Executive Summary

25 European cloud and digital service providers call on the EU Commission in an open letter for concrete rules against "sovereignty washing" by US hyperscalers. The planned Cloud and AI Development Act (CADA) should define sovereignty through genuine control, not mere EU presence. US companies such as AWS, Microsoft, and Google dominate with 70 percent market share but remain subject to the US CLOUD Act, which endangers data sovereignty.

People

Topics

  • Digital sovereignty
  • Cloud regulation
  • Data protection & extraterritoriality
  • European competitiveness
  • AI infrastructure

Clarus Lead

Industry association CISPE criticizes in an open letter to Henna Virkkunen that US cloud providers market their European presence as "sovereignty" without ceding genuine control. The phenomenon of "sovereignty washing" describes the practice of advertising EU data centers and security certifications while companies remain subject to the US CLOUD Act. The planned CADA regulatory framework is intended to halt this abuse and return market share to European providers.

Detailed Summary

The open letter of March 17, 2026, addresses the leading commissioner for technological sovereignty and targets the market dominance of AWS, Microsoft Azure, and Google Cloud with a combined market share of approximately 70 percent. Microsoft had to admit before the French Senate in 2025 that it could not guarantee European data sovereignty – a symptomatic problem for the entire sector.

The five demanded principles aim at structural changes: First, a strict definition of sovereignty through actual control rights rather than location marketing. Second, resilience through customer-side encryption and data portability as protection against extraterritorial access. Third, a procurement principle of "Buy European – Ensure Resilience – or Explain," which strategically directs public contracts. Fourth, competition protection through interoperability and prohibition of AI-cloud bundling. Fifth, prioritization of public investment for European infrastructure.

CISPE Secretary General Francisco Mingorance warns that Europe must not squander the "unique opportunity" to regain digital independence. A gigawatt of European infrastructure must be "investment in strategic autonomy," otherwise Europe would only deepen its dependence. Local providers currently hold approximately 15 percent market share and could benefit particularly in public contracts and sensitive data.

Key Statements

  • Market dominance problematic: US hyperscalers control 70% of the European cloud market but remain subject to US laws such as the CLOUD Act
  • Pseudo-sovereignty criticized: EU data centers and certifications simulate control without granting genuine data sovereignty
  • Five-point demand: From genuine control definition through resilience to reserved procurement for European providers
  • Competition protection central: Interoperability and prohibition of AI-cloud bundling should counter market distortions
  • Strategic autonomy at risk: Without course correction, Europe only deepens its technological dependence on overseas actors

Critical Questions

  1. Evidence: Is the 70 percent market share figure based on current market research data, or are these estimates? How is the methodological distinction between "European" and "US American" providers defined?

  2. Conflicts of Interest: CISPE directly represents competing European providers – to what extent could the demand for "reserved procurement" favor European providers regardless of cost-efficiency or performance?

  3. Causality: Is it proven that the CLOUD Act has actually led to data access on European customer data, or does it remain a theoretical risk? What alternatives to technical controls (e.g., contractually assured resistance) exist?

  4. Feasibility: Can European providers technically and economically offer competitive solutions to AWS/Azure scalability, or would a "Buy European" quota fail due to quality deficiencies or cost disadvantages?

  5. Overall Impact: Could a procurement mandate for European cloud services lead to higher IT costs for authorities and companies – and thereby indirectly harm digital competitiveness?

  6. Regulatory Costs: What administrative and technical burdens result from interoperability and reversibility requirements for all cloud providers?

Sources

Primary Source: Cloud: 25 European CEOs warn EU of sovereignty washing – https://www.heise.de/news/Cloud-25-europaeische-CEOs-warnen-EU-vor-Souveraenitaets-Washing-11217583.html

Verification Status: ✓ March 17, 2026

This text was created with the support of an AI model. Editorial responsibility: clarus.news | Fact-checking: March 17, 2026