Europe's New Cloud and AI Rules Target American Dominance
The European Commission proposed sweeping regulations on June 3, 2026, to reduce the continent's reliance on foreign cloud and AI providers. The Cloud and AI Development Act (CADA) forms the centerpiece of a broader sovereignty package that also includes semiconductor targets and open-source commitments.
The proposal is not yet law. Member States and the European Parliament must negotiate and vote on the text. But the political direction is clear: Brussels intends to steer public procurement, accelerate data center deployment, and build a European supply chain less dependent on non-European companies.
The Dependency Problem
AWS, Microsoft Azure, and Google Cloud control roughly 70% of the European cloud market. This concentration creates operational, legal, and geopolitical risks that Brussels wants to address.
European authorities cite specific legal concerns. The U.S. Cloud Act allows American authorities to compel providers to hand over data stored outside U.S. territory. There is also the risk that an external actor could disrupt essential services-what officials call the "kill switch" scenario-in critical sectors like defense, healthcare, energy, and banking.
How CADA Works
The regulation rests on three pillars: innovation, capacity, and autonomy.
Innovation means supporting next-generation cloud and AI technologies, including frontier AI and industrial AI systems. The Commission plans "grand challenge" initiatives to direct research toward areas where Europe can regain strategic ground.
Capacity is the most visible target: Brussels wants to at least triple European data center capacity within five to seven years. The Commission will reduce permitting delays, improve access to land, energy, and water, and improve financing options. This signals a wave of infrastructure spending ahead.
Autonomy introduces a four-level sovereignty framework. Level 1 requires data storage within EU infrastructure. Level 2 adds independence from third countries and transparency about software supply chains. Level 3 mandates European ownership and control of the provider. Level 4 represents maximum sovereignty, with full control of the software chain and no foreign interference.
Public administrations and sensitive sectors will assess their risk levels and select services compatible with these requirements. The Commission also plans a common procurement framework across Europe to pool demand and increase negotiating power against suppliers.
What This Means for American Providers
CADA does not close Europe's market to Microsoft, Amazon, or Google. The regulation maintains openness to partners, but makes it conditional. Providers will face increased pressure on data localization, governance transparency, auditability, and independence from foreign jurisdictions.
The implicit signal is stronger than the explicit text. Public procurement, permits, and funding could favor actors with genuine European operations. This matters because it could reshape which companies win contracts for sensitive workloads, even if American providers retain dominance in standard use cases.
European Winners
OVH and Ionos stand to benefit most directly. Both have European operations, established brands, and exposure to sovereignty concerns. If Levels 3 and 4 become standard in critical public markets, these providers could gain share in sensitive workloads where American hyperscalers face restrictions.
OVH offers a pure-play profile on European cloud hosting and infrastructure services. Its risk lies in execution: CADA creates opportunity but does not solve competitiveness gaps in service depth, software ecosystems, or operating margins.
Ionos appeals to SMEs and companies seeking alternatives to the American trio. Its broader business mix may reduce volatility compared to a sovereign-cloud-only player.
Nebius occupies a different category. Its exposure to AI infrastructure and GPU capacity aligns with the goal of tripling data center capacity and supporting AI factories. The opportunity is real but riskier-it depends on chip access, energy costs, and long-term customer contracts.
The Semiconductor Angle
CADA cannot be separated from the Chips Act 2.0. Tripling data center capacity and developing AI requires more semiconductors, power components, cooling solutions, and network infrastructure. Brussels targets 20% of global semiconductor production by 2030, up from much lower levels today.
ASML remains Europe's most valuable strategic asset in the semiconductor chain, though its connection to CADA is indirect. Infineon and STMicroelectronics could benefit from reshoring cycles and industrial investment, though their trajectory depends more on automotive and industrial demand than the European package alone.
Energy Is the Constraint
Tripling data center capacity in five to seven years requires significant electricity growth. Beneficiaries include grid equipment suppliers like Schneider Electric, Legrand, Nexans, Prysmian, and Siemens Energy.
The Commission explicitly links data center development to energy efficiency, cooling, and grid integration. Without sufficient connections, grid capacity, and competitive electricity rates, European cloud sovereignty remains theoretical.
The Real Test Ahead
Europe has announced ambitious industrial goals before without rapidly shifting global power dynamics. Success depends on three variables: the final regulation text, the sovereignty levels required by sector, and the actual volume of public procurement mobilized.
Funding remains fragmented across the European budget, Member States, and private capital. Data centers still need to secure land, water, energy permits, and local acceptance. AI infrastructure is extremely capital-intensive, making financing decisive.
The United States could contest certain criteria if it deems them discriminatory. The final text will likely balance firm sovereignty requirements against avoiding direct confrontation with Washington.
For IT and development professionals, this signals a structural shift in where cloud and AI infrastructure lives and who controls it. The regulation creates new market segments and technical requirements that will shape infrastructure decisions for years ahead.
Your membership also unlocks:
