Europe has spent years writing some of the world's toughest rules for artificial intelligence and digital technology, but it's now facing an uncomfortable truth: it doesn't actually control the infrastructure those rules are supposed to govern. The European Union relies on non-EU countries for more than 80% of its digital products, services, infrastructure, and intellectual property, according to data compiled by EU institutions and cited by the European Parliament in its January 2026 resolution on technological sovereignty. That dependence has shifted from a business concern to a strategic security issue, especially as AI becomes central to everything from hospitals to energy grids.

Why Does Europe's Data Dependence Matter So Much?

The scale of Europe's reliance on foreign technology is striking. According to an Oliver Wyman analysis cited in recent reporting, 92% of Western data is stored on U.S.-owned infrastructure. This isn't just about using American software or cloud services; it means that critical information powering the European economy sits in data centers that Europe doesn't control. A server might be physically located in Madrid, but control and decision-making could remain in Seattle, creating what experts call a sovereignty gap.

The cloud computing market illustrates the problem clearly. Amazon Web Services (AWS), Microsoft Azure, and Google Cloud account for roughly 70% of the European cloud infrastructure market, while European providers hold only about 15%. This represents a dramatic shift from 2017, when European cloud providers controlled around 29% of the market. In just five years, European companies lost nearly half their market share, and that decline has largely stagnated since 2022.

The concern isn't simply market competition. These technology giants, known as hyperscalers, operate vast networks of data centers and provide computing power, storage, and digital services on demand. Once a company starts using one provider's storage services, it often becomes locked into the same vendor for databases, development tools, cybersecurity, data analytics, and artificial intelligence. This phenomenon, called vendor lock-in, makes switching providers so difficult and expensive that customers become effectively trapped.

How Is Europe Trying to Regain Control of Its Digital Future?

European Commission President Ursula von der Leyen summed up the shift in strategy on June 3, 2026, when she unveiled the European Technology Sovereignty Package, stating: "We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure. This is about protecting our citizens, defending our interests and making our own choices". The package includes two major legislative proposals: the Chips Act 2.0 and the Cloud and AI Development Act (CADA), alongside a European open-source strategy and a roadmap for digitalization and artificial intelligence in the energy sector.

The most innovative aspect of CADA is its definition of sovereignty, which moves beyond the simple idea that a cloud service is sovereign just because data are physically stored within the European Union. Instead, Brussels has established four levels of sovereignty:

• Level One: Data must be processed and stored on infrastructure located in the EU
• Level Two: Adds independence from third countries and transparency regarding the software supply chain
• Level Three: Requires that the provider be owned and controlled from within the EU
• Level Four: Demands full transparency and control over the software supply chain, as well as freedom from interference by third countries

This framework matters because it recognizes that physical location alone doesn't guarantee control. Sebastián Muriel, Telefónica's chief digital officer, highlighted this concern in an article published in the business daily Cinco Días on May 23, arguing that "believing sovereignty consists merely of hosting data on European soil is clearly insufficient". The U.S. Cloud Act, for example, may allow U.S. authorities to request information from companies subject to U.S. jurisdiction, even if their servers are located in Europe.

What Are the Practical Steps Europe Is Taking to Build Digital Independence?

The European Commission is pursuing several concrete measures to reduce dependence on foreign technology providers and build homegrown alternatives:

• Data Center Expansion: CADA aims to at least triple the European Union's data center capacity over the next five to seven years, ensuring sufficient computing power to support artificial intelligence and cloud services growth
• Regulatory Streamlining: The proposal speeds up and simplifies permitting procedures for new data center facilities, improving access to energy, land, water, and financing
• Gatekeeper Designation: In June 2026, the European Commission informed Amazon and Microsoft of its preliminary view that AWS and Azure should be designated as "gatekeepers" under the Digital Markets Act, extending EU regulation into cloud infrastructure itself
• Interoperability Requirements: The Data Act, which began to apply in September 2025, includes measures designed to make it easier for customers to change cloud providers by improving interoperability and reducing technical and financial barriers

The reason for this urgency is artificial intelligence. Advanced AI models require enormous amounts of computing power, specialized processors, data centers, storage systems, high-speed networks, and vast quantities of energy. AI is turning data centers into the factories that will produce much of the digital economy of the future. Without control over this infrastructure, Europe cannot ensure that its AI systems remain independent or that critical decisions about technology deployment remain in European hands.

The European Commission's approach reflects a fundamental shift in thinking. Rather than trying to push U.S. companies out of the European market or build a digital fortress isolated from the United States and China, Brussels is pursuing a strategy of strategic autonomy. The goal is for Europe to have enough homegrown alternatives to be able to choose, negotiate, and, if necessary, do without a foreign supplier in technologies it considers critical.

These legislative proposals have not yet become law and must still make their way through the EU's policymaking process. However, they offer a clear indication of the direction Brussels wants European technology policy to take. For the first time, Europe is treating digital infrastructure not as a business issue but as a matter of national security and democratic sovereignty.