The Cloud and AI Development Act, unveiled by the European Commission in June 2026, would change how governments in the EU buy cloud services by adding a sovereignty test to public procurement. Executive Vice-President Henna Virkkunen presented it as part of a wider technology sovereignty package, and negotiations with member states and Parliament are the next step.
How the Cloud and AI Development Act works
The proposal asks public buyers to assess jurisdictional risk before signing digital contracts. Under the draft, providers would be sorted into four sovereignty tiers. Only European providers, or non-European ones that can demonstrate verified data localisation and legal ring-fencing, would qualify for the top two tiers.
The most sensitive tier covers critical government systems. According to reporting on the package, large US cloud providers such as Amazon Web Services, Microsoft Azure and Google Cloud would be barred from that tier. The aim is to reduce exposure to foreign laws that can compel a company to hand over data wherever it is stored, with the US CLOUD Act the most cited example.
Why EU cloud sovereignty is on the agenda
The figure driving the debate is dependence. Non-EU providers supply more than four-fifths of digital products, services and intellectual property used in the Union. That concentration worries officials because a dispute over trade or security could affect services that hospitals, tax offices and police forces rely on.
The timing is also political. The package follows this year’s tariff standoff with the United States, and the Commission has been careful not to appear to start a technology trade war. A tiered procurement test is a softer instrument than an outright ban, since it focuses on risk rather than nationality, but US providers will still read it as a barrier.
Open source and data centre capacity
The package does more than restrict suppliers. An Open Source Strategy would tie public funding of open-source software to EU governance standards, and the Commission sets a target of tripling EU data centre capacity over five to seven years. Both measures try to build supply, not only limit demand, which matters because a sovereignty rule is only workable if credible European options exist.
That is the central risk for the Cloud and AI Development Act. If European capacity grows more slowly than the rules require, public buyers may find themselves with few compliant providers, higher prices or delayed digital projects. Regulators will need transitional arrangements under the Cloud and AI Development Act to avoid forcing agencies to switch systems before alternatives are ready.
Who gains and who loses
European cloud firms and data centre operators stand to gain from a protected segment of the public market. Large US providers face a narrower route into the most sensitive contracts, although they can still compete for lower tiers if they accept stronger local controls. Public administrations carry the compliance burden, because they must document risk assessments for each contract.
Smaller member states may have the hardest task under the Cloud and AI Development Act. They often lack procurement specialists and rely on shared platforms, so common guidance and Commission support will decide whether the tiers work in practice or become a paper exercise.
What to watch in 2026 and 2027
Three questions will determine the outcome. First, how the final text defines verified data localisation and legal ring-fencing. Second, whether Parliament and the Council keep the exclusion of US hyperscalers from the highest tier. Third, whether funding for data centres arrives fast enough to give buyers real choice.
The Cloud and AI Development Act will be tested less by its legal wording than by delivery. If Europe builds capacity while it tightens procurement, the Act could anchor a more resilient digital market. If it tightens rules first and builds later, governments will bear the cost.
