The EU’s Technological Sovereignty Package: new rules for cloud and chip procurement

The EU’s Technological Sovereignty Package: new rules for cloud and chip procurement

The Technological Sovereignty Package sets out the EU’s most tangible attempt yet to reduce its dependence on foreign-controlled technology. It consists of two proposed regulations, the Cloud and AI Development Act (CADA) and the Chips Act 2.0, which sit alongside the EU Open Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy. Aside from investment incentives and funding, CADA and the Chips Act 2.0 introduce mandatory regulatory obligations that could significantly reshape cloud procurement in the public and critical sectors and impose new supply chain requirements on the semiconductor industry. 

The package is part of a broader policy shift in which supply-chain resilience, public procurement and industrial capacity are increasingly treated as linked regulatory issues. EU funding rules now exclude projects using Chinese solar inverters, the proposed Cybersecurity Act 2.0 targets information and communications technology (ICT) components from certain high-risk countries, and the proposed Industrial Accelerator Act introduces “Made in EU” procurement criteria and monitoring of foreign investment in strategic manufacturing. These instruments use similar tools: they screen supply chains for foreign dependencies, give weight to suppliers with EU links or controls, and reinforce that direction through funding and faster permitting.

Cloud sovereignty: new requirements for public and critical sectors

CADA introduces a new sovereignty layer for procurement of cloud services by the public sector, which can also be extended to private companies active in critical sectors, subject to a delegated act by the European Commission. 

The framework is built around four so-called Union assurance levels under the new Cloud Computing Sovereignty Framework (CCSF), the sovereignty regime within CADA, with each assurance level imposing progressively stricter limits on foreign influence over the service. Risk assessments conducted every two years determine which level applies to a given activity.

Public bodies whose activities touch on public order in critical sectors will have to use providers certified at the second level or higher (depending on the relevant risk assessment); all other public bodies must use a provider certified at the baseline level. The European Commission may extend these requirements to private companies in the same critical sectors as defined in the NIS2 Directive (NIS2), including digital infrastructure providers.

What the assurance levels require

The CCSF is less concerned with conventional IT security than with limiting the influence of foreign states over European cloud infrastructure. 

As the levels rise, the constraints on foreign control tighten:

• The first (baseline) level requires EU establishment, EU data location and self-certification, providing baseline safeguards against third-country influence. 
• At the second level, the provider and all its subcontractors involved in providing the service must be EU-based, and the provider must guarantee that no foreign actor can access customer data, disrupt the service, or compel it to comply with foreign sanctions. This is, in effect, a “kill switch” provision: an assurance that control over the service cannot be exercised from outside Europe. At this second level, the framework also prohibits the use of customer data to train or fine-tune any AI system operated by a third country or a third-country entity, ensuring such data does not leave the EU. 
• The third level goes further by prohibiting third-country control of the provider and relevant subcontractors altogether, and requiring that relevant staff be EU citizens. The only way in for a provider controlled from outside the EU is if the European Commission has formally recognised that provider’s home jurisdiction satisfies prescribed country-level conditions, including a GDPR adequacy decision and the absence of measures enabling incompatible data access, service disruption or the enforcement of foreign sanctions, and the provider demonstrates the required safeguards.
• At the fourth and highest level, third-country control over the provider and relevant subcontractors is prohibited without exception and extends to effective third-country control over relevant software components. Sensitive data must remain in the EU at all times.

Only the baseline level permits self-certification; from the second level upwards, providers must obtain an independent external audit and renew it every year.

The framework appears to be inspired in part by a recent incident where a senior official at an international court reportedly had his Microsoft account suspended following US sanctions. The concern is that providers subject to a third country’s jurisdiction may be required to take measures affecting service access or continuity. Similar concerns can be seen in recent US legislative proposals, including the proposed “AI Kill Switch Act”, which would require AI developers to maintain the ability to suspend or shut down AI systems under certain circumstances. The CCSF reflects a comparable focus on ensuring that control over critical digital services cannot be exercised from outside the EU.

What it means for providers and buyers

The practical consequences of the framework could be significant: foreign-controlled providers, including US-headquartered ones, subject to foreign intelligence laws, may still be able to reach the second level, provided they can demonstrate the safeguards described above against third-country access, disruption or coercion. The third level, by contrast, is likely to remain out of reach unless the provider’s home jurisdiction is recognised by the European Commission as offering equivalent safeguards. It also remains unclear to what extent governance mechanisms such as golden shares, sovereign veto rights, local control arrangements or similar contractual safeguards will be regarded as sufficient to mitigate concerns around third-country control for the purposes of the higher assurance levels. 

For sensitive public sector workloads, this could materially narrow the pool of eligible providers. Where a risk assessment requires migration to a compliant service, the transition period is capped at 12 months, which is a tight timetable for anything beyond a routine workload. The pressure, however, will also be felt by commercial suppliers: cloud providers serving customers who are themselves subject to critical sector regulations, such as DORA in the financial sector or NIS2 in critical infrastructure, may find these sovereignty requirements increasingly woven into their customers’ own due diligence and supply-chain risk assessments. If the requirements are formally extended to private critical sectors, affected companies across these regulated spaces may need to reassess parts of their cloud estate well ahead of any deadline.

