EU Cloud Sovereignty Meets Reality: Europe Is Too Dependent on US Tech to Break Free
In a nutshell
everything on the web starts with the domain
Europe has spent years insisting it wants digital sovereignty — control over its own data, its own infrastructure, its own technological fate. This summer it wrote that ambition into a law. And within weeks, the strongest resistance came not from Washington or Silicon Valley, but from inside Europe itself: its own defence officials, warning that the continent is now so dependent on American technology that trying to break free could leave it less secure, not more. This is the sovereignty dream colliding with the sovereignty arithmetic, and the arithmetic is unforgiving.
What Brussels Proposed
In June, the European Commission presented the Cloud and AI Development Act, the clearest move yet to loosen Europe's dependence on American cloud giants. The logic is sound and long-standing. Amazon Web Services, Microsoft Azure, and Google Cloud together hold roughly seventy percent of the European cloud market, and all three are bound by the US CLOUD Act, which can compel American companies to hand data to US authorities even when that data sits on European soil. For a continent that treats data protection as a fundamental right, having its most sensitive public information resting on infrastructure a foreign government can legally reach is an obvious vulnerability. The Act's answer is a sensitivity ranking: member states would classify each public service by how sensitive it is, and the highest tier would require solely domestic, European technology.
The One Percent Problem
Here is the number that tells the whole story, and it came from the Commission itself. Under the proposed rules, only about one percent of Europe's public services would qualify for that highest, domestic-only sovereignty tier. One percent. That figure is meant to sound reassuring — a narrow, careful requirement affecting only the most critical systems. Read it the other way, though, and it is a confession. It is the Commission's own measurement of how little of Europe's digital life could actually run on European infrastructure if it had to. The tier is set at one percent not because Europe only wants sovereignty over one percent, but because one percent is roughly all the sovereignty its current capacity can bear. The thinness of the European technology stack is not an accusation from critics; it is baked into the law's own math.
The Revolt From Within
The most telling resistance came from the people whose job is European security. According to Financial Times reporting, defence officials and executives across the bloc are pushing back against the Act, warning that a rapid retreat from US hyperscalers could leave armed forces with inferior systems, greater cyber vulnerabilities, and serious difficulty coordinating with NATO allies. Their recurring example is the F-35 fighter jet — American hardware whose digital infrastructure is embedded in US cloud services, not bolted on as an afterthought but woven through the machine. Sources put the US lead in cloud and AI defence platforms at eight to ten years. The concern is not ideological; it is operational. Finland has raised the spectre of a "kill switch" — the fear that dependence on US systems means Washington could, in theory, degrade them. And yet the same officials warn that Europe cannot simply walk away, because the domestic alternatives capable of replacing what the militaries rely on do not yet exist. That is the trap in a single sentence: afraid of the dependence, and unable to escape it.
Claim and Counter-Claim
The case for pressing ahead regardless is serious. The CLOUD Act vulnerability is real, the geopolitical climate has made American reliability feel less certain than it did a decade ago, and sovereignty you never build is sovereignty you never have — at some point the transition has to start, and it will always feel too early. If Europe waits until the dependence is comfortable to break, it will wait forever, because dependence of this kind only deepens.
The case for the defence officials' caution is just as serious, and more immediate. Ripping out systems that armed forces depend on, before credible European replacements exist, does not produce sovereignty; it produces a gap, and gaps in defence get measured in lives. An eight-to-ten-year capability lag cannot be legislated away, and NATO interoperability is not a bureaucratic nicety but the backbone of collective security. The honest synthesis is uncomfortable: both sides are right, which is precisely why this is so hard. Europe genuinely needs to reduce this dependence, and Europe genuinely cannot afford to reduce it quickly. Sovereignty here is not a switch to flip but a decade-long climb, and the law has run ahead of the ladder.
The European Perspective
This is the most honest mirror Europe has been handed in a long time, and everything we have reported this year points to it. We have written, again and again, that Europe regulates what it does not build — that its power is the rulebook, not the engine. The Cloud and AI Development Act is that pattern reaching its logical endpoint: a rule demanding sovereignty that Europe's own capacity cannot yet supply, exposed not by American lobbying but by Europe's own generals doing the math. The one percent figure and the F-35 example are the same lesson the Nvidia earnings and the two-superpower model race taught, now made concrete and strategic: you cannot regulate your way to independence from infrastructure you never developed.
The deeper truth is almost philosophical. Sovereignty is not the right to make a rule; it is the capacity to live by it. Europe has the first and lacks the second, and no directive can close that gap — only years of building can. There is a hard version of hope in this, though, if Europe will take it. The Act, for all that it has run ahead of reality, at least forces the continent to see the reality clearly: to measure, in its own official estimates, exactly how dependent it has become, and exactly how far it must climb.
A continent that finally knows the true size of its dependence is better placed than one that comforts itself with the language of sovereignty while quietly running everything on someone else's cloud. The first step out of a trap is admitting you are in one. Europe, this summer, finally did — and then its own defence officials read the map back to it. The question now is whether the admission becomes a decade of building, or just another rule that reality politely ignores.
We are not first. We are right.
SOURCES
AI Weekly — European Defence Officials Push Back on EU Cloud Sovereignty
Dealroom — Defence officials resist EU plan to curb reliance on US tech giants
Computerworld — EU's cloud sovereignty push leaves room for US hyperscalers
Defence Matters — European defence officials challenge EU curbs on US cloud dependence