EU Proposes Cloud Risk Assessments for Sensitive Services, Raising Barriers for US Providers

The European Commission published technological sovereignty proposals on Wednesday that would require EU member states to assess cloud computing providers in defence, criminal justice and border management for foreign access risks. If a service is deemed risky, authorities could be required to switch providers.

The commission said the EU needed to reduce dependency on foreign suppliers in cloud computing, artificial intelligence and semiconductor production.

The EU is reliant on foreign providers for more than 80% of digital products and services, infrastructure and intellectual property, the commission said. China stopped semiconductor exports last year, almost bringing the European car industry to a halt.

U.S. And east Asia for the most advanced chips, including AI chips. Henna Virkkunen, the European Commission vice-president for tech sovereignty, said the 2018 US Cloud Act “was not in line with our rules here”. She said the EU was “not planning to work in isolation and produce everything ourselves” but had to identify “risky dependencies” by ensuring sensitive services and data relating to security and law enforcement were controlled in Europe.

She added it would be “very difficult” for US companies to pass strict EU criteria to provide cloud computing services in areas such as defence. The draft law suggests US cloud providers operating in the EU might have to comply with EU data protection rules and prove they would not be compelled to surrender EU data to US authorities.

The proposals have to be agreed by member states and the European parliament.