The framework is not, however, an outright ban on non-EU providers. Contracting authorities may depart from these requirements on an exceptional basis, for instance, if no suitable recognised service is available, a previous tender failed, or compliance would entail disproportionate cost. These exceptions are likely to matter most in specialised cloud markets where EU-based alternatives remain limited, and confirm that CADA operates as a structured preference regime rather than a blanket exclusion. Compliance is also a continuous operational risk rather than a one-off hurdle. National authorities can investigate and fine non-compliant providers, and any loss of certification mid-contract could trigger damages claims from customers forced to migrate their workloads.

The effect may also be self-reinforcing. Cloud and data centre operators are themselves classified as essential entities under NIS2. This places them under pressure from two sides: first, as sellers, they must ensure that their subcontractors and infrastructure meet CADA’s sovereignty standards to serve public clients on the higher levels; and second, as buyers, if the European Commission extends the rules to NIS2 entities, they may have to apply the same sovereignty standards to the cloud and infrastructure services they procure for their own internal operations.

Chip supply chains: new Commission powers and crisis tools

Under the proposed Chips Act 2.0, the European Commission is set to receive broad powers to manage semiconductor supply chain risks, establishing a permanent monitoring platform for manufacturers and introducing extraordinary intervention tools in times of crisis.

The regulation allows the European Commission to address semiconductor supply chain risks in critical sectors, ranging from automotive, healthcare and energy to defence, data centres and AI. To improve early visibility of emerging bottlenecks, semiconductor production facilities will be required to participate in a new Business-to-Business Semiconductor Supply Chain Platform. Building on this monitoring, where the European Commission identifies a sector as particularly vulnerable, it can recommend mitigation measures and, if these are not adequately implemented, make them binding. The measures span a wide spectrum, from supply chain mapping and dual sourcing to strategic stockpiling, diversification requirements and mandatory risk assessments. 

In a declared crisis, the European Commission may go further still, directing manufacturers to accept and prioritise crisis-relevant orders and coordinating common procurement for affected Member States. Failure to comply with such priority-rated orders can attract penalties of up to 1.5 per cent of daily turnover. Manufacturers required to prioritise such orders are, in turn, shielded from contractual liability towards third parties to the extent necessary to comply.

Again, the proposal appears to be shaped by recent experience. In October 2025, disruptions at a foreign-owned European chip manufacturer reportedly halted production at several German automotive plants, illustrating how dependence on a single supplier of semiconductors can bring an entire industrial sector to a standstill. This is precisely the type of scenario the crisis mechanism is designed to address.

These powers do not stand alone. They align closely with the proposed Cybersecurity Act 2.0, which pursues a similar focus on securing ICT and semiconductor supply chains against dependence on high-risk countries. Taken together, the two instruments point to a coordinated and increasingly assertive EU approach to supply chain resilience. 

Beyond regulation: faster permits and procurement preferences

Beyond these obligations, the package also works through incentives. CADA requires Member States to designate data centre acceleration zones offering streamlined and time-limited permitting, while the Chips Act 2.0 provides comparable fast-track procedures for semiconductor manufacturing projects and allows the European Commission to steer public bodies toward EU-based suppliers, including through security of supply declarations in tenders. 

Where the legislative process stands

As of September 2026, both CADA and the Chips Act 2.0 remain at an early stage of the EU’s ordinary legislative procedure. In the European Parliament, both files remain in the preparatory phase, with committee responsibilities and negotiating teams not yet fully confirmed. Technical examination of CADA has begun in the Council, where initial discussions among Member States have focused on proportionality, alignment with existing European Union legislation, compliance costs and complexity, and the risk of fragmented national implementation. Both proposals may therefore change materially during the legislative process. On the current indicative timetable, negotiations between the European Parliament and the Council on CADA are unlikely to begin before 2027, and political agreement is not currently expected before late 2027. The Chips Act 2.0 is likewise expected to progress during 2027, with political agreement targeted for the second quarter of that year.

A deliberate turn, and a contested one

The initial concerns raised by Member States in relation to CADA reflect a broader disagreement about the EU’s approach. Industry voices argue that resilience is better achieved through consistent security standards and contractual accountability applied equally to all providers, rather than through restrictions based on ownership and nationality. That tension is unlikely to be resolved soon, and early pushback against the proposals suggests it will continue throughout the legislative process.

That debate, however, may not settle the matter. Similar objections have been raised in adjacent fields, such as the ban on EU funding for Chinese solar inverters, without stopping the process so far. Given the EU’s current priorities and the general international developments, it appears rather likely that this pushback, too, will not be reflected in the final text. Despite the scope for change during the legislative process, for providers and companies serving government and critical infrastructure, the direction of travel is clear. The practical questions – which certification level applies, whether an external audit will be required, and how far supply chains must be restructured – are best assessed now rather than once the rules take effect. The Chips Act 2.0 would apply directly once in force, while CADA’s requirements would take effect one year later, leaving a relatively narrow window to prepare for the operational changes involved.