The Sovereignty Paradox
Europe’s ambitious drive toward digital sovereignty—the quest to reduce reliance on foreign tech giants and build a robust, local cloud ecosystem—is facing a harsh reality check. According to a recent study by the European Centre for International Political Economy (ECIPE), the legislative framework known as the Cloud and AI Development Act (CADA) is showing signs of doing more harm than good. Rather than fostering a dynamic, pan-European cloud market, these policies appear to be encouraging individual member states to retreat into national silos, favoring local providers over broader regional competition.
The ECIPE report analyzed thousands of public cloud procurement contracts spanning from 2018 to 2025. The data reveals a troubling trend: the implementation of "sovereignty" requirements has almost exclusively resulted in contracts being awarded to domestic companies. This pattern of national protectionism is effectively stifling the cross-border competition necessary to build a truly integrated European cloud sector capable of challenging established global incumbents.
The Conceptual Muddle
At the core of the issue lies a fundamental confusion regarding what "sovereignty" actually entails. The ECIPE report identifies two competing, often contradictory, definitions currently dominating the policy conversation. The first definition focuses on security and resilience, emphasizing that users should have control over their data, architectural choices, and the ability to switch providers easily. This is an objective-based approach to digital safety.
The second, more controversial definition views sovereignty as an industrial policy tool. In this view, sovereignty is equated with the success of European-headquartered firms, often through state-backed preference. By conflating these two goals, CADA creates a confusing regulatory environment. The legislation attempts to enforce security through requirements like EU-located infrastructure and restricted third-country control, but these criteria often act as barriers that prevent the scaling of genuine, pan-European alternatives. Ultimately, the report argues that current policies are locking in national fragmentation rather than creating the unified digital landscape Europe claims to want.
Why it Matters
- Market Fragmentation: Instead of creating a single EU market, national procurement habits are solidifying regional monopolies.
- The "Passpost" Problem: Experts warn that a provider’s nationality does not inherently guarantee data security or technical resilience.
- Economic Impact: Critics have warned that heavy-handed efforts to exclude US giants could cost the European economy up to €115 billion.
- Interoperability Risk: By focusing on ownership status rather than technical outcomes, the current framework risks ignoring essential features like portability and multi-cloud compatibility.
A Path Toward True Resilience
To move forward, the report suggests a pivot toward "technological neutrality." This means defining sovereignty not by the passport of the service provider, but by demonstrated outcomes. Real sovereignty should be measured by the ability of a public sector entity to secure its data, maintain control over the software supply chain, and retain the flexibility to switch providers if service requirements change. By prioritizing interoperability and open standards, the EU could create a market that is genuinely resilient to foreign pressure without sacrificing the innovation that comes from healthy competition.
As the debate continues, the tension between tech trade associations like CISPE—which demand protection from the US CLOUD Act—and those advocating for a more open, competitive market remains high. Whether the EU will refine CADA to avoid further fragmenting its digital future or continue down a path of national protectionism remains a critical question for Europe's tech trajectory.
