Europe’s pursuit of digital sovereignty threatens to limit competition in the cloud market. It also does little to reduce dependence on non-European technology.
This is according to a report by the Brussels-based think tank European Centre for International Political Economy (ECIPE), which analyzed 8,725 European government tenders for cloud services between 2018 and 2025.
The researchers describe a paradox regarding sovereignty. By awarding contracts to domestic suppliers, European governments are attempting to reduce their dependence on foreign technology. However, these suppliers regularly use infrastructure provided by American hyperscalers such as Microsoft, Amazon, and Google.
An analysis of tenders in nine EU member states shows that approximately 97 percent of contracts went to domestically registered providers. In tenders that explicitly referenced digital sovereignty, this percentage even rose to 100 percent. Notably, the share of tenders with only one bidder rose from 28 to 46 percent.
Different forms of sovereignty
According to ECIPE, a supplier’s European origin offers no guarantee that the data is actually secure. The researchers distinguish between functional sovereignty and industrial sovereignty. The former focuses on security, continuity, and control over data, while the latter examines suppliers’ origin and ownership structure.
“True sovereignty means that a public contracting authority can demonstrate that its data is secure and that it can switch suppliers if necessary. A provider’s nationality says nothing about that,” ECIPE Director Fredrik Erixon told The Register.
For this reason, the study explicitly questions the proposed European Cloud and AI Development Act (CADA). The legislation sets out four levels of security and safety. At the highest levels, it imposes requirements for a European presence, infrastructure, personnel, and control. This would exclude European cloud companies that collaborate with U.S. hyperscalers from government contracts.
The European trade association Cloud Infrastructure Service Providers in Europe (CISPE) previously advocated stricter digital sovereignty requirements, reports The Register. According to CISPE, the focus should instead be on actual control over the underlying technology.
The U.S. CLOUD Act plays a key role here. This law can compel U.S. technology companies to provide data to authorities, including data stored outside the United States.
ECIPE, by contrast, advocates a risk-based approach in which the strictest requirements apply only to critical applications. European certifications must also be valid in all member states. This is to prevent further fragmentation of the cloud market.