Views: 57
The digital sovereignty (DS), principally, is the ability of a state (on a national level and/or the group of states, globally) to independently control its “digital dimension” and perspectives; i.e. in citizens’ data, hardware, software codes and standards. The European DS initiative is presently seriously vulnerable due to lack of its own hyperscalers; hence, the EU is “balancing” between external digital technologies and the European values in the DS’ regulatory essence, in order to maintain legal and physical control over the data for the private/public actors and the corporate community.
Background
The total dominance of American hyperscalers is creating a large-scale political and legal crisis for the EU. Main risks and conflicts for the EU include:
= Jurisdictional conflict: the US CLOUD Act vs. GDPR (Schrems II Issue, described below), which is becoming a main headache of the European DS and legal regulations. The American CLOUD Act (Clarifying Lawful Overseas Use of Data Act) obliges American IT companies to provide the US intelligence agencies (and the government agencies) with access to their clients’ data upon a court request, even if these servers are physically located in Europe (for example, the AWS data center in Frankfurt). However, the DS in the EU is to be seen as an integral part of a larger European strategic autonomy’s concept.
More in: https://aws.amazon.com/compliance/cloud-act/
The European GDPR categorically prohibits the transfer of the EU citizens’ personal data to other countries without an adequate level of protection (which, after the repeal of Privacy Shield in the famous Schrems II case, includes also the USA), unless there are special grounds for this. The Schrems II case (Case C-311/18) is a landmark Court of Justice of the European Union (CJEU) ruling in 2020 that invalidated the EU-US Privacy Shield act and imposed strict conditions on how European companies transfer personal data to countries outside the EU.
Note. Mr. Schrems, an Austrian national residing in Austria, has been a user of the Facebook social network since 2008. Any person residing in the EU who wishes to use Facebook is required to conclude a contract with Facebook Ireland, a subsidiary of Facebook Inc. which is itself established in the US. Some or all of the personal data of Facebook Ireland’s users who reside in the EU is transferred to servers belonging to Facebook Inc. that are located in the United States, where it undergoes processing.
In June 2013, Mr. Schrems filed a complaint with the Commissioner whereby he requested, in essence, that Facebook Ireland be prohibited from transferring his personal data to the United States, on the ground that the law and practice in force in that country did not ensure adequate protection of the personal data held in its territory against the surveillance activities in which the public authorities were engaged. That complaint was rejected on the ground, inter alia, that, in Decision 2000/520, the Commission had found that the United States ensured an adequate level of protection.
More on the Judgement in: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62018CJ0311
As a result, European businesses using AWS or Azure find themselves between “a rock and a hard place’s” alternative: if the provider complies with US laws, it will violate the GDPR; if it refuses, the violation of the US laws is expected.
Source: https://www.nortonrosefulbright.com/en/knowledge/publications/ad5f304c/schrems-ii-landmark-ruling-a-detailed-analysis
According to Commission data, the EU in mid-2025 relied on third countries for over 80 percent of its digital products, services, infrastructure and intellectual property. This dependency has not only put European economy at risk, it has undermined the competitiveness of EU companies, and also posed great threats to the bloc’s security.
Source: https://sciencebusiness.net/sovereignty/meps-and-commission-split-over-eus-reliance-foreign-tech
As to the infrastructure and economic dependence issues, banks, hospitals, governments and entire sectors of the EU-wide economy depend -presently- on the digital infrastructures of the main three American digital corporations (mare on that bolow). For example, in the event of the US sanctions, changes in US policy or technological failures, Europe does not have its own digital alternatives.
In addition, the lion’s share of revenues from the digitalization of the European economy goes to the budget of US corporations. EU companies typically spend between 2.5% to 8% of their total revenue on ICT services, with about 40-60 percent of that budget allocated to external digital providers, contractors and outsourced services. The exact amount depends heavily on the company’s industry, company size and specific digital needs.
At the same time, the EU legislation is targeting external online digital service providers: the US technology companies bear the vast majority of the impact from EU digital regulation. The average annual cost of complying with the regulatory provisions of the EU legislation for a large
US company is $430 million annually per company; this amounts to $2.2 billion across
the five largest U.S. technology companies. In addition to compliance costs, the US companies face significant potential financial exposure from opportunistic litigation, fines and penalties under the EU digital regulation – in the range between $4.3 billion and $12.5 billion annually per company.
More in: https://ccianet.org/wp-content/uploads/2025/03/CCIA_EU-Digital-Regulation-Factsheet_reportfinal.pdf
Modern DS’ challenges
Numerous present challenges on the global digital market are forcing the EU authorities to take urgent measures to defend its digital independence, which is popularly called sovereignty, but in the official papers – “complete self-sufficiency”.
Source: https://sciencebusiness.net/news/sovereignty/commission-announces-plans-eu-tech-sovereignty-amid-fears-competitiveness-hit
The main EU’s argument is the dominance of the world-wide digital providers, so-called hyperscalers; these are the global cloud service providers with a colossal computing infrastructure. They don’t just rent out servers; they provide computing power, database storage and software platforms, such as e.g. SaaS, PaaS and IaaS) that can instantly scale to any client load – from a small startup to a multinational corporation.
There are the following vital hyperscalers’ features, mainly from the legal and corporate points:
= 1. Global presence in the data residency and jurisdiction. The hyperscalers have data centers (the so-called Availability Zones) around the world. For a lawyer, this means that a client can physically choose in which jurisdiction their data will be stored and processed in order to comply with local laws (for example, GDPR or data localization laws).
