EU Proposes Cloud Risk Assessments for Sensitive Services, Raising Barriers for US Providers

The European Commission published technological sovereignty proposals on Wednesday that would require EU member states to assess cloud computing providers in defence, criminal justice and border management for foreign access risks. If a service is deemed risky, authorities could be required to switch providers.

The commission said the EU needed to reduce dependency on foreign suppliers in cloud computing, artificial intelligence and semiconductor production.

The EU is reliant on foreign providers for more than 80% of digital products and services, infrastructure and intellectual property, the commission said. China stopped semiconductor exports last year, almost bringing the European car industry to a halt.

U.S. And east Asia for the most advanced chips, including AI chips. Henna Virkkunen, the European Commission vice-president for tech sovereignty, said the 2018 US Cloud Act “was not in line with our rules here”. She said the EU was “not planning to work in isolation and produce everything ourselves” but had to identify “risky dependencies” by ensuring sensitive services and data relating to security and law enforcement were controlled in Europe.

She added it would be “very difficult” for US companies to pass strict EU criteria to provide cloud computing services in areas such as defence. The draft law suggests US cloud providers operating in the EU might have to comply with EU data protection rules and prove they would not be compelled to surrender EU data to US authorities.

The proposals have to be agreed by member states and the European parliament.

The commission will roll out a rating system to ensure energy efficiency of datacentres and create acceleration zones to offer fast-tracked permitting for datacentres. It wants to triple the EU’s datacentre capacity within five to seven years. The EU passed the European Chips Act in 2023.

The Computer and Communications Industry Association, whose members include Amazon and Google, said the commission had produced “a dangerous recipe for progressive market shutdown” that would push trusted providers out of parts of the EU market. U.S. and even try to match them in terms of AI leadership”.

He said building RAM chips and memory chips could still be beneficial. Lara Natale, the senior director for public affairs at the Centre for Future Generations, said US companies “will invest a lot of money in the upcoming months to try to lobby, try to create common positions, try to position themselves on the side of the new sovereignty discussion”.