Europe pivots toward digital sovereignty

The European Commission on April 17 awarded sovereign-cloud contracts worth up to 180 million euros over six years, giving EU institutions a way to buy cloud services that Brussels says better fit its digital-sovereignty goals. The move came as European officials and companies stepped up warnings about dependence on U.S. technology providers for communications, cloud hosting and sensitive public-sector workloads. A separate debate over Microsoft’s handling of International Criminal Court prosecutor Karim Khan’s account has added urgency to those concerns. Together, the disputes have pushed cloud policy deeper into the EU’s broader argument about strategic autonomy in technology. ### Why did a cloud procurement tender become part of a sovereignty debate? The Commission said on April 17 that its new sovereign-cloud tender was designed to strengthen the “digital sovereignty posture” of EU institutions and to encourage services that comply with EU laws and values. The contracts went to four groups led by Post Telecom with OVHcloud and CleverCloud, STACKIT, Scaleway, and Proximus with S3NS, Clarence and Mistral. (commission.europa.eu) The same Commission notice said the procurement used a Cloud Sovereignty Framework with measurable criteria covering legal, operational, security and supply-chain issues. Providers had to meet at least a “SEAL-2” data-sovereignty level, while most of the winners reached “SEAL-3,” which the Commission said implies resilience against disruption from non-EU third parties. (commission.europa.eu) ### What did the Karim Khan episode change? Karim Khan’s email disconnection became a shorthand in Europe for the risk that U.S. sanctions or executive action could affect international bodies that rely on American technology. POLITICO reported that Microsoft President Brad Smith said on June 4, 2025 that the company had not ceased or suspended services to the ICC, even after reporting that Khan’s email address had been canceled following U.S. sanctions. (commission.europa.eu) Brad Smith said Microsoft’s actions “did not in any way involve the cessation of services to the ICC,” according to POLITICO. But the same report said the episode had fueled fears in Europe that Washington could trigger a “kill switch” through U.S. tech providers operating abroad. ### What is Brussels now considering for government data? (politico.eu) CNBC reported on May 7 that the Commission was considering rules that would restrict the use of U.S. cloud platforms for sensitive government data across EU countries. The proposal is expected as part of a “Tech Sovereignty Package” due on May 27, according to officials cited by the outlet. Those officials told CNBC that discussions covered requiring high levels of sovereign cloud infrastructure for government-held financial, judicial and health data. (politico.eu) The talks were still ongoing, and the measures under discussion would not amount to a total ban on overseas cloud providers in public-sector contracts. ### Is Europe trying to exclude U.S. companies entirely? Politico reported on May 6 that the Commission was still drawing lines around what counts as sovereign cloud, and that some European companies feared Brussels would leave room for U.S. firms. (cnbc.com) The concern followed signals that the EU might accept some arrangements involving American technology if operations were run by European entities. Thibaut Kleiner, the Commission’s director for future networks, told Politico’s event that the planned Cloud and AI Development Act would seek to ensure Europe does not become a technology “colony.” At the same event, Nextcloud Chief Executive Frank Karlitschek said he expected a law with “a little nice exception at the end,” which he said could leave a “back door” for dominant U.S. cloud providers. (cnbc.com) ### Where is this pressure showing up first? (politico.eu) France has emerged as one of the clearest examples of the shift, according to WIRED’s reporting as summarized by the Benton Institute. That account said cities and governments were dropping Microsoft Office for open-source tools, moving local AI workloads to European cloud hosting and shifting defense data away from systems with U.S. involvement. French budget minister David Amiel recently called for the state to “break free” from American systems and use technology it can control, according to the same summary of WIRED’s article. (politico.eu) The Commission’s next test comes on May 27, when the Tech Sovereignty Package is expected to set out how Brussels wants sensitive public-sector data handled and which providers can qualify for that work. (benton.org)