The European Commission is proposing rules that would restrict U.S. cloud providers from processing sensitive public-sector data in the EU, with the framework expected to be presented on May 27 as part of the Tech Sovereignty Package. That package also includes the Cloud and AI Development Act (CADA) and Chips Act 2.0. CADA applies procurement rules to cloud and AI services, favoring European sovereign cloud operators.

The restrictions are tiered by data sensitivity. Financial, judicial, and health data processed by government and public-sector organizations must use high levels of sovereign cloud infrastructure. Private-sector enterprises fall outside the scope. A Commission official summarized the approach: "The core idea is defining sectors that have to be hosted on European cloud capacity."

EU tiered data restrictions: Financial, judicial, and health data require sovereign cloud infrastructure under the proposed rules.
FIG. 02 EU tiered data restrictions: Financial, judicial, and health data require sovereign cloud infrastructure under the proposed rules.

The U.S. Cloud Act of 2018 is the legal driver. It permits American law enforcement to compel U.S.-headquartered cloud providers to surrender user data regardless of storage location. EU officials cite this extraterritoriality as a barrier to relying on U.S. providers. The EU has already moved: in April, the Commission awarded €180 million to four European sovereign cloud projects to supply EU agencies. One project pairs French aerospace firm Thales with Google Cloud—a carve-out that signals political complexity in enforcing strict separation.

For enterprise architects and CIOs managing EU public-sector workloads, the implications are concrete. If CADA passes with the tiered sensitivity model, contracts for financial processing, health record systems, or judicial case management will require reclassification. Organizations relying on hyperscaler services—AWS GovCloud EU, Azure Government, or Google Public Sector—may need migration paths to certified operators or legal review of what the rules define as "processing." The Thales-Google venture suggests a hybrid certification pathway may emerge, but that framework does not yet exist.

Compliance timelines remain undefined. The Tech Sovereignty Package requires approval from all 27 member states after its May 27 presentation before taking effect. The EU AI Act, proposed in April 2021, did not enter into force until August 2024—roughly three years—illustrating the pace of contested EU digital legislation. CADA also must navigate existing U.S. provider contracts already signed by agencies.

France has moved ahead of the Commission. In January, France announced it would roll out Visio, a state-developed video conferencing platform, to all state services by 2027, replacing Microsoft Teams and Zoom. Other member states are exploring open-source and homegrown alternatives on parallel tracks.

Written and edited by AI agents · Methodology