EU Tech Sovereignty Package: Chips Act 2.0 and the Cloud and AI Development Act Explained

Why June 2026 Is a Turning Point for Digital Policy

Europe has debated digital sovereignty for years. On June 3, 2026, the European Commission converted that debate into legislation. The Technological Sovereignty Package — four interconnected initiatives covering cloud, semiconductors, open source, and energy AI — was adopted following a multi-year reckoning with exactly how exposed EU infrastructure had become. The Commission’s announcement framed the moment starkly: “We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure,” said Commission President Ursula von der Leyen.

The trigger conditions are quantifiable. US cloud providers — Amazon Web Services, Microsoft Azure, and Google Cloud — control more than 70% of the European cloud market. EU semiconductor production accounts for less than 10% of global output. The EU spends approximately €264 billion per year on US IT products and services. Against that backdrop, the package is less a strategic luxury than a calculated response to structural dependency.

The package arrives at a geopolitically charged moment. Brussels simultaneously joined the US-led Pax Silica chip alliance targeting China, creating an apparent contradiction: the EU is deepening security cooperation with Washington while also legislating to reduce reliance on American cloud providers. That tension is not accidental — it reflects the Commission’s attempt to maintain openness with “like-minded partners” while protecting critical infrastructure from extraterritorial legal exposure, particularly the US CLOUD Act (2018), which compels American companies to provide data to US authorities regardless of where that data is physically stored.

What the Package Contains: Four Pillars

The Technological Sovereignty Package consists of four distinct but interdependent initiatives:

1. Cloud and AI Development Act (CADA). The centerpiece legislative proposal. CADA establishes a four-tier sovereignty framework for public-sector cloud procurement, targets tripling EU data-center capacity within five to seven years, and designates acceleration zones where member states must issue data-center permits within 12 months. The CADA proposal page on the Commission’s digital strategy portal describes it as addressing “a structural deficit in data-centre capacity and dependence on a limited number of non-EU cloud computing service providers.”

2. Chips Act 2.0. A revision of the 2023 original, which fell short of its 20%-of-global-market-share target by 2030. The updated act shifts from market-share targets to supply-crisis management: it grants the Commission emergency powers to override semiconductor supply contracts during shortages, establishes a centralized EU-wide chip purchasing system to consolidate negotiating power, and imposes fines of up to €300,000 for violations of reporting obligations. Pilot production of advanced EU semiconductor facilities is targeted for the 2030–2033 period, with an EU Blueprint for semiconductor crisis management due in Q2 2027.

3. EU Open Source Strategy. A non-legislative initiative to scale open-source alternatives to proprietary US platforms, reduce vendor lock-in in public administrations, and invest in open-source skills development.

4. Strategic Roadmap for Digitalisation and AI in Energy. Integrates data centers into EU energy systems, deploys AI solutions for grid management, and develops sovereign AI models for the energy sector — an acknowledgment that data centers now consume 2.5% of EU electricity and that AI energy demand is accelerating.

The CADA Sovereignty Tiers in Detail

The most legally consequential element of the package is CADA’s four-level assurance framework, which analysts at Wilson Sonsini describe as “likely to be one of the central political battlegrounds in trilogue negotiations.”

Level 1 (Baseline): Infrastructure, assets, and customer data must be established and maintained in the EU. Provider must not report vulnerabilities to third-country authorities.

Level 2 (Enhanced): All Level 1 requirements plus: personnel and assets located in the EU; EU cloud certification; a software bill of materials with source-code audits of non-EU components; legal and technical separation from foreign parent subsidiaries.

Level 3 (Strict): Provider must be “owned and controlled in the EU.” Derogations are possible if the third country holds a GDPR adequacy decision and maintains open markets — a carve-out designed to allow US providers to qualify only if they undertake extensive corporate restructuring.

Level 4 (Strictest): EU ownership and control with no derogations whatsoever; European cybersecurity certification at “high” assurance level; provider retains effective control over all software components. Defence procurement falls here — a tier that currently excludes all US hyperscalers.

Critically, the framework applies mandatorily to cloud providers serving the public sector with only very narrow exceptions. Public bodies whose activities contribute to public order, national security, defence, justice, or law enforcement — and those covered by NIS2 in sectors such as digital infrastructure, energy, research, and healthcare — may only use providers meeting Levels 2, 3, or 4. Private entities designated as “essential” under NIS2 may conduct similar assessments, though the Commission may later mandate this through secondary legislation.

The practical impact: Amazon, Microsoft, and Google must either restructure their EU operations to meet Level 2 or 3 criteria — establishing legally and technically independent EU subsidiaries with EU-controlled personnel and supply chains — or accept exclusion from substantial public-sector revenue streams. The transition creates significant uncertainty until member states complete individual sovereignty risk assessments, which may temporarily slow public-sector cloud adoption.

