EU technology sovereignty plan reshapes European digital procurement landscape, cloud services and open source become key levers

EU Technological Sovereignty Plan Reshapes Europe's Digital Procurement Landscape

In June 2026, the European Commission officially launched the "European Technological Sovereignty Package," a comprehensive legislative and policy framework covering cloud infrastructure, artificial intelligence, microprocessors, and open-source software. The core goal of this plan is to triple Europe's data center capacity within the next five to seven years and ultimately break free from reliance on American technology suppliers.

Background

Currently, approximately 85% of Europe's cloud infrastructure market is held by US hyperscale cloud providers, including AWS, Microsoft Azure, and Google Cloud. These suppliers are subject to US law, particularly the 2018 CLOUD Act, which allows US law enforcement agencies to access data stored by US companies anywhere in the world. In 2025, Microsoft acknowledged in a French court that it could not guarantee digital sovereignty if the US government requested access to data on overseas servers. The same year, the incident where International Criminal Court prosecutor Karim Khan was cut off from Microsoft services due to US sanctions further exposed Europe's vulnerability in critical digital infrastructure.

It is against this backdrop that the EU decided to take action. European Commission President Ursula von der Leyen stated: "We cannot rely on others for the technology that keeps our hospitals running, stabilizes our power grids, and secures our services. This is about protecting our citizens, defending our interests, and making our own choices."

Union Assurance Levels (UALs): A New Compliance Tier

One of the most disruptive innovations of this plan is the introduction of "Union Assurance Levels" (UALs). This is a legally enforced four-tier control system based on cumulative standards across user organizations in terms of control, jurisdiction, data processing, supply chain, and security. UALs will become part of the Cloud and AI Development Act (CADA) and will be legally binding for public sector technology procurement.

Gartner analysis indicates that UALs will cause confusion for both suppliers and buyers, as they are layered on top of numerous existing cloud sovereignty standards, including the "Sovereignty Effectiveness Assurance Level" (SEAL) of the European Cybersecurity Certification Framework, Germany's Federal Office for Information Security's "Cloud Computing Autonomy" (C3A) policy, and France's ANSSI SecNumCloud certification. Public sector CIOs will now need to shift their consideration of cloud workloads, digital infrastructure, and core applications from a physical geography concept to a legal jurisdiction concept.

Open Source Strategy: From Cost Saving to Sovereignty ToolThe planned "Open Source Strategy" marks a fundamental shift in the EU's attitude toward open source software. Previously, open source was mainly seen as a means to reduce costs or accelerate innovation, but now it has become a sovereignty mechanism to "ensure transparency, auditability, and freedom from external control." The EU will invest in skills training, support open source startups, and improve the long-term maintenance and security of key open source components.The legal mandatory nature of UALs means the EU is shifting from "advisory sovereignty" to "regulatory sovereignty." This will bring it into conflict with the United States—the U.S. Trade Representative may challenge the EU's procurement discrimination under WTO rules. However, the EU has previously demonstrated firm enforcement resolve in the Digital Services Act (DSA) and the Digital Markets Act (DMA), and the new sovereignty plan is likely to retain core provisions after negotiations.

For cross-border data flows, UALs will reinforce the trend toward "data localization." Government agencies may be required to keep sensitive data within the EU and under EU legal jurisdiction. This runs counter to the U.S.-advocated concept of "free flow of data," but aligns with the regulatory logic of the EU's GDPR.