EU's Cloud and AI Development Act: Can Europe regulate its way to technological leadership?

15.09.2026

Over the past two decades, the European Union has become the world’s leading regulator of the digital economy, setting many of the rules governing how technology companies operate worldwide. Yet while Brussels has shaped global standards through the GDPR, the Digital Markets Act, the Digital Services Act, and the AI Act, Europe has failed to produce technology companies that can compete with America’s and China’s digital giants.Seeking to close this technological gap, the European Commission unveiled the Cloud and AI Development Act (CADA) in June 2026, an ambitious proposal to strengthen Europe’s cloud infrastructure, accelerate AI development, and reduce dependence on foreign technology providers. Yet rather than addressing the structural barriers that have long constrained Europe’s innovation ecosystem, the proposal relies on protectionist measures designed to favor domestic providers.

Protectionism in the name of digital sovereignty

At the heart of the Cloud and AI Development Act is the concept of digital sovereignty. The proposal translates this idea into a four-tier framework that classifies cloud and AI providers by ownership, legal jurisdiction, and operational control. The higher the tier, the stricter the requirements, with the highest levels reserved primarily for European-owned and European-controlled providers. In practice, this means that governments would increasingly favor European-controlled providers when purchasing cloud services for sensitive sectors such as healthcare, finance, energy, defense, and public administration.

The rationale behind this approach is Europe’s growing concern over its dependence on foreign technology providers. Policymakers fear that foreign laws—especially the US CLOUD Act—could allow authorities outside the European Union to access sensitive European data. Yet CADA moves well beyond narrowly defined security safeguards. Rather than evaluating providers primarily on measurable standards such as encryption, cybersecurity certification, operational resilience, and independent audits, the proposal places considerable weight on nationality, ownership, corporate headquarters, and even personnel citizenship.

Security should be judged by outcomes, not nationality. Providers should qualify by demonstrating that their systems are secure, reliable, and resilient—not simply because their owners or employees are European. A European company with weaker safeguards should not receive an automatic advantage over a rigorously audited American, Japanese, or British provider offering stronger protection.

This emphasis on nationality also extends to CADA’s public procurement rules. Providers receive additional credit for their “Union added value,” including the European share of their research, hardware, and supply chains. As a result, public contracts would increasingly be awarded not only on price, quality, reliability, and security, but also on where a company is based.

Supporters argue that this approach is necessary to curb the dominance of Amazon Web Services, Microsoft Azure, and Google Cloud, which together control about

70% of Europe’s cloud market, while European providers continue to lose ground.Yet these companies built their leadership through decades of investment and innovation, not government protection. Europe will not create globally competitive cloud providers by shielding them from foreign rivals. Protection may increase their domestic market share, but it cannot replace the competitive pressure that drives innovation, efficiency, and long-term success.The proposal also risks deepening tensions with the United States. CADA would make it harder for American providers to compete for valuable public-sector contracts unless they establish costly “sovereign cloud” infrastructure within Europe. Coming after the Digital Markets Act and the Digital Services Act—regulations that Washington already views as disproportionately targeting American tech companies—CADA could reinforce US concerns that Europe is using digital regulation as a form of protectionism and further strain transatlantic trade relations.

Why protectionism will weaken Europe’s future

The most immediate consequence of CADA’s sovereignty rules is likely to be higher costs. Sovereign-cloud services typically cost 20–30% more than global alternatives while offering fewer features and slower access to new technologies. Those costs would ultimately fall on taxpayers, hospitals, universities, startups, and businesses.

European businesses are already warning of these consequences, and the concerns extend even to the defense sector. Companies across banking, manufacturing, and defense argue that restricting access to American software, cloud services, and AI would raise costs, create greater risks, and weaken Europe’s competitiveness. Having spent decades building their operations around these technologies, many note that comparable European alternatives often do not yet exist. As Volvo CEO Håkan Samuelsson warned, Europe “would be the only loser” if barriers to US technology were introduced. Business leaders have instead urged policymakers to strengthen the single market, deepen capital markets, avoid protectionist measures, and reduce regulatory burdens.

Nor is it clear that the rules would weaken the American giants they are intended to challenge. Amazon, Microsoft, and Google are far better equipped than their smaller European rivals to absorb compliance costs, with the financial resources, legal expertise, and technical capacity to adapt to complex regulatory requirements. The result could be a policy that entrenches established firms by making it more costly for smaller competitors to enter and compete.

Europe also cannot afford to discourage the investment needed to close its technological gap. The European Commission estimates that expanding Europe’s data-center capacity will require around €200 billion in mostly private investment. Yet private capital flows to open, competitive markets with predictable rules—not ownership-based restrictions. Many of the companies CADA targets are already investing billions in European data centers, creating jobs and expanding infrastructure across the continent. Discouraging these investments would undermine the very technological capacity CADA seeks to build.

More fundamentally, CADA misdiagnoses Europe’s challenge. Europe’s problem is not a lack of digital sovereignty, but a lack of competitiveness. Rather than protecting domestic firms from foreign rivals, policymakers should address the barriers holding them back: high energy costs, fragmented capital markets, burdensome regulation, and weak investment incentives.

Technological leadership cannot be legislated into existence. It emerges from open markets, a business-friendly environment, entrepreneurial risk-taking, and strong competition. If Europe wants to lead the next technological revolution, it must stop trying to regulate its way to competitiveness and create the conditions for innovation and investment to flourish.

Mohamed Moutii is a Research Associate at the Arab Center for Research, a Research Fellow at the Institute for Research in Economic and Fiscal Issues (IREF Europe), and a member of the Ibn Khaldun Initiative for Free Thought. He has translated numerous books from English into Arabic, contributing to the dissemination of free-market ideas across the Arab world. His research and writing focus on economic freedom, trade, development, and public policy, and his work has appeared in AIER, FEE, Econlib, IREF Europe, and the Montreal Economic Institute.