Summary
- DIGITALEUROPE proposes limiting strict sovereignty requirements to sensitive public workloads.
- It wants common EU implementation and greater opportunities for smaller European suppliers.
- The proposals are stakeholder recommendations, not enacted legislation.
DIGITALEUROPE has called for the European Union to limit its strictest cloud and AI sovereignty requirements to clearly defined sensitive public workloads, warning that wider restrictions could increase costs without necessarily improving security.
The industry association set out its position on 22 October as European policymakers consider the proposed Cloud and AI Development Act. The legislation forms part of the wider effort to strengthen Europe’s computing capabilities and encourage investment in cloud and AI infrastructure.
DIGITALEUROPE argues that mandatory sovereignty conditions should concentrate on particularly sensitive activities, including selected defence and justice workloads. It opposes extending the same requirements across the entire public sector without considering the different risks associated with individual services.
The association is also seeking a consistent European framework rather than separate national interpretations. Divergent implementation could require service providers to adapt the same infrastructure and operating arrangements for multiple jurisdictions, increasing the cost and complexity of cross-border services.
Its statement refers to European Commission estimates of substantial compliance costs under differing sovereignty requirements. Those figures are being used by the association to support its policy position and should not be treated as independently established costs for every provider.
Cloud sovereignty covers several distinct requirements. The physical location of data processing is one consideration, while access controls, operational jurisdiction, software dependencies and the continuity of critical services may be equally important for particular workloads.
A facility located within the EU may satisfy geographical processing requirements without resolving every question about remote administration or the organisations responsible for maintaining its systems. Conversely, nationality based procurement restrictions do not automatically guarantee technical resilience.
Risk based rules would require policymakers to establish which activities justify additional safeguards and how those safeguards can be demonstrated. The resulting definitions could influence the range of cloud providers eligible for public contracts and the infrastructure they choose to build.
DIGITALEUROPE favours a system that protects sensitive workloads while allowing broader competition in other areas. Governments may place different weight on strategic autonomy, exposure to foreign jurisdictions and the ability to maintain essential services during geopolitical disruptions.
The association also wants procurement arrangements that provide greater access for European small and medium-sized providers. Its proposals include opening a greater share of public procurement opportunities to smaller companies and directing more resources towards digital investment.
That approach depends partly on the ability of European providers to obtain suitable computing infrastructure. Hosting capacity requires buildings, electricity connections, cooling systems, networking and ongoing operational support, regardless of the nationality of the supplier.
DIGITALEUROPE refers to the European Commission’s ambition to triple the continent’s data centre capacity over the next five to seven years. The organisation argues that achieving this requires faster permitting, infrastructure investment and access to private capital.
Planning and electricity availability can remain obstacles even where customer demand and investment capital are substantial. A regulatory requirement favouring European hosted computing cannot itself create the capacity needed to satisfy that demand.
The association’s recommendations should be understood as a stakeholder intervention in an ongoing legislative debate. They do not establish new legal obligations and should not be represented as the European Commission’s final position.
Further development of the Cloud and AI Development Act will determine the balance between sensitive workload protections, supplier choice and the infrastructure investment required to expand Europe’s computing capacity.
