Is Europe stacking the deck against US tech?

On 3 June, the European Commission unveiled a sweeping package of tech policy proposals that will determine which companies get to participate in Europe's AI and digital infrastructure buildout over the next decade.

The package includes new data localisation requirements that restrict where sensitive data can be stored, procurement rules that favour European alternatives to US proprietary software, a push to triple EU data centre capacity, and measures to advantage EU chip manufacturers.

Explicitly aimed at strengthening the bloc’s “tech sovereignty”, it is a move that could prove deeply damaging for US technology companies invested in Europe and has significant implications for US tech firms’ licence to operate in the EU.

This is not a regulatory compliance push. It is a market access push – or rather, a market-restriction push – and a competitive threat that Washington and US boardrooms – from Silicon Valley to Seattle to New York – need to take seriously.

A new AI data-law provision of the proposed Cloud and AI Development Act (“CADA”) would significantly curb the storage of sensitive data in data centres outside the EU. The measures are ostensibly intended to strengthen the EU’s data security and protect against cyberattacks. But one can’t avoid detecting the distinct whiff of protectionism.

The draft regulation includes a four-tier framework for assessing the risk of localising public data outside the EU. A significant estimate of 30% would fall under tiers 2-4, from “advanced measures” to prevent third-country access to “full control” under tier 4. Any non-EU country bidding for public cloud storage contracts at level 3 or above would need to hold an EU adequacy determination for data privacy.

For the United States, this limits access to data providers operating under the EU-US Data Privacy Framework. The EU would also recognise only countries that offer reciprocal access to their own data for EU cloud computing services. Providers would need to demonstrate that their government cannot exercise control over cloud computing service providers or compel them to degrade or disrupt service.

How that’s going to be assessed is anyone’s guess. Quite literally. Because under the proposals, each EU Member State would be responsible for conducting its own risk assessment and classifying public data according to these assurance levels. What will be the basis of assessment? How rigorous, robust and reliable will measurement be?

The danger is that evaluations may be based more on politics and prejudices rather than facts and evidence. And what if two Member States reach differing assessments? The potential for chaos is enormous.

The Commission has also proposed that the EU’s economic security concerns could override bilateral trade agreements and WTO government procurement commitments. There have been calls for the EU to find a backbone again in the face of the Trump administration’s tariffs, and this initiative could represent a bold piece of unilateralism on the Commission’s side. But announcing a policy ambition is the easy bit—sticking to your guns in the face of the backlash the triggering of this provision would cause is rather more difficult. This may be more bark than bite.

Beyond sensitive-data restrictions, CADA is also an industrial-capacity play. It aims to at least triple EU data centre capacity within 5-7 years, accelerate permitting, improve access to land, energy, water, and financing, and support next-generation cloud and AI technologies.

A proposed update to the 2023 Chips Act (“Chips 2.0”) is designed to foster an “ecosystem” approach linking researchers and producers with data centres, cloud providers, and AI gigafactories, moving the EU’s focus to building demand and resilience. The Commission says the EU remains too dependent on third countries in advanced chip manufacturing and semiconductor design. Chips 2.0 will seek to reduce dependencies, strengthen supply-chain resilience, boost domestic demand, and promote advanced EU chip production.

A strategy to put open source at the centre of EU tech sovereignty is the most important measure beyond cloud/data and chips. The strategy explicitly promotes European open alternatives to non-EU proprietary solutions in critical domains and is a direct challenge to proprietary software lock-in. It doesn’t ban US vendors, but it does create a clear policy preference for open, European-controlled, interoperable alternatives—especially in public administration and critical infrastructure. US vendors will be challenged on openness, interoperability and control.

In its reaction, the American Chamber of Commerce to EU said the package “overlooks the reality of global technology supply chains and introduces significant legal uncertainty and fragmentation for businesses.” That’s the polite way of putting it.

The hard cold reality is that the package is essentially about who controls Europe’s digital and AI infrastructure. What it seeks to do from a policy perspective is establish a regime where EU ownership, control, supply-chains, and exposure to third-country interference become competitive criteria. It’s a naked play to comprehensively stack the deck in favour of European providers. European Commission President Ursula von der Leyen put it clearly enough: “We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure. This is about protecting our citizens, defending our interests and making our own choices.”

US companies may still participate, but they will face a procurement environment that is clearly political and designed to disfavour them. The window to shape these rules remains open– for now. US companies that engage early, demonstrate European investment, and make credible arguments for why their participation serves European interests will be best placed to compete. Those that wait for the rules to be finalised will find themselves managing constraints they had no hand in creating.

The EU has made its ambitions clear. The question is whether US business will take them seriously before it is too late.