= 2. Shared responsibility model. This is the fundamental legal concept of cloud services: i.e. the hyperscalers are only responsible for the security of the cloud itself (physical protection of data centers, hardware and core networks). The client is responsible for security within the cloud (encrypting their data, access control and setting up the firewalls). The SLA-type contracts with the hyperscalers strictly fix these boundaries.
= 3. Vendor Lock-in effect. The architecture of hyperscalers is so unique that migrating a client’s IT infrastructure from one provider to another is technically complex and costs a lot of money. Legally, this puts the client in a vulnerable position when revising prices or changing SLA conditions.
= 4. Standardized contracts. Unless a client (state and/or corporation) is of the size of Netflix or something, it is impossible to address a hyperscaler in order to get a separate contract of the type of NDA or DPA. Hence, for almost all corporate entities the standard and non-negotiable “Terms of Service” apply.
More in: https://ec.europa.eu/eurostat/web/interactive-publications/digitalisation-2025
Note. Important facts: there is not a single provider in the EU-27 that could be classified as a global hyperscale. The largest European players, such as OVHcloud, Hetzner and Scaleway are excellent hosting providers, but they are not comparable to the US “big three” in terms of scale, ecosystem of services and capital. For example, the Scaleway, as a European alternative to global hyperscalers, ensures the customers data sovereignty and provides a full range of cloud services to develop innovative solutions and scale AI projects from A to Z.
Source: https://www.scaleway.com/en/
Main global hyperscalers
The global digital market is monopolized: there are only a few real hyperscalers in the world, and they are divided into two geopolitical camps: the American (“Big Three”) and the Chinese.
= These “big three” in the USA controls about 65-70% of the world digital market:
1. Amazon Web Services (AWS): The undisputed leader; it offers the widest range of services. Historically, it became the first hyperscaler, turning Amazon’s excess server capacity into a stand-alone product.
2. Microsoft Azure – the second player in the market. It has a tremendous advantage in the corporate sector, as it easily integrates with familiar software (Windows, Office 365, Active Directory, etc.). It is often chosen by conservative big business and the public/private sectors.
3. Google Cloud Platform (GCP) – the third player; it relies on advanced technologies for working with Big Data, machine learning and artificial intelligence, as well as open-source code.
= The Asian bloc (mainly in China): Alibaba Cloud, Tencent Cloud and Huawei Cloud dominate the Asia-Pacific region. Due to geopolitical restrictions and trust issues, their presence in Western markets is limited, but they are actively expanding in Africa, Latin America and the Middle East.
The EU’s options to solve the DS problems
Since it is now economically and technologically unrealistic to create its own so-called the EU-type AWS, the Union is following the path of legal and digitally-architectural regulations:
= Gaia-X Project: it is not a competitor to existing hyperscalers, but a European initiative to create a kind of “federal cloud”. Gaia-X develops uniform standards for interoperability, transparency and security; hence, the main idea behind the project is to provide the clients an easily transfer of his data between different providers (reducing the Vendor lock-in), and the data itself is processed strictly according to European rules.
= Sovereign clouds: as soon as the existing hyperscalers do not want to lose the EU market, they suggest some compromises: e.g. creating partnerships; for example, Microsoft and Google are licensing their cloud technologies to European companies, like T-Systems in Germany or Bleu in France. In this scheme, an American company provides software, but the data center is owned and fully managed by a European company, which also stores encryption keys. In this way, the negative effect of the US CLOUD Act could be eliminated.
= Generally, tough digital legislations: the EU has already adopted several legal acts (such as Data Act, Digital Markets Act, Digital Service Act, NIS2, AI Act, etc.; there are over 50 various regulatory means in the digital sector) which have imposed strict obligations on hyperscalers for data exchange, cybersecurity and the prevention of monopoly behavior on the EU-wide territory.
Recent US administration’s export controls on Anthropic spark renewed calls for Europe to accelerate development of its own cutting-edge AI models. The US Commerce Department in mid-June 2026 ordered Anthropic to cut non-US citizens’ access to the company’s latest models; Anthropic suspended access for everyone, including the US citizens: i.e. for the first time, the US eliminated the Europeans’ access to US digital/AI perspective technologies. Hence, the only way for the EU is to take prompt actions in the following directions: to reserve existing data, and secure the EU market exclusively (or preliminary) for European tech-companies to scale and build EU-wide secure AI services. Besides, the EU would definitely follow plans to create several AI gigafactories and numerous EU-wide AI computing hubs to train their own AI models.
Source and reference to: https://www.politico.eu/article/us-anthropic-order-exposes-eu-ai-dependency/
Our comment. It is evident, that presently the world-wide hyperscalers damage the EU’s digital sovereignty. The total dominance of American hyperscalers is creating a large-scale political and legal crisis for the EU in general and the member states, in particular. Then, the lack of critical minerals is becoming a vital stumbling block for such strategic EU-wide foundations as the energy transition, the digital economy and global supply chains. As demand accelerates and geopolitical competition intensifies, governments and businesses face growing questions around investment, supply security and critical dependencies.
As to the data centers’ issues, since the AI Action Summit in February 2025, the EU was increasingly focusing on the “winning the global AI race” campaign. Soon after the summit, it launched the EU-wide AI Continental Action Plan which aimed to triple European data centers’ capacity by 2030.
Besides, fueled by the AI boom, the EU plans to relax permitting rules to make it easier for the digital technology companies to build their own data centres; but the latter’s rapid expansion is already putting immense local pressure on energy, water supplies and electricity grids.
More in: https://corporateeurope.org/en/2026/04/copy-paste-govern