A report from the European Centre for International Political Economy (ECIPE) argues that the EU's proposed Cloud and AI Development Act could backfire. Examining public cloud procurement in nine EU member states, the report found that every contract invoking 'sovereignty' went to a domestic provider, and an analysis of 8,725 cloud-related contracts from 2018 to 2025 showed negligible intra-EU cross-border competition. ECIPE warns that the law may lock in this national pattern instead of fostering pan-European rivals.
ECIPE says CADA blurred two different meanings of sovereignty: a security and resilience objective, and an industrial policy objective. As a result, the proposed criteria based on EU-located infrastructure and restrictions on third-country control could favor selected providers, restrict competition, and split the digital market along national lines. The report argues that many domestic wins are actually delivered by prime contractors using hyperscale infrastructure, so ownership alone says little about where data is controlled.
The authors recommend treating sovereignty as a demonstrated outcome rather than an ownership status. 'Real sovereignty means a public buyer can show its data is secure and that it can switch provider if it has to,' said ECIPE director Fredrik Erixon. 'Europe's cloud market is already national in practice. CADA risks locking that in.'
Not everyone frames the problem the same way. CISPE, a trade association for cloud providers in Europe, has also called for 'real tech sovereignty,' but it defines sovereignty as control over the underlying technology and protection from extraterritorial laws such as the US CLOUD Act. CISPE previously warned that the EC's criteria were so vague they favored incumbents, a position that overlaps with ECIPE's criticism but places more emphasis on ownership and control.