Europe wants more data centres and less dependence on US cloud giants. The rules for both are being written now

Seven out of every ten euros that Europeans spend on cloud computing go to three American companies: Amazon, Microsoft and Google. European providers hold about 15 per cent of their home market, down from 29 per cent in 2017, according to 2024 data from the research firm Synergy. [1]

At the same time, the European Commission wants to at least triple the EU's data centre capacity within five to seven years. [2] Those two facts now sit inside the same draft law, and the next few months will decide how they are reconciled.

The law is the Cloud and AI Development Act, which the Commission proposed on 3 June 2026 as the centrepiece of a "tech sovereignty package". [3] It pulls in two directions. It would make it faster to build data centres, and it would tell public bodies which cloud providers they may buy from.

It also lands on top of the AI Act, Europe's rulebook for artificial intelligence, which is now largely in force. Where Europe's computing will physically sit, who will control it and who sets the terms for the AI that runs on it are now being decided in parallel. Our AI Explained guide sets out the rules in plain language. [19]

Who public bodies may buy from

The procurement part of the proposal sets out four "assurance levels". At level 1, data must be stored and processed inside the EU. At level 2, a provider must show independence from foreign governments and transparency about its software supply chain. Level 3 requires the provider to be owned and controlled from within the EU, and level 4 adds full control over the software supply chain with no possible foreign interference. [2]

Governments would have to assess which public services help preserve public order, a category that covers the critical sectors listed in the EU's NIS2 cybersecurity directive as well as security, defence and policing. Contracting authorities buying cloud for those services could only choose services certified at level 2 or higher. Everyone else would need level 1. [3]

The Commission's own impact assessment explains what that means in practice. US providers working in partnership with European companies could qualify for level 2, while European providers alone would easily reach level 3. [3]

The proposal's text notes that three non-EU hyperscalers control over 70 per cent of the European cloud market and that such providers are subject to foreign laws that may conflict with EU rights. [4] In some cases, public bodies would have to replace foreign services with European ones. [5]

Reactions arrived from both sides. The Computer and Communications Industry Association, whose members include Amazon, Google and Meta, objected sharply. Daniel Friedlaender, head of CCIA Europe, called the act "a direct recipe for fragmented discrimination across Europe in 27 different ways, not only in public procurement but potentially also across thousands of private critical entities, from banks to energy companies." [20][21]

Amazon said European organisations deserve "the best technology available from trusted providers". Lawmakers who want a harder line were not satisfied either. "The proposal remains too permissive," said Christophe Grudler, a French centrist MEP. Kim van Sparrentak, a Dutch Green, said the package "finally recognizes the scale of Europe's digital dependency, but ultimately falls short." [5]

Competition rules reach the cloud

A second front is competition law. In November 2025 the Commission opened market investigations to decide whether Amazon Web Services and Microsoft Azure should be treated as "gatekeepers" under the Digital Markets Act, even though they do not meet the law's usual size thresholds. [6]

On 25 June 2026 it told both companies that its preliminary answer was yes. It pointed to entrenched customer bases, lock-in, high switching costs and the growing role of their AI tools in cloud purchasing. [7] Politico reported that a final decision is due by December; Bloomberg, cited by The Next Web, reported that it could come in November, though the date could slip. [8][9]

Designation would give the two services six months to comply with rules that make it easier and cheaper to switch providers or use several at once. [8][9]

Amazon argues that cloud is already regulated by the EU Data Act and that the findings "risk deterring European investment and innovation". Microsoft warned that "ignoring the growing power of Google Cloud and Gemini will tilt the market in a harmful way". [9]

Where the AI Act fits in

The AI Act entered into force in August 2024 and has applied in stages. Bans on practices such as social scoring took effect in February 2025.

Since August 2025, providers of general-purpose AI models, the large models behind chatbots and coding tools, have had to meet rules on transparency and copyright, and the most powerful models must also be assessed for systemic risk. Most remaining rules applied from 2 August 2026, when the Commission's AI Office gained enforcement powers over these models. [16]

The strictest part has been pushed back. The "Digital Omnibus on AI", agreed in May and in force since 27 July 2026, delays obligations for high-risk systems, such as AI used in hiring, education or critical infrastructure, to 2 December 2027, and to 2 August 2028 for AI built into regulated products. [16]

Supporters called it simplification; it also means the core safeguards arrive later than first planned.

The AI Act regulates models and uses, not the data centres they run on. But the two debates meet. Among the providers that signed the EU's voluntary code for complying with these model rules are OpenAI, Google, Anthropic, Microsoft and Amazon, alongside European developers such as Mistral AI and Aleph Alpha. [17] Three of those American signatories, Amazon, Microsoft and Google, also run most of Europe's cloud. [1]

To build European capacity, the EU is tendering for up to seven publicly backed "AI gigafactories". [24] Bids for the large-scale lot are due on 3 December, and facilities must show adequate power capacity and best practice in energy and water efficiency. [18]

Building faster, at what cost

The other half of the cloud act concerns construction.

Each member state would have to designate at least one "data centre acceleration zone" with simpler permitting. Projects there would count automatically as strategic and could receive EU support. [3]

The pressure on local resources is already visible. In Ireland, data centres used 23 per cent of all metered electricity in 2025, up from 5 per cent in 2015. Their consumption rose 10 per cent in a year, against 2 per cent for all other users. [10] In December 2025 Ireland's energy regulator updated its connection rules: new data centres must still provide generation or storage to match the grid capacity they request, and must now also meet at least 80 per cent of their annual demand with new Irish renewable power, with a six-year glide path. [22]

In Aragón, Aurora Gómez of the campaign Tu Nube Seca Mi Río ("Your cloud is drying my river") says 24 hyperscale data centres were approved in less than three years, during a drought. In Lombardy, the group Sentinelle del territorio opposes a project on farmland less than a kilometre from an existing Microsoft data centre, warning of "irreversible soil sealing". [11] The industry says the real issue is underinvestment in the grid. "We're visible, we're easy to point at," Michael Winterson of the European Data Center Association told Politico. [11]

Critics focus on who gets a say. Europe's water utilities, represented by EurEau, want local water availability to be "a hard siting test" before any acceleration zone is designated, oppose the aggregated baseline permits the act would create and want permits reviewed against actual consumption. [12]

Researchers including Fieke Jansen of the University of Amsterdam argued in EUobserver, before the proposal was published, that the plan "sidesteps sustainability" and would further disempower local governments, which already have too few tools to stop developers "with the deepest pockets" from claiming scarce energy, water and land. [13] "Environmental protections have been left out," said Sergey Lagodinsky, a German Green MEP who now drafts the legal affairs committee's opinion on the act. "There are no binding sustainability standards for data centers and no clear clean-energy obligations." [5][23]

A separate rating scheme, adopted by the Commission on 21 September and now in a two-month scrutiny period before Parliament and Council, would publish energy and water data for data centres above 500 kilowatts, with first labels expected in 2027. [14]

What happens next

In Parliament, the act's rapporteurs are Diego Solier of the conservative ECR group and Reinier van Lanschot of the Dutch Volt party, who sits with the Greens. The committees have not yet voted. [23]

Ireland, which holds the Council presidency, aims to complete a first compromise text among governments by the end of the year. [15] The act will not become law this year.