EU Moves to Limit U.S. Cloud Providers for Sensitive Public-Sector Data

The European Commission is preparing a “Tech Sovereignty Package” for presentation on 27 May. Draft provisions would require certain public-sector workloads—especially financial, judicial and health data—to be processed on cloud infrastructure located within the EU. The measures would not ban non-EU providers outright, but would limit their use for data classified as “sensitive” or “strategic.” The proposals remain under discussion.

BenzingaCNBC

Public-sector bodies across the EU rely heavily on U.S. cloud providers such as Amazon Web Services, Google Cloud and Microsoft Azure. Officials cite the U.S. Cloud Act of 2018, which allows American authorities to request data held by U.S. companies even when stored abroad, as a driver of the new rules. The move follows heightened transatlantic tension, including President Donald Trump’s recent threats of tariffs on European automobiles and criticism of NATO allies.

Benzinga

Key actors include the European Commission, which is drafting the package; U.S. cloud providers Amazon, Google and Microsoft; President Donald Trump, whose trade stance is cited; and member states such as Germany, Italy and Spain, which may adopt the rules early.

Benzinga

Sources say U.S. providers “currently dominate the European market” for public-sector cloud services and handle large volumes of health and financial records.

CNBC

Limiting foreign cloud access is presented as a step toward EU strategic autonomy, protecting data from extraterritorial claims and reducing reliance on external firms. The shift could spur investment in domestic or open-source clouds and reshape cross-border data flows.

CNBC

Commission officials said the core aim is to identify sectors that must use European cloud capacity. They emphasized that the draft does not ban overseas platforms, only restricts their role for highly sensitive data. The Commission declined comment when asked for details.

CNBC

Observers warn that sudden limits could disrupt contracts, raise public-sector costs and create interoperability problems. No formal U.S. objections appear in the sources, though the impact on European revenue is noted.

CNBC

The precise sectors, the definition of “sensitive” data and implementation timelines are not yet defined. No final text is public and member-state positions differ.

CNBC

• “The core idea is defining sectors that have to be hosted on European cloud capacity,” — EU Commission official

CNBC

• “U.S. cloud providers could face restrictions in certain sensitive and strategic sectors” — EU Commission official

CNBC

• “Tech Sovereignty Package” — European Commission

CNBC

The Commission will unveil the “Tech Sovereignty Package” on 27 May. The European Parliament and national governments will then debate the measures, with legislative votes potentially leading to phased sovereign-cloud adoption across member states.

CNBC