What Technology Leaders, Legal Teams, and Policymakers Should Do

1. Map Your Cloud Exposure to CADA’s Tier Requirements Now, Not in 2029

CADA’s legislative timeline targets final law by Q4 2027 with implementation running through 2029–2030. That may sound distant, but cloud migration cycles run 18–36 months on average, meaning procurement decisions made in 2026–2027 will still be active when CADA applies. Technology leaders and CIOs at organisations serving EU public bodies should immediately audit which cloud providers they use and under which proposed tier those providers would qualify. The four-level framework maps cleanly onto sensitivity: Level 1 for general administrative workloads, Level 2 for healthcare and financial data, Levels 3–4 for security and defence. If your current provider cannot meet the required tier for your use case, you have a three-year window to migrate — and that window opens now. European alternatives such as OVHcloud, IONOS, STACKIT, and Hetzner already market Level 1–2-compliant architectures; evaluate whether they can scale to your requirements before the hyperscaler restructuring timeline becomes clear.

2. Audit Semiconductor Supply Chains for Taiwan Dependency Before the Crisis Framework Activates

Chips Act 2.0’s most immediate provision is not about building EU fabs — that won’t bear fruit until 2030–2033 — but about crisis management. Taiwan currently produces over 90% of the world’s advanced semiconductors. The Chips Act 2.0 grants the Commission power to override supply contracts and activate a centralized purchasing system during declared shortages. Hardware-dependent organizations — automotive, telecom, defence contractors, and anyone building edge AI devices — should conduct a full semiconductor supply-chain audit now, mapping which components originate from Taiwan-based foundries (TSMC, UMC) and which have EU or US alternatives. The Commission’s Q2 2027 Blueprint for crisis management will define what “declared shortage” means; organisations that have already mapped dependencies will be positioned to act rather than react.

3. Engage the Member-State Risk Assessment Process to Shape Your Own Tier Classification

CADA does not centrally assign tier requirements to organisations. Instead, member states must conduct individual sovereignty risk assessments for public-sector use cases. This creates a 24–36-month window during which the tier classification for many sectors remains genuinely open. Legal and public affairs teams at cloud providers and major enterprise cloud consumers should engage national digital ministries and procurement bodies during this window — not to lobby against the framework, but to provide technical input on what Level 2 or 3 compliance actually entails for their architecture. The Wilson Sonsini analysis notes that “significant uncertainty” in this period may slow cloud adoption; organizations that actively participate in shaping the risk-assessment criteria for their sector will face fewer surprises when the final classifications land. Companies with a €120 billion investment gap to close by 2035 should also explore Commission co-investment vehicles such as Important Projects of Common European Interest (IPCEIs), which fund CADA-aligned infrastructure projects.

What This Signals for Digital Policy Beyond Europe

The EU Tech Sovereignty Package is not just a European story. Its effects propagate outward in three directions.

First, the compliance extraterritoriality effect. Any non-EU company that sells cloud services to EU public bodies — or any multinational that uses EU-based cloud infrastructure for regulated European workloads — must now plan for CADA compliance regardless of where they are headquartered. The €264 billion per year that Europe spends on US IT is enough market leverage to force architectural changes on the largest providers in the world. AWS, Microsoft, and Google will restructure EU subsidiaries not because Brussels mandates that they do so globally, but because the EU market is too large to walk away from.

Second, the regulatory cascade effect. GDPR set a global baseline for data privacy regulation that dozens of countries subsequently adopted or referenced. CADA’s four-tier cloud sovereignty framework is positioned to do the same for cloud independence. Countries navigating their own digital sovereignty questions — from Singapore and South Korea to Gulf states to North African neighbours — will be watching whether the EU’s approach creates a workable compliance template or a protectionist barrier. The answer will arrive during the 2027–2028 trilogue negotiations.

Third, the supply-chain realignment effect. With EU semiconductor self-sufficiency targeted at a meaningful but still limited share of global output by 2033, and Taiwan supplying over 90% of advanced chips today, there is no short-term path to full European chip independence. The realistic outcome is a managed diversification: EU fab capacity for mature nodes and some advanced nodes, continued reliance on TSMC for cutting-edge production under resilience agreements, and a Pax Silica framework that coordinates export controls with the US. Companies should plan for a fragmented but more resilient supply landscape rather than a clean break.

For non-EU governments and companies watching from outside, the strategic implication is clear: the EU’s tech sovereignty agenda is not a temporary defensive posture. It is a durable policy framework that will reshape the architecture of the global cloud market, chip supply chains, and AI infrastructure investment for at least the next decade.

Frequently Asked Questions

Sources & Further Reading

• Further Reading
• Strengthening Europe’s Tech Sovereignty — European Commission
• Cloud and AI Development Act — European Commission Digital Strategy
• EU Cloud and AI Development Act in Depth — Inside Global Tech
• European Commission Publishes Proposal to Reduce Reliance on Foreign Cloud and AI — Wilson Sonsini Data Advisor
• EU Unveils Sweeping Tech Sovereignty Push — TechPolicy.Press
• EU Tech Sovereignty Package 2026: Chips Act 2.0, CAIDA and What Companies Need to Know — Innobu
• European Commission Tables Cloud and AI Development Act — Grosswald
• Europe Unveils Tech Sovereignty Package — CNBC