How the EU's New 'Cloud Sovereignty' Framework Could Exclude US Tech Giants From Government Contracts

For the past decade, the global cloud computing market has operated on a geographic compromise: US tech giants could serve European governments as long as they built data centers physically located within European borders. That era is coming to a close. With the introduction of the Cloud and AI Development Act (CADA), the European Commission is fundamentally redefining what it means to control digital infrastructure.[2]

CADA is the centerpiece of the broader European Technological Sovereignty Package, a sweeping legislative blueprint unveiled in June 2026. The package is driven by a stark mathematical reality: the European Union currently relies on non-EU providers for more than 80 percent of its digital products, services, and intellectual property. Brussels now views this reliance not merely as an economic imbalance, but as a critical strategic vulnerability comparable to its former dependence on Russian natural gas.

To correct this, CADA introduces a mechanism known as the Union cloud computing sovereignty framework. Outlined in Article 16 of the proposed regulation, the framework establishes four distinct "Union Assurance Levels" (UAL 1 through 4). These tiers dictate exactly which cloud providers are legally permitted to host different categories of public-sector data, shifting the focus from where data is stored to who legally controls the company storing it.[2]

The tier system operates as a graduated filter. Union Assurance Level 1 (UAL 1) serves as the new baseline for all public-sector cloud procurement. It requires that the provider be established in the EU and that all customer data, including metadata and telemetry, remains physically within the Union unless a public body explicitly grants an exception. Most major international cloud providers can meet this baseline today.[2]

Union Assurance Level 2 (UAL 2) tightens the net. It demands that both the audited provider and all subcontractors maintain their infrastructure, assets, and personnel exclusively within the EU. Furthermore, it prohibits the training of artificial intelligence models on customer usage data outside of European borders, establishing a robust defense against extra-territorial data transfer.[2]

The structural roadblocks for foreign tech giants begin at Union Assurance Level 3 (UAL 3). At this tier, all personnel involved in managing the cloud service must be EU citizens, holding national security clearances if they handle classified information. Crucially, the provider and its subcontractors must not be subject to corporate control by a third country, effectively locking out subsidiaries of foreign multinationals unless specific, narrow derogations are granted.

Union Assurance Level 4 (UAL 4) is the absolute ceiling, designed exclusively for the most sensitive government workloads—such as defense, national security, justice, and border management. UAL 4 mandates full EU-only control with zero exceptions. It requires European corporate ownership, European infrastructure, and mandatory EU citizenship for anyone with physical or logical access to the systems. Under these criteria, no US-headquartered hyperscaler can currently qualify.[2]

The exclusion of US tech giants from the top tiers is not an accident of the drafting process; it is a direct response to the US CLOUD Act. Passed by the US Congress in 2018, the CLOUD Act grants American law enforcement the legal authority to compel US-based technology companies to hand over data regardless of where those servers are physically located in the world.[1]

European regulators have long argued that the US CLOUD Act creates an irreconcilable conflict with European data protection laws. Because a hyperscaler operating a data center in Frankfurt remains subject to the laws governing its American parent company, European officials argue that US providers inherently hold a jurisdictional "kill switch" over European public-sector data.

By codifying the four-tier system, CADA transforms this theoretical legal conflict into a hard procurement disqualifier. Article 30 of the proposed act requires member states to conduct mandatory risk assessments on their public-sector workloads. Activities deemed critical to "public order" must be assigned to UAL 3 or UAL 4, legally barring US providers from bidding on those contracts.[2]

This creates a structural ceiling for companies like Amazon Web Services, Google Cloud, and Microsoft Azure. While these hyperscalers possess the capital to build endless localized data centers across Europe, they cannot alter their ultimate corporate ownership or shield themselves from the jurisdictional reach of US federal law without fundamentally restructuring their global businesses.[1]

Conversely, the framework hands a massive structural advantage to domestic European cloud operators. Companies such as France's OVHcloud and Scaleway, or Germany's T-Systems, are perfectly positioned to qualify for UAL 3 and UAL 4. For these firms, CADA represents an unprecedented opportunity to capture high-value government contracts without having to outspend American rivals on raw infrastructure.[2]

CADA does not exist in a vacuum. It is flanked by the Chips Act 2.0, which grants the European Commission emergency powers to override commercial semiconductor contracts during supply crises, and a new EU Open Source Strategy that elevates community-maintained software to the status of critical national infrastructure.[1]

The legislative battle is now shifting to the European Parliament and the Council of the EU. US providers and international trade groups are actively lobbying to soften the definitions of "operational autonomy" in the final text, hoping to carve out a compliance pathway that would allow them to reach UAL 3 through localized joint ventures or technical ring-fencing.[2]

While CADA technically only applies to public-sector procurement, enterprise security analysts warn of massive spillover effects. Private companies that operate critical infrastructure—such as energy grids, telecommunications, and financial services—will likely face intense regulatory and contractual pressure to align their own cloud architectures with the new UAL tiers.

Ultimately, the Tech Sovereignty Package marks the moment Europe stopped treating digital independence as an abstract political aspiration and began writing it into the mathematical logic of procurement law. Whether it succeeds in incubating a competitive domestic cloud industry, or simply fragments the global internet, will depend entirely on how strictly the four tiers are enforced.[2]