EU defines sovereignty criteria for cloud services

The EU Commission has taken a significant step with the Cloud and AI Development Act to establish binding criteria for the sovereignty of cloud and AI services. This law aims to create clear guidelines on when a service is considered sovereign. The initiative comes at a time when digital sovereignty is gaining increasing importance in Europe.

However, reactions to the draft law are mixed. While some associations see the new regulations as necessary to ensure the competitiveness of European providers, others express concerns about potential discrimination and artificial barriers. In particular, the associations Eco and international organizations warn of the potential negative impacts on the market.

Different Perspectives of the Associations

Eco, an association of the internet industry, sees a danger to competitive conditions in the proposed criteria. They argue that the new regulations could lead to discrimination against non-European providers, which would impair innovation in the cloud sector. These concerns are shared by international organizations that demand an open and fair competitive environment for all providers.

On the other hand, there are the positions of Cispe and the European SME Alliance. These groups fear that the existing criteria are not strict enough and could lead to a phenomenon known as "Sovereignty Washing." They call for rigorous criteria to ensure that only genuinely sovereign services are recognized as such. These demands reflect the concern that without clear standards, the integrity of the European cloud strategy could be at risk.

The discussion about sovereignty criteria is part of a larger trend in the EU aimed at strengthening digital independence. The Commission has launched several initiatives in recent years to reduce dependence on foreign technologies and promote the development of European alternatives. The Cloud and AI Development Act is a central component of this strategy.

The EU Commission has announced that it will incorporate feedback from various stakeholders into the final version of the law. This could lead to adjustments in the criteria to address both the concerns of the associations and the need for clear regulation. The public consultation on the draft law is expected to take place in the coming months.

The debate over sovereignty criteria for cloud services is also accompanied by a broader discussion about data protection and data security. At a time when data is considered one of the most valuable assets, the question of control over this data is of central importance. The EU has committed to setting high standards for data protection, which could also be reflected in the new regulations.

The final decision on the Cloud and AI Development Act is expected to be made in 2027, after the Commission has evaluated stakeholder feedback. Thus, the discussion about the sovereignty of cloud services will remain a central topic in European digital policy in the coming years.