24 March 2026

The European Internet Forum convened policymakers and industry representatives to examine Europe's growing dependence on non-European cloud providers and the policy tools available to address it. The debate centred on the forthcoming Cloud and AI Development Act and covered three interconnected challenges: expanding data centre capacity, establishing a credible definition of cloud sovereignty, and determining the appropriate role of European providers in public procurement. Participants shared a broad concern about the pace of investment relative to Europe's digital ambitions, while holding different views on how far procurement preferences should go.

Building a sovereign EU cloud ecosystem

Opening Remarks

Pilar del Castillo MEP opened the debate by noting the structural gap between Europe's computational capacity and its digital ambitions, a concern already flagged in recent analyses of European competitiveness. She identified three concrete obstacles holding back progress: constrained access to energy and water resources, fragmented and slow permitting processes that can take up to nine years for data centre projects, and an insufficiently integrated single market for cloud services. On permitting, she stressed that fragmentation often emerges not in the rules themselves but in their implementation across member states. MEP del Castiilo called for the Cloud and AI Development Act to provide targeted solutions in each of these areas, and argued for continued cooperation with non-European providers alongside stronger European alternatives.

The Commission's Perspective

Thibaut Kleiner, Director for Future Networks at DG CONNECT, confirmed that the Commission's forthcoming proposal has broadened in scope beyond cloud and AI infrastructure to become a wider technology sovereignty package covering chips, open source software and energy for the digital sector. He framed the stakes in concrete terms: Europe currently imports an estimated €286 billion a year in cloud services, exceeding the entire EU annual budget, while European providers account for only 15% of the EU cloud market in a sector growing at 15% a year. The proposal pursues two primary objectives: attracting the investment needed to at least triple Europe's data centre capacity, estimated at over €200 billion, and reducing technological dependencies by creating a clear legal definition of sovereign cloud services and introducing incentives for the public sector to prioritise European offers in sensitive sectors. Kleiner acknowledged the intensity of the current debate, noting two opposing arguments being made: that European providers lack the capability to substitute for global hyperscalers, and that switching to them would be prohibitively expensive. He indicated the Commission intends to be firm enough to signal that European providers deserve a genuine chance, without imposing requirements that are technically unreasonable.

Industry views

Aude Le Tellier, representing Thales, described the experience of building S3NS, a company established five years ago as a joint venture that operates a Google Cloud region under full Thales control, with no Google access to client data, an exclusively European workforce, and immunity from extraterritorial legislation such as the US Cloud Act. She held this up as a model demonstrating that combining hyperscaler technology with European security governance is technically and commercially viable. On policy, Le Tellier argued that the absence of an EU-wide definition of sovereign cloud is the single most significant inhibitor to adoption, stalling both cloud and AI uptake for sensitive use cases and imposing disproportionate compliance complexity on SMEs and startups trying to operate across borders. She called for immunity from third-country interference to be embedded as a core specification in public procurement, for joint procurement mechanisms to help European players achieve scale, and for the Commission to consider mandating sovereign cloud for sensitive sectors such as critical infrastructure and defence.

Mikkel Brun Naesager of CISPE, the association of European cloud infrastructure service providers, argued that it matters not only how much capacity Europe builds but who builds it. He introduced the forthcoming CISPE Sovereignty and Resilience Framework, which draws a deliberate distinction between two categories: sovereign services, where no foreign power holds legal or technical ability to access or shut down the infrastructure, and resilient services, designed for contexts where full sovereignty is not yet achievable, ensuring operational continuity and portability in the event of disruption. He used the analogy of car safety ratings to make the point that Europe should evaluate cloud services not on their convenience but on how they perform under stress. Naesager was direct in rejecting the argument that European providers are not capable of competing, and called on policymakers to ensure the forthcoming Act does not inadvertently enable sovereignty-washing by non-European providers claiming compliance with standards they do not genuinely meet.

Guido Lobrano of ITI, the global technology industry association, offered a different framing. He argued that industrial policy goals and security objectives, while related, are distinct and should be pursued through distinct instruments. For ITI, sovereignty should be understood as the capacity to choose, innovate and rely on trusted and secure solutions regardless of provider origin, assessed through objective, risk-based criteria covering security, transparency and governance rather than nationality or headquarters location. He supported positive measures such as permitting simplification, grid modernisation and harmonisation across member states as the most effective levers for building capacity. On procurement, he warned that excluding providers on geographical grounds would raise costs, slow AI adoption and, by limiting access to state-of-the-art cybersecurity tools, paradoxically make Europe less secure. His three recommendations for the Act were: preserve choice in cloud offerings, encourage collaboration with trusted providers based on objective criteria, and apply any sensitive-use restrictions in a narrowly defined and carefully justified way.

Henric Skalberg, Chief Information Security Officer at Advania, brought an operational perspective as a provider that has delivered sovereign cloud services commercially for over a decade across government and critical infrastructure sectors in Europe. He stressed that sovereignty is not a uniform standard: different industries require different levels of autonomy, security and scale, and the term loses meaning when it becomes a marketing label detached from questions of operational control, data ownership and jurisdictional accountability. Skalberg identified data centre capacity constraints, rising energy costs and the cumulative regulatory burden on SMEs as the main barriers to scaling. He noted that smaller providers are frequently subject to compliance requirements passed down from larger clients even when formally exempted, which effectively negates those exemptions. He called for sovereign cloud definitions to be embedded as procurement requirements rather than voluntary frameworks, for regulatory incentives to be rebalanced between security and agility, and for some degree of market consolidation to help European providers reach the scale needed to compete.

Videos

  • EU Consumer Law: Present and Future
  • Building a sovereign EU cloud ecosystem
  • MEP visit to MWC26
View more

Related content

European Internet Forum ©2026. All Rights Reserved.