Europe's generals push back on cloud sovereignty, and the hyperscalers' moat shows
Defence officials are pressing Brussels to soften rules that could shut Amazon, Microsoft and Google out of the most sensitive public work. The fight will decide how big Europe's sovereign cloud market can become.
Europe's effort to reduce its dependence on American cloud computing has found an unexpected opponent: its own defence establishment. Defence officials and contractors are pressing Brussels to amend the proposed Cloud and AI Development Act, warning that restrictions on foreign providers could leave European militaries with inferior systems, greater cyber exposure and weaker data sharing within Nato, the Financial Times reported on September 4. Amazon, Microsoft and Google declined to comment.
The dispute matters well beyond defence ministries. Amazon Web Services, Microsoft Azure and Google Cloud hold roughly 70 per cent of the European cloud market. The act is the most serious attempt yet to carve out a protected segment of public demand for European providers. How wide that segment turns out to be will determine whether sovereign cloud becomes a real growth market for European startups and their investors, or remains a niche protected by procurement preference.
What Brussels has proposed
The Commission published the proposal on June 3 as part of a wider tech sovereignty package. It starts from an uncomfortable statistic: the share of the European cloud market held by EU-based providers fell from about 29 per cent in 2017 to around 15 per cent by 2022. Its remedy is a framework of four assurance levels that public bodies would apply after mandatory risk assessments of their activities.
The lowest level, required of almost every provider serving the public sector, demands that infrastructure and customer data sit in the EU. The middle levels add requirements on personnel, certification and separation from non-EU parent companies, and can apply to sectors such as energy, healthcare and transport as well as to security, law enforcement and defence. Level three requires ownership and control in the EU. Level four, the strictest, rules out any control by a third country, without exceptions. The Commission estimates that only about 1 per cent of European public services would fall into the highest tier.
The act also tells public buyers to weigh "Union added value" as a non-price criterion in cloud and AI tenders, and codifies an open source first principle for the public sector. The Commission's open source strategy notes that the EU "currently spends EUR 264 billion a year on US proprietary IT products and services."
Why defence objects
The officials' argument is practical rather than ideological. Sources quoted in the reporting put the American lead in cloud and AI defence platforms at 8 to 10 years. The F-35 fighter, flown by several European air forces, depends on a support ecosystem that runs on American cloud services. James Appathurai, a Nato deputy assistant secretary-general, has stressed that allied militaries must exchange battlefield data seamlessly and at speed. Opposition to strict sovereignty rules is reported to be strongest in eastern and Nordic states, which place the alliance's north-eastern flank and access to allied systems above industrial policy.
The irony is that the same governments are acutely aware of the risk the act is meant to address. Finland's foreign minister, Elina Valtonen, has said Helsinki is preparing for the risk of a foreign supplier "kill switch". The disagreement, then, is less about whether dependence is dangerous than about whether an abrupt break before credible European alternatives exist would be more dangerous still.
It is worth being clear about what the proposal does not do. As commentators have noted, it does not propose a blanket ban on American companies, and at intermediate levels a non-EU provider can still qualify by meeting conditions on ownership, operational independence and legal exposure. The act still has to pass trilogue negotiations between the Council and the European Parliament, and the sovereignty framework is expected to be the central point of contention.
The market forming underneath
While the legislation is argued over, buyers are already acting. In July Airbus said it would move 70 of its most critical applications, part of roughly 900 it needs to run as a "minimum viable company", from AWS to Scaleway, the French provider owned by iliad. Techzine reported that the tender was worth more than €50 million over up to 10 years. Catherine Jestin, Airbus's digital chief, said the arrangement "keeps our critical data assets shielded from foreign extraterritorial laws", and that Scaleway was competitive on price with the hyperscalers. She was equally clear about the limits: "We do not intend to move away from all non-European solutions; we balance our choices based on the criticality of the data."
On September 3 the Swiss Federal Council published the results of a feasibility study in which 172 federal employees tested openDesk, a German open source collaboration suite. A pilot covering 3,000 workstations, backed by CHF 9 million from the Federal Chancellery, will run alongside Microsoft 365 rather than replacing it, in an administration of more than 54,000 computers.
The pattern in both cases is the same: sovereignty is being applied selectively, to the most critical workloads, with American services retained for everything else. The hyperscalers are adapting accordingly. AWS is backing a €7.8 billion investment in Germany through 2040, and Microsoft is investing more than CHF 325 million in Swiss AI and cloud infrastructure. Their bet is that local data centres, local staff and legal ring fencing will satisfy most buyers below the top tier.
What it means for startups and investors
For European cloud, security and open source companies, the tiered approach is both an opportunity and a ceiling. Demand at the top tier is real and protected, but it is small by design; 1 per cent of public services is a market for a few well capitalised providers, not a sector. The larger prize lies in the middle levels, where European providers will compete directly with sovereign versions of American services and where price, features and reliability still decide contracts. The "Union added value" criterion helps, but the act describes it as ancillary rather than decisive.
The defence pushback adds a further risk. If Brussels softens the rules for militaries, the most demanding and best funded customers could remain outside the protected market. Startups that sell into defence, whether software, AI tooling or secure communications, should assume interoperability with American platforms will remain a buying requirement for years.
Our view
The defence lobby has a point, and Brussels should listen. A sovereignty rule that forces militaries off systems they cannot replace would weaken Europe, not strengthen it. But the episode also exposes the true size of the hyperscalers' moat: after years of political rhetoric, Europe's most security conscious buyers still conclude they cannot do without American cloud.
That is a sobering message for investors who have treated sovereign cloud as a policy driven growth story. The opportunity will be earned in the middle tiers, contract by contract, as Scaleway has done with Airbus, rather than handed over by regulation. Founders should build products that win on capability and price, with sovereignty as an advantage rather than the whole pitch. What to watch: amendments for defence in the trilogue, how member states classify their services in the first risk assessments, and whether other large industrial groups follow Airbus.
Sources
- Dealroom News: Defence officials resist EU plan to curb reliance on US tech giants (Financial Times)
- AI Weekly: European defence officials push back on EU cloud sovereignty
- Defence Matters: European defence officials challenge EU curbs on US cloud dependence
- Inside Global Tech: The EU Cloud and AI Development Act in depth
- The Next Web: Airbus is moving its most critical apps off AWS to a French cloud
- It's FOSS: Switzerland's Federal Government is replacing Microsoft on 3,000 computers
Filed under Big Tech. Written by InvestTimes Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.
