the European Commission proposed the Cloud and AI Development Act on 2 July. The draft law places cloud sovereignty at the centre of the Union’s digital strategy, pairing an ambition to expand computing capacity with new rules on who can be trusted to run it.
The headline target is physical: triple the Union’s data-centre capacity within five to seven years, so European businesses and public administrations can meet surging demand for artificial intelligence by 2035. To get there, the proposal attacks the practical bottlenecks that slow data-centre construction — sluggish permitting, scarce suitable sites and, above all, access to affordable energy.
The urgency comes from a market that has tilted sharply abroad. The Commission reports that the share of Europe’s cloud market held by EU-based providers slid from roughly 29 percent in 2017 to around 15 percent by 2022, leaving critical infrastructure concentrated in a few non-European hands. Officials frame that dependence as both an economic weakness and a security exposure.
Its most consequential feature is a cloud sovereignty framework built around four graduated assurance levels. Each level ties security, resilience and control requirements to eligibility for public-sector contracts, so governments buying sensitive computing services would face stricter sovereignty tests the more critical the workload. The design nudges public money toward providers that can meet European standards, as the Commission’s own outline makes clear.
Reactions split along familiar lines. European cloud challengers welcomed a framework that could finally tilt procurement in their favour, while large incumbents warned that sovereignty labels risk fragmenting the single market and raising costs. Civil-society groups asked how the assurance levels would work in practice, and whether they would deliver genuine independence or merely relabel existing arrangements.
Energy sits awkwardly inside the plan. Tripling data-centre capacity means a steep rise in electricity demand at the very moment the Union is straining to decarbonise its grid, and analysts note the act says less about where that clean power will come from than about how fast the buildings can go up. Reconciling the digital and climate agendas will fall to the coming negotiations.
The proposal now heads to the European Parliament and member states, where the sovereignty provisions promise the sharpest fights. Legal commentators reviewing the draft in detail expect heavy lobbying over the assurance levels. However the text evolves, it signals that cloud sovereignty has moved from slogan to statute, and that Europe intends to treat computing power as strategic infrastructure.
