EU Commission presents digital sovereignty package: Chips, Cloud, and AI from Europe

At its core is the CADA, a 129-page draft regulation. It sets out requirements for cloud providers that intend to supply computing power to government agencies and companies in sensitive sectors such as finance and health. Specifically, the regulation provides for four security levels, whereby providers must demonstrate, depending on the level, that their infrastructure is located in the EU, their software supply chains are transparent, and no influence from third countries is possible.

Four Security Levels for Cloud Services

"We cannot afford to be dependent on others for the technologies that ensure the operation of our hospitals, the stability of our energy grids, and the security of our services. It's about protecting our citizens, defending our interests, and making our own decisions," said Commission President Ursula von der Leyen. She pointed to Europe's existing potential: "Europe has the talent, cutting-edge research, industrial base, and internal market. Together, we must transform these strengths into technological sovereignty."

The background to the initiative is the high market concentration in the cloud sector: According to the EU Commission, over 70 percent of the European cloud market is controlled by three US providers – Amazon Web Services (AWS), Microsoft Azure, and Google Cloud. European alternatives such as OVHcloud or Schwarz Digits play only a subordinate role globally. The EU estimates that it is structurally dependent on providers outside the EU for over 80 percent of its digital products, services, and infrastructure.

CADA: Requirements for Data Centers and Providers

A specific trigger is a US law that obligates cloud providers to grant US authorities access to customer data – even if it is stored abroad. In early 2025, judges of the International Criminal Court were disconnected from their Microsoft accounts overnight after they were placed on a US sanctions list. Vice-President Henna Virkkunen described the package as a historic systemic shift from a consumer to a shaper role.

With the Cloud Act, the Commission is pursuing four goals: expanding European AI computing capacity, creating attractive framework conditions for sustainable data centers across the EU, increasing data sovereignty and operational continuity, and better protecting public order. The EU Commission aims to triple computing capacity for AI in the next five to seven years and reach the required level by 2035.

The regulation also provides for so-called acceleration zones, where particularly sustainable data centers can be built quickly and in a structured manner. In particularly sensitive areas such as defense or critical infrastructure, authorities could effectively be forced to use exclusively European software and hardware. When publicly procuring cloud and AI software, open-source solutions should generally be preferred.

Funding and Investment Needs

As examples of functioning open ecosystems, the Commission cites the EUDI Wallet for electronic identification and the decentralized social network Mastodon. For the CADA research initiative, around two billion euros are planned at the EU level over the next seven years, and about one billion euros for the open-source strategy. According to the EU, it currently spends 264 billion euros annually on non-European proprietary software; services worth around 180 million euros are to be specifically awarded to reliable EU partners in the future.

Chips Act 2.0: Demand Instead of Just Supply

In parallel with the CADA, the Commission presented the draft for a Chips Act 2.0. While the first Chips Act, introduced three years ago, primarily promoted the supply side, the new version aims to stimulate demand and reduce bureaucracy. For example, authorities and companies are to be encouraged to purchase European semiconductors preferentially, approval procedures are to be accelerated, and an excellence label for European semiconductor regions is to be introduced.

A central project is an open factory for advanced semiconductor manufacturing in a member state, which is to go into pilot production between 2030 and 2033. The prerequisite is that the participating companies are based in the EU. In a crisis, the Commission could intervene in supply chains and oblige manufacturers to suspend existing contracts with foreign customers in order to prioritize serving EU demand.

Europe's current global share of semiconductor production is stagnating at around ten percent, according to the EU Commission; by 2030, it is to rise to 20 percent. According to estimates by the ifo Institute, Europe's market share has grown from eight to eleven percent in the past three years, as expert Dorothee Hillrichs emphasized. The EU had provided 43 billion euros in subsidies for this, mostly from the national budgets of the member states. Overall, the Commission estimates the investment required for the semiconductor ecosystem by 2035 at around 120 billion euros, and for the expansion of data center capacities by 2036 at a further 200 billion euros. Brussels has initiated consultations with the member states and the European Investment Bank on a European equity and venture capital facility.

Despite these efforts, Europe remains dependent on manufacturers from Taiwan and South Korea when it comes to the actual production of state-of-the-art microchips under three nanometers. About 90 percent of the most advanced AI chips come from Taiwan. Nvidia, AMD, and Apple also have their semiconductors manufactured in Taiwan. However, the Dutch company ASML is a crucial player, as the USA and Taiwan are completely dependent on it for chip manufacturing machinery. Nvidia announced it would invest $150 billion annually in Taiwan; Taiwan expects economic growth of around ten percent this year, its strongest in 16 years.

Location Germany between Magdeburg and Dresden

In Germany, the development has not been without setbacks: Intel's plans for a chip factory in Magdeburg have failed. At the same time, Dresden is developing into an important semiconductor location, the so-called "Silicon Saxony." The Taiwanese manufacturer TSMC is investing there together with Bosch, Infineon, and NXP in a new factory, which, however, will produce chips for automotive applications such as assistance and infotainment systems, not for AI. Chancellor Merz praised Saxony at the East German Economic Forum as "one of the most important microelectronics clusters in all of Europe." The DAX group Infineon has built another facility at its Dresden site in record time.

However, Professor Klemens H. Fischer from the University of Cologne warned that dependencies would not change but rather intensify, especially in the area of rare earths. High energy and labor costs have so far made the production of high-performance chips in Europe unattractive. The EU Commission has responded with its own energy roadmap: Energy Minister Dan Jørgensen stated that technological sovereignty is impossible without energy sovereignty. Accordingly, data centers will in future receive a binding sustainability rating, waste heat will be used more extensively, and smart meters will be expanded EU-wide. Furthermore, an independent AI model, trained on European data, is to be developed for the entire energy sector.

As early as Monday, before the presentation, 13 European tech companies – including OVHcloud, Proton, Mastodon, Nextcloud, and Ecosia – together with non-governmental organizations and the Greens in the European Parliament, called for a change in course. The digital association Bitkom welcomed the proposals; President Ralf Wintergerst praised that the Commission is setting the right priorities, Europe now needs speed. The European Parliament, meanwhile, intends to lead the way with its own signal: From June 4, 2026, Qwant will be the default search engine in the Microsoft Edge and Mozilla Firefox browsers; however, users can change the setting manually.

Reactions and Outlook

Before the package can enter into force, the EU member states and the European Parliament must deliberate and adopt it. The Commission also plans to publish a call for tenders for AI gigafactories in July, thus operationally supplementing the package. The EU Commission estimates that data centers in the member states consumed as much electricity in 2024 as nearly 20 million European households in one year.

Even before the presentation in Brussels, Nvidia CEO Jensen Huang had unveiled a new chip called "RTX-Spark" at the Computex trade fair in Asia, which is intended to enable complex AI applications on home PCs. Huang said the PC is being "completely reinvented after 40 years," comparing the development to the transformation of the telephone into a smartphone. The chip is manufactured in Taiwan – a fact that further underscores the strategic direction of the Brussels package.