Europe's Path to Technological Sovereignty: What Is Actually Happening

I. The Starting Point

Ninety percent. That is Cristina Caffarra's estimate — founder of the Eurostack Foundation and competition economist — of the share of European digital infrastructure, cloud, computing capacity, software, controlled by non-European, predominantly American companies. Three hyperscalers — Amazon Web Services, Microsoft Azure, Google Cloud — hold together roughly two thirds of the European cloud market. The market share of European providers has remained stable at around 15 percent despite all initiatives of recent years.

That is the starting point. Not an opinion, not a political narrative — a market structure that maps to numbers. Those who want to assess what Europe's technological sovereignty initiatives are worth must measure them against this baseline.

And they must know the US CLOUD Act of 2018: the law that permits American authorities to compel US companies to hand over data — regardless of where in the world that data is stored. A data centre in Frankfurt, operated by Amazon Web Services, is legally accessible to American authorities under American law. This is not theory. It is current law. And it makes any approach built on American infrastructure components a legal grey zone when it comes to genuine sovereignty.

II. What Europe Is Doing — the Regulatory Side

Europe has built an impressive regulatory framework in recent years that sets global standards. The GDPR regulates data protection. The Digital Services Act and Digital Markets Act regulate platform behaviour. The AI Act is the world's first comprehensive AI regulation, phasing in from 2026. The Data Act creates rules for data use. The Chips Act is meant to build European semiconductor production. The Critical Raw Materials Act secures access to raw materials.

This is not trivial. Europe has developed into a regulatory great power — through the so-called Brussels Effect: because the European market is large enough, global companies adapt their products and practices to European standards, even outside the EU. The GDPR triggered data protection debates worldwide. The AI Act will influence global AI development.

But regulation is not infrastructure. One can regulate brilliantly and still be completely dependent — on the regulated companies. Those who define the rules of the game but cannot play it themselves are not a sovereign actor. They are a referee in a game that others win.

III. What Europe Is Doing — the Infrastructure Side

Here it becomes more concrete — and more sobering.

GAIA-X was launched in 2019 by Germany and France as the "Airbus of the Cloud" — a European cloud ecosystem that was supposed to break the dominance of American hyperscalers. What happened: Amazon, Microsoft and Google were admitted as members. Scaleway, a founding member, withdrew. The Nextcloud CEO called it a "paper monster". The European cloud market share continued to fall throughout GAIA-X's existence. The initiative is today a standardization and certification framework — useful, but far from the original vision.

EuroHPC — the EU's joint high-performance computing programme — has real results: LUMI in Finland, one of the world's most powerful supercomputers, is used for AI, climate and health research. Jupiter, the next European exascale supercomputer, is under construction. These data centres are developing into "AI factories" — infrastructure that remains under European legal and political control. This is genuine progress.

The EU Chips Act, with 43 billion euros in investment, aims to double Europe's share of global semiconductor production from the current roughly 8 to 20 percent by 2030. Intel announced a mega-factory in Magdeburg — which was then delayed due to financial difficulties. TSMC is building in Dresden. The ambition is real; the implementation is faltering.

EURO-3C — presented at the Mobile World Congress in Barcelona in March 2026 — is the newest initiative: a federated cloud, AI and edge computing network, supported by Telefónica and more than 70 organisations, backed by the European Commission. Rather than building from scratch, it connects existing national infrastructure into a common network. The initiative sounds more promising than its predecessors because it builds on existing infrastructure. Whether it delivers remains to be seen.

CADA — the Cloud and AI Development Act — is expected to be proposed by the European Commission in Q1 2026. It would be the first binding law on cloud sovereignty — not a voluntary framework, not guidelines, but binding regulation under Article 114 TFEU. Critics ask: EUCS, the European cloud certification scheme, has been blocked since 2019 on the question of whether non-European providers should be excluded from the highest security levels. If member states could not agree for six years, why should CADA succeed?

IV. The Problem: Sovereignty Washing

Here lies the structural problem running through all European initiatives: what experts call "sovereignty washing" — the adoption of sovereignty vocabulary by exactly the actors it is directed against.

Microsoft, Google and Amazon have recognized European demand for sovereignty — and now aggressively market "sovereign cloud" solutions. They place data centres on European soil, found joint ventures with European partners, promise EU-only support teams and customer-managed encryption. France has Bleu (Microsoft + Orange + Capgemini) and S3NS (Google + Thales). Germany has Delos (Microsoft + SAP).

The problem: as long as the parent company is American, it remains subject to the CLOUD Act. A Delos data centre in Germany, operated with Microsoft technology, is legally not sovereign — because Microsoft as an American company must provide access on court order from American authorities, regardless of contractual sovereignty promises. Caffarra puts it plainly: "A company subject to the extraterritorial laws of the United States cannot be considered sovereign for Europe."

This is not trivial. It means that a significant portion of the "sovereignty solutions" that European governments and companies are purchasing are legally not what they claim to be. They are convenient solutions that produce the appearance of compliance without solving the structural problem.

V. The Investment Problem

Behind the sovereignty-washing problem lies an even more fundamental one: the investment problem.

Amazon invested over 100 billion dollars in AWS infrastructure in 2025. The entire European cloud sector combined cannot come close to matching this. Public funding can help — but it cannot close a gap measured in hundreds of billions of dollars. The EU Chips Act with 43 billion euros over several years sounds large. In the semiconductor industry, where a single modern chip factory costs 20 to 30 billion dollars, it is small money.

This is not criticism of European initiatives — it is a description of the structural baseline. Europe has spent thirty years building a knowledge infrastructure, an industrial capacity and an investment base that simply does not exist in certain areas. That cannot be made up in five years with funding programmes.

The fragmentation problem compounds this: France builds bilaterally, Germany bilaterally, each country its own solutions — which undermines exactly the collective European alternative that CADA and EURO-3C are trying to create. The crystallization point is again the old European Achilles heel: national interests trump collective strength.

VI. What Is Realistically Possible

Pessimism would be the wrong conclusion. There are real advances and real possibilities for action — but they lie not where the big announcements are made.

In the public sector, concrete things are happening. The Austrian Federal Ministry for Public Administration has fully migrated its collaboration infrastructure to Nextcloud — not for cost reasons, but for sovereignty reasons. The CIO: "This is not about saving money. It is about maintaining control over our own data and our own systems." The International Criminal Court in The Hague has taken similar steps. These are blueprints, not footnotes.

In research, EuroHPC is real and functional. The LUMI infrastructure genuinely provides European researchers with sovereign computing capacity. That is not marketing.

The regulatory side — GDPR, AI Act, DMA — has effect. It forces American companies to change behaviour, creates market conditions favouring European alternatives, and sets global standards. That is not nothing.

But the honest overall picture remains: Europe regulates brilliantly and builds slowly. It produces initiatives faster than infrastructure. It discusses sovereignty while American hyperscalers invest further hundreds of billions. The gap is no longer growing as fast as ten years ago — but it is not shrinking either.

Europe regulates the world
and uses American servers
to administer the regulation.
That is the most precise description
of the current state
of European technological sovereignty. — beyond-decay.org