BRUSSELS – The European Commission unveiled what it called its most ambitious technology initiative in a decade on June 3, presenting a sweeping package of legislation and investment plans designed to reduce the bloc’s near-total reliance on American and Asian companies for cloud infrastructure, semiconductors and artificial intelligence. The announcements were framed not as protectionism but as strategic necessity: Europe depends on non-European providers for more than 80 percent of its key digital products, services and intellectual property, and the Commission has concluded that no amount of regulatory pressure can substitute for building indigenous capacity.
The package has four pillars. At its centre is a proposed Cloud and AI Development Act, or CADA, which would for the first time introduce formal sovereignty risk assessments into public procurement. Member states would be required to evaluate the jurisdictional exposure of their digital contracts before signing them – a direct reference to the US CLOUD Act, which gives American law enforcement the ability to compel US-based providers to hand over data stored anywhere in the world, including in Europe. Under CADA, cloud companies that fail a sovereignty assessment could be barred from the most sensitive government contracts, including defence, healthcare and critical infrastructure applications. The Act also creates a framework for large-scale European data centre development, establishing “acceleration zones” where permitting would be fast-tracked and energy supply guaranteed.
The second pillar is Chips Act 2.0, a revision of the 2023 semiconductor legislation that the Commission acknowledges fell short of its headline target of doubling Europe’s global chip market share to 20 percent by 2030. The revision goes considerably further than its predecessor: the Commission would gain emergency powers to intervene in chipmakers’ commercial decisions during a crisis, overriding existing supply agreements to prioritise EU-critical orders. It also commits to building at least one foundry for advanced semiconductor manufacturing – defined as chips at the cutting edge of the AI supply chain – within the bloc. As AI-related chips are projected to account for more than 70 percent of the global semiconductor market by 2030, the Commission argues that the original Act was overtaken by events before it was even implemented.
The third and fourth pillars are less contentious but carry longer-term implications. The EU Open Source Strategy places open-source software at the centre of the bloc’s digital infrastructure, explicitly promoting European alternatives to US-proprietary software in government systems and research institutions. The Strategic Roadmap for Digitalisation and AI in Energy addresses the intersection between the green transition and digital infrastructure – specifically the energy demands of AI compute, where European data centres already consume roughly 2.5 percent of EU electricity, a figure projected to rise sharply as AI workloads intensify.
The scale of investment required is not in dispute: the Commission’s own estimates put the bill at approximately €120 billion for semiconductors, €200 billion for data centres by 2036, €100 billion for cloud and AI infrastructure, and €2 billion for open-source over seven years. The annual energy investment gap alone is estimated at €400 billion. Brussels is betting heavily on private capital channelled through the proposed European Competitiveness Fund and the InvestAI initiative, which targets €200 billion in AI investment. Whether private markets will commit at that scale, and on what timeline, is the question the package does not answer.
Executive Vice-President Henna Virkkunen, who oversees the Tech Sovereignty portfolio, framed the package as a corrective to a structural dependency that predates the current geopolitical moment. Analysts had already been warning that Europe’s reliance on US hyperscalers and Asian hardware was compounding across the AI transition, with each successive AI infrastructure build further entrenching non-European providers. Virkkunen told reporters the Commission was aiming to ensure no cloud provider of critical workloads had a “kill switch” – an explicit reference to the threat of service withdrawal or data access under foreign legal compulsion that European governments have raised in private for years without acting on publicly.
The Commission’s timing is deliberate. The Trump administration has made US tech sector primacy an explicit trade policy objective, and Washington has signalled that EU regulations targeting American platforms – under the Digital Markets Act and Digital Services Act – could trigger retaliatory tariffs. Brussels is calculating that moving toward indigenous capacity simultaneously reduces vulnerability to both US regulatory retaliation and to the geopolitical risk of supply disruption. Germany has separately been pushing G7 partners on critical mineral dependency, and the Chips Act 2.0 addresses the semiconductor supply chain from the same defensive posture.
The tension within the package is unresolved and openly acknowledged by Commission officials. European sovereignty requirements, if applied rigidly to cloud procurement, would effectively exclude AWS, Microsoft Azure and Google Cloud from the most lucrative EU government contracts. Those companies currently control more than 70 percent of the European cloud market. Excluding them from sensitive workloads would either drive up costs substantially – European alternatives are less mature, less geographically distributed and more expensive – or force governments to accept degraded capability. Nicole Lemke of the Berlin thinktank Interface told Science|Business the Commission had not resolved the fundamental tension between sovereignty and competitiveness goals. Member states are themselves divided: several Nordic and Central European governments want strict EU-ownership requirements that would effectively shut non-EU companies out; others, primarily larger western European economies with significant US tech investment, want a softer “trusted partner” framework that would keep American hyperscalers in the market under enhanced surveillance conditions.
The two legislative proposals – CADA and Chips Act 2.0 – must pass through the European Parliament and require approval from all 27 member states before becoming law. That process typically takes two years and will subject both measures to significant amendment, particularly the public procurement exclusions and the emergency override powers for semiconductor supply. China’s aggressive industrial subsidy model, which the OECD has recently documented at scale, is also a reference point for the Commission’s urgency: Brussels is watching Beijing build out semiconductor and AI infrastructure at state-backed speed and asking whether European market mechanisms – even aided by regulatory preference – can produce the same result without the same concentration of state power. The package is the Commission’s answer that they can. The next two years of legislative negotiation will determine how much of that answer survives contact with political reality.
