The European Union flag flies in front of the European Parliament.
Philipp von Dittfurt | DPA | Picture Alliance | Getty Images
The European Union is considering rules that would restrict member governments from using U.S. cloud providers to handle sensitive data, people familiar with the talks told CNBC.
The European Commission, the EU’s executive branch, is scheduled to unveil a “Technology Sovereignty Package” on May 27, which includes a series of measures aimed at strengthening the EU’s strategic autonomy in key digital areas.
As part of preparations for the package, discussions are underway within the European Commission about restricting the release of sensitive public sector data to cloud platforms provided by companies outside the EU, two Commission officials who requested anonymity because they are not authorized to discuss private discussions told CNBC.
As tensions with President Donald Trump’s administration escalate, Europeans are increasingly demanding that U.S. cloud providers, which currently dominate the European market, diversify their most critical workloads to their own providers.
“The central idea is to define the sectors that need to be hosted in European cloud capacity,” one of the officials said. It added that companies providing cloud solutions in third countries, including the United States, may also be affected.
It added that the proposal would not completely ban foreign companies’ cloud platforms from government contracts, but would restrict their use in processing sensitive data in public sector institutions depending on the level of sensitivity. Officials said negotiations are ongoing but have not yet been finalized.
One official said that as a result of the proposal, “US cloud providers could face restrictions in certain key strategic areas” within EU member states’ public institutions.
Officials told CNBC that discussions are taking place around a proposal that financial, judicial and medical data processed by government and public sector organizations would require high-level sovereign cloud infrastructure.
One of the people said the discussions do not concern private companies, and the technology sovereignty package does not propose rules for private companies to use cloud platforms.
Once the European Commission submits the package, all 27 member states will need to give it the green light. The “Technology Sovereignty Package” includes the Cloud and AI Development Act (CADA) and the Chips Act 2.0, legislation aimed at encouraging sovereign homegrown solutions and products in both sectors.
Asked for comment, a European Commission spokesperson told CNBC that the package was “about Europe waking up and getting its act together.”
It added that this would “improve opportunities for sovereign cloud provision, including through public procurement, and support the entry of a more diverse range of cloud and AI service providers into the market.”
Increasing calls for diversification
Public sector organizations in EU member states can now use cloud platforms provided by foreign companies (often based in the US due to their dominance in this field) to process sensitive data such as medical or financial data, provided they comply with regulations.
But that dependence has come under increased scrutiny as transatlantic relations have deteriorated in recent months. Under the Cloud Act of 2018, U.S. law enforcement can request user data from U.S. companies, regardless of where the data is stored.
European governments told CNBC in February that they were considering homegrown and open source alternatives to U.S. technology platforms and increasing their budgets for digital sovereignty.
France has announced that it will introduce Visio, a government-developed video conferencing tool, in January and that it will be available on all national services by 2027, replacing US tools such as Microsoft Teams and Zoom.
In the same month, the EU said it faced “a serious problem of dependence on non-EU countries in the digital sector…which could create vulnerabilities, including in key areas.”
In April, the European Commission awarded 180 million euros in tenders for four European sovereign cloud projects to supply EU institutions and institutions, including one involving a joint venture between French aerospace company Thales and Google Cloud.
