Brussels weighs blocking US cloud providers from sensitive EU government data ahead of May 27 Tech Sovereignty Package

The European Commission is considering rules that would restrict EU member governments from using US cloud providers to process sensitive data, sources told CNBC in a report published on May 7. The restrictions would apply to financial, judicial and health data processed by governments and public-sector organisations, and would form part of the Tech Sovereignty Package due to be presented on May 27.

That package, which has been telegraphed for months and now sits days from publication, will bundle two flagship bills. The Cloud and AI Development Act, known as CADA, is designed to give the EU a coherent framework for sovereign cloud and AI compute capacity. The Chips Act 2.0 will follow on from the 2023 chips legislation, with an expanded focus on advanced packaging and on tying public investment to strategic autonomy.

The cloud restrictions described to CNBC do not extend to private companies. A senior Commission official told the broadcaster the discussions are explicitly limited to public-sector use cases, and that the package will not propose rules about how private firms procure cloud capacity. That distinction matters. Hyperscaler revenue in Europe still flows overwhelmingly from private-sector workloads, and forcing every EU bank or hospital onto sovereign infrastructure would have created a fight that the Commission has shown no appetite for.

The underlying driver is the US Cloud Act of 2018, which gives American law enforcement the ability to compel US-headquartered companies to hand over user data regardless of where the data is physically stored. Successive European data-protection rulings, from Schrems II in 2020 to the more recent disputes over the EU-US Data Privacy Framework, have made clear that European public bodies cannot fully insulate themselves from extraterritorial US legal demands when they sit on AWS, Azure or Google Cloud. Brussels is now drawing a line at sensitive public-sector data and putting the legal weight of CADA behind it.

For European cloud providers the policy direction has been visible for months, and the procurement signal is already loud. In April the Commission awarded a €180 million tender to four European sovereign cloud projects to supply EU institutions and agencies. One of those involves a partnership with the Thales-Google Cloud joint venture, S3NS, which is structured to keep customer data, encryption keys and operations under French legal control even while drawing on Google technology. OVHcloud, Scaleway and IONOS have been positioning for years against this exact moment. Smaller specialists, from German operator StackIT to Belgium's Kamatera-style entrants, will be watching closely to see how the technical and certification thresholds are written.

The political reading is also worth flagging. CADA needs sign-off from all 27 member states once the Commission tables it, and the cloud question has fractured EU governments before. The Netherlands, Ireland and Sweden have historically been more open to US hyperscalers, while France and Germany have pushed hardest for sovereignty. Negotiations over the EUCS cybersecurity certification scheme, which has been blocked for more than a year over a "sovereignty requirement" for top-tier cloud workloads, give a preview of how messy the politics can get. The Commission appears to be trying a different tactic this time, building sovereignty into a new horizontal cloud law rather than fighting it case by case through certification standards.

The May 27 publication will not end the debate. It starts the legislative process and gives sovereign cloud providers a year or more of certainty about which way Brussels is leaning. For European public-sector buyers, who have spent the last decade migrating to US clouds because nothing else could compete on price or features, the message is that the migration is about to reverse for the most sensitive workloads. The question is whether European providers can scale fast enough to meet the demand they are about to be handed.