EU cloud rules risk stifling cross-border competition, study warns
A report finds that sovereignty language in public contracts is driving purchases toward domestic firms rather than building a single European market.
Key points
- Every EU cloud contract using sovereignty terms went to a domestic provider, according to an ECIPE study.
- The European Centre for International Political Economy argues this approach confuses security goals with industrial protectionism.
- The proposed Cloud and AI Development Act may inadvertently reinforce national silos instead of fostering pan-European competition.
Public cloud procurement in Europe is failing to create a unified market because sovereignty rules are effectively locking out cross-border competition, a new report warns. The European Centre for International Political Economy (ECIPE) argues that member states are using data sovereignty as a justification to favor local vendors, which undermines the goal of a single digital market.
The study examined thousands of contracts across nine EU nations and found that every single agreement invoking sovereignty language was awarded to a provider based in the same country. This trend suggests that policy frameworks intended to secure European data are instead reinforcing national boundaries and preventing larger, more efficient cloud ecosystems from forming across borders.
What we know
The ECIPE analysis covered 8,725 cloud-related procurement contracts between 2018 and 2025, revealing that nearly all deals were domestic even before sovereignty became a primary policy focus. The report criticises the EU’s proposed Cloud and AI Development Act (CADA) for mixing two distinct concepts: security resilience and industrial policy. This conceptual blur allows governments to treat market protection as a security necessity, potentially stifling innovation and raising costs for public services.
Furthermore, the study notes that many of these domestic winners are actually prime contractors relying on infrastructure from major global hyperscale operators. In these cases, sovereignty is attached to the nationality of the service provider rather than the underlying technology layer. This arrangement creates an illusion of independence while still depending on foreign-controlled infrastructure, complicating the true meaning of sovereign cloud services.
Defender's checklist
- Review current cloud contracts to determine if sovereignty clauses are restricting vendor options unnecessarily.
- Verify whether domestic providers are using underlying infrastructure from non-European hyperscalers.
- Assess if security requirements can be met through technical controls rather than geographic restrictions.
- Monitor legislative updates to the Cloud and AI Development Act for changes in procurement rules.
The background in plain language
Cloud sovereignty refers to control over data and infrastructure, but the term is often used in two conflicting ways. One view treats it as a security measure, ensuring organisations can manage risks and choose providers freely. The other treats it as an industrial policy tool, aiming to protect local companies from foreign competition. When policymakers mix these goals, they may prioritise national champions over secure, resilient systems.
Teams usually need to distinguish between genuine security needs and market protectionism. Check whether your organisation’s cloud strategy aligns with technical resilience or political objectives. Understanding this difference helps avoid locking into inefficient or less secure domestic solutions that may still rely on global infrastructure.
What to do and how to stay safe: ECIPE
- Audit your cloud service agreements to identify any clauses that mandate domestic providers without clear security justification.
- Confirm the actual location and ownership of the underlying infrastructure used by your cloud provider, including any subcontractors.
- Evaluate whether your security and compliance requirements can be satisfied through encryption and access controls rather than geographic restrictions.
- Stay informed about updates to the Cloud and AI Development Act and how they might affect future procurement options.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What did the ECIPE study find about EU cloud contracts?
The study found that every cloud contract invoking sovereignty language in nine EU member states was awarded to a domestic provider rather than a cross-border competitor.
How does the report define the problem with the Cloud and AI Development Act?
The report states that the Act confusingly aims to achieve both security resilience and industrial policy objectives, leading to a conceptual confusion that favors national providers.
Are domestic cloud providers truly independent of global tech giants?
No, the report claims that many domestic winners are prime contractors relying on infrastructure provided by big hyperscale operators, meaning sovereignty attaches to the operator's nationality, not the infrastructure layer.
