EU Considers Limits on US Cloud Use for Sensitive Data

The European Commission formally proposed its European Technological Sovereignty Package on June 3, 2026, after the announcement slipped from an originally reported May 27 target (European Commission press release; CNBC). The package bundles four measures: the Cloud and AI Development Act (CADA), Chips Act 2.0, an Open Source Strategy, and a Strategic Roadmap for Digitalisation and AI in Energy. CADA establishes four "Union assurance levels" of cloud sovereignty; any provider serving EU public-sector customers must meet at least the lowest level, while progressively higher levels impose stricter data-residency and foreign-control restrictions for more sensitive workloads (European Commission; digital-strategy.ec.europa.eu). Commission Executive Vice-President Henna Virkkunen told CNBC, "We want to be sure nobody has a kill switch."

Silicon Canals reports that CADA does not name or ban specific US companies, but the US CLOUD Act, which lets American authorities compel US-headquartered firms to hand over data regardless of where it is physically stored, makes it nearly impossible for Microsoft, AWS, and Google to satisfy the top assurance levels' independence-from-foreign-access requirements without structural changes such as fully independent EU subsidiaries. CADA is still a Commission proposal and requires approval from the European Parliament and Council before it becomes law. Earlier reporting from CNBC (May 7) and Politico had previewed the package before its formal unveiling; Politico quoted Thibaut Kleiner, the Commission's Director for Future Networks, warning Europe risked becoming a "technological colony" without domestic capacity, a sentiment consistent with the package Commission ultimately proposed.

The Commission frames the push around a capacity gap: the EU's share of the global cloud market has fallen from about 29% in 2017 to roughly 15% in 2022, according to Commission figures cited in coverage of the proposal. CADA requires member states to designate at least one "data centre acceleration zone" with streamlined permitting, capped at a 12-month permit-granting timeline, as part of a goal to triple the EU's data-center capacity within five to seven years. UK MP Chi Onwurah, who chairs the UK Science, Innovation and Technology Select Committee, separately raised concerns about government reliance on Microsoft, Amazon Web Services, and Palantir (ITSecurityNews), reflecting a wider debate not limited to the EU proposal itself.

Cloud architects and compliance teams serving EU public-sector customers should start mapping current infrastructure against the four assurance levels rather than waiting for final legislative text, since procurement requirements are likely to phase in as CADA moves through the Parliament and Council. Vendors should treat the CLOUD Act conflict as a design constraint, not a hypothetical: any EU-sovereignty claim that doesn't structurally sever US legal reach is unlikely to satisfy the higher assurance tiers.

• •CADA's progress through the European Parliament and Council, and whether the assurance-level thresholds change during negotiation.
• •Whether US hyperscalers propose structural workarounds, such as legally independent EU subsidiaries, to reach the top sovereignty tiers.
• •Member states' designation of data-centre acceleration zones and early progress toward the capacity-tripling target.
• •Which specific public-sector data categories (health, financial, judicial) get mapped to which assurance level in implementing guidance.