European Union Proposed New Cloud and AI Data Act
The legislation tabled on June 3, 2026, aims to curb reliance on U.S. firms and boost data sovereignty.
Updated on Oct. 2, 2026 in Data Centers
Live Poll
Should nations restrict foreign companies from sensitive public cloud contracts to ensure technological sovereignty?
On June 3, 2026, the European Union tabled the Cloud and AI Development Act to address digital dependency by restricting U.S. companies from sensitive public cloud contracts. The policy seeks to bolster European data-center infrastructure while tightening oversight on digital assets.
Why it matters
The move aims to reduce critical technology dependencies and mitigate potential hybrid threats by ensuring European control over state digital infrastructure. It marks a significant shift in digital autonomy for the bloc, which currently relies heavily on non-European providers.
The act establishes a hierarchy of assurance levels, mandating Level 1 for public contracts and Levels 2 to 4 for sensitive sectors like defense and justice. It outlines a target to triple European Union data-center capacity over the next 5 to 7 years.
The players
European Union
The European Union is a political and economic union of 27 member states that governs the development of regional digital policies.
United States
The United States is a nation whose technology firms currently control a dominant share of the global and European cloud infrastructure market.
Amazon
Amazon is a global technology corporation and a major provider of cloud computing services to public and private sectors.
Microsoft
Microsoft is a multinational technology company that serves as a primary provider of public cloud infrastructure globally.
Google is a technology leader and provider of cloud services that faces new regulatory scrutiny under the proposed EU legislation.
The details
The act categorizes the United States as a third country, requiring member states to conduct risk assessments for public digital activities under Article 29. Access to high-level cloud contracts will be restricted to entities participating in EU joint ventures or those meeting stringent compliance requirements.
Timeline
The Cloud and AI Development Act was tabled on June 3, 2026.
The target timeframe for tripling EU data-center capacity is 5 to 7 years.
The Tech Race
This legislation follows the security framework pattern set by the NIS2 Directive regarding the protection of critical digital networks. By mandating higher assurance levels for sensitive sectors, the EU aims to replace reliance on foreign tech with a sovereign digital ecosystem.
Government agencies and organizations in sensitive sectors may face shifts in service providers or technical procurement requirements as compliance standards rise. These changes could alter the available digital toolsets for public administration, prioritizing systems that meet the new EU assurance hierarchy.
The takeaway
The move signals a long-term transition toward localized digital infrastructure within the European market. Organizations should anticipate stricter compliance and auditing standards as the bloc works to triple its internal data-center capacity over the coming years.
Further reading
For more on infrastructure trends, see the latest Data Centers reports.
Live Poll
Should nations restrict foreign companies from sensitive public cloud contracts to ensure technological sovereignty?
