Cloud, data centres and digital sovereignty: what is the EU deciding?

What is it?

Artificial intelligence runs on computers in large buildings called data centres. Most companies and public bodies do not own those computers. They rent computing power and storage over the internet, which is called cloud computing.

The European Union is now writing rules about both: how many data centres should be built and under what conditions, and which cloud providers public bodies may trust with sensitive work. This explainer covers those rules in plain language.

An everyday example

A hospital stores patient records and runs an AI tool that reads scans. If both run in the cloud, the hospital depends on the company that operates the servers. That raises three questions. Where are the servers, and is there enough electricity and water to run them? Who controls the company, and could a foreign government demand access to the data? And if the hospital wants to change providers, how hard and how expensive is it to leave? EU law now tries to answer each of these.

Why does it matter?

Three American companies, Amazon, Microsoft and Google, account for about 70 per cent of Europe's cloud market. European providers hold about 15 per cent, down from 29 per cent in 2017, according to 2024 data from the research firm Synergy.

Meanwhile the European Commission wants to at least triple the EU's data centre capacity in the next five to seven years. Data centres need a lot of electricity and often water, so this growth affects energy bills, local land use and the climate.

A common misconception

That "sovereignty" means banning foreign companies. The main EU proposal sets levels of trust and leaves most of the market open. Only the most sensitive public uses would require providers controlled from within the EU.

In more detail

Why are some people against new data centres?

Because the costs are local. In Ireland, data centres used 23 per cent of all metered electricity in 2025, up from 5 per cent in 2015, according to the national statistics office. Water utilities want local water availability to be a strict condition before fast-track zones are approved. Critics usually do not argue that data centres should never be built, but that communities, water companies and grid operators should have a real say before they are.

The Cloud and AI Development Act at a glance

This is the central proposal. The Commission presented it on 3 June 2026. It is not yet law. It has three parts:

• Research: support for new cloud and AI technology and national cloud and AI strategies in each member state.
• Capacity: each country would designate at least one "data centre acceleration zone" with faster permits. Projects there would count as strategic and could receive EU support.
• Autonomy: a single EU system for rating how sovereign a cloud service is, and rules on which level public bodies must buy.

The four sovereignty levels

• Level 1: data is stored and processed in the EU.
• Level 2: the provider shows independence from foreign governments and is transparent about its software supply chain.
• Level 3: the provider is owned and controlled from within the EU.
• Level 4: full control over the software supply chain and no possible foreign interference.

Governments would have to assess which public services are important for public order, such as energy, health, banking, defence and policing. For those, public bodies could only buy cloud services certified at level 2 or higher. Other public buyers would have to use level 1 services.

This matters because governments are among the largest buyers of digital services. If public bodies buy from providers that meet sovereignty criteria, public money can help European alternatives grow.

Why is it so hard to leave a hyperscaler?

Moving a few files is easy. Moving a whole organisation's systems is not. Large cloud providers offer hundreds of their own services, and applications built on them often only work there. That is why the EU treats switching rules, competition law and procurement rules as connected: each tackles a different part of the same dependency.

Competition rules: the Digital Markets Act

The Digital Markets Act (DMA) sets special obligations for very large "gatekeeper" platforms. In June 2026 the Commission said that, in its preliminary view, Amazon Web Services and Microsoft Azure should be added to the list. If that is confirmed, they would have six months to make it easier and cheaper for customers to switch providers or use several at once.

Bloomberg reported that a final decision could come in November 2026; Politico reported that it is due by December. Both companies disagree with the preliminary view.

Switching providers: the Data Act

The EU Data Act is already law and has applied since 12 September 2025. It gives cloud customers a right to switch. A customer can ask to move, and the provider must help transfer the data and applications quickly and without losing data or functions.

Until 12 January 2027, providers may still charge for switching, but only what the switch actually costs them. From that date, switching charges, including fees for moving data out ("egress fees"), will be abolished.

Where does the AI Act fit in?

The AI Act is the EU's law on artificial intelligence itself. It sorts AI uses by risk: some practices are banned, high-risk uses face strict requirements, and others mainly have to be transparent. It entered into force in August 2024 and applies in stages. Rules for high-risk uses such as hiring and education now apply from 2 December 2027, later than originally planned.

The AI Act regulates models and their uses, not data centres or cloud contracts. But the debates are connected: the large models it covers need huge amounts of computing power, mostly rented from the same cloud providers.

Where things stand in November 2026

The Cloud and AI Development Act is being negotiated. Ireland, which chairs the Council of the EU until the end of 2026, aims to reach a first compromise text among governments by then. After that, Parliament and Council must agree on a final text, so the act will not apply for some time. The DMA cloud decision is on a separate, faster track.

What does this mean in practice?

For residents near a planned data centre, the key question is how much say local authorities, water companies and the public will keep if permits are fast-tracked. For public bodies, it means assessing which services are sensitive and planning how to switch to certified providers where required. For businesses, it may mean more choice and easier switching if the DMA rules apply to cloud.

Remember: Most of these rules are still proposals. Europe is trying to build more data centres and reduce its dependence on a few foreign providers at the same time, and the details of the law will decide whether those two goals support each other. For the latest developments, read our story in The Trenches.