EU weighs restricting use of U.S. cloud platforms to process sensitive government data, sources say

The European Union is contemplating regulations that could restrict member states from utilizing U.S. cloud providers for managing sensitive governmental data, according to sources familiar with the discussions. The European Commission, which serves as the EU’s executive arm, is set to unveil its "Tech Sovereignty Package" on May 27. This comprehensive initiative aims to enhance the bloc's autonomy in critical digital sectors. As part of these preparations, ongoing conversations within the Commission are focused on minimizing the risk of sensitive public sector data being processed by cloud platforms operated by companies outside the EU. Amid escalating tensions with the U.S. administration, there is a growing sentiment in Europe to reduce reliance on dominant U.S. cloud services and pivot towards local providers for essential operations. "The main objective is to identify sectors that must rely on European cloud capabilities," one official noted, emphasizing that cloud service providers from third countries, particularly the U.S., might face implications. The proposed regulations would not completely ban foreign cloud platforms from government contracts; however, they would impose restrictions based on the sensitivity of the data involved. Ongoing discussions indicate that specific sectors, including finance, judiciary, and health, could require robust sovereign cloud infrastructure for data processing by government entities. The Commission’s spokesperson indicated that this initiative represents a pivotal moment for Europe to enhance its digital sovereignty, fostering a more diverse landscape of cloud and AI service providers. The upcoming package will also encompass the Cloud and AI Development Act (CADA) and the Chips Act 2.0, both aimed at promoting domestic solutions and products in these sectors. Currently, EU public sector organizations are permitted to utilize cloud services from foreign firms—predominantly U.S.-based—provided they adhere to existing regulations. However, skepticism regarding this dependency has intensified as relations between Europe and the U.S. have deteriorated in recent months. The 2018 Cloud Act allows U.S. law enforcement to access user data from American companies, raising further concerns. In response, European governments have been exploring local and open-source alternatives to U.S. technologies, including a commitment by France to introduce a state-developed video conferencing solution called Visio, slated for deployment across all government services by 2027, replacing tools like Microsoft Teams and Zoom. Additionally, the EU has acknowledged its significant dependence on non-EU countries in the digital domain, which poses vulnerabilities in critical sectors. Recently, the Commission allocated €180 million to four European sovereign cloud initiatives intended to serve EU institutions and agencies, one of which is a partnership involving Thales and Google Cloud.