Policy briefs · Oct 17, 2026
European Commission Tables Digital Sovereignty Package Restricting Foreign Cloud Providers From Handling Public-Sector Data
The European Commission published a Digital Sovereignty Package on 29 September 2026 proposing that public-sector entities and critical infrastructure operators across EU member states migrate sensitive data and workloads to cloud providers meeting a new 'Sovereign Cloud' certification, which requires data processing within EU borders and prohibits parent-company ownership by non-EU entities. The package would require compliance by the end of 2029.
Contents
Key takeaways
- New 'Sovereign Cloud' certification requires full EU data residency and EU-domiciled ownership.
- Public bodies and critical infrastructure operators must comply by end-2029.
- US hyperscalers' EU subsidiaries would not automatically qualify under the ownership test.
- ENISA tasked with building the certification framework within 18 months.
- France, Germany and the Netherlands back the proposal; Ireland and Denmark have reservations.
Certification Framework
The Sovereign Cloud certification, which ENISA would administer, contains three cumulative criteria: data must be processed and stored on servers physically located within the EU; the provider must be a legal entity incorporated in an EU member state; and no more than 25 percent of ownership or effective control may rest with non-EU entities. The last criterion is the most consequential, as it would exclude US hyperscalers' European subsidiaries unless they restructure through legally independent European vehicles.
The Commission emphasised that the restriction applies only to 'sensitive public-sector data' and 'critical infrastructure operational technology', not to commercial or general administrative data. In practice, this distinction may be difficult to enforce given the integrated nature of most cloud environments.
Market Impact
Microsoft Azure, Google Cloud and Amazon Web Services collectively hold approximately 67 percent of EU public-sector cloud contracts by value. All three have European data centre networks and have pre-emptively launched Sovereign Cloud products, but their ultimate ownership structure would not satisfy the Commission's draft ownership test without significant corporate restructuring.
European providers including OVHcloud (France), IONOS (Germany) and Cleura (Sweden) stand to gain substantially if the package is adopted without major amendment.
Legislative Path
The package requires co-decision by the European Parliament and the Council. Ireland and Denmark — both home to major US tech operations — have signalled opposition to the ownership test and are likely to seek amendments during Council deliberations. Passage in its current form is considered uncertain; a compromise version retaining residency requirements but relaxing ownership criteria is seen as the most probable outcome.
Sources
Related publications
Czech Intelligence Warns of Chinese Acquisitions in Semiconductor Testing and Precision Optics Firms
The Czech Security Information Service (BIS) published its 2026 annual report warning that Chinese state-linked entities have acquired minority and in some cases controlling stakes in Czech firms specialising in semiconductor testing equipment and precision optical components — technologies with dual civilian and military applications. The report has prompted the Czech government to accelerate legislation tightening the country's Foreign Direct Investment screening framework, with a new bill expected before parliament by December 2026.
EU and Central Asia Sign Digital Economy and Cybersecurity Framework at Samarkand Forum
The first day of the Central Asia + EU Ministerial Forum in Samarkand produced a Digital Economy and Cybersecurity Cooperation Framework, signed October 17 by all five Central Asian states and the EU. The framework covers data localisation harmonisation, critical infrastructure cyber incident sharing, joint response to disinformation campaigns, and EU technical assistance for digital government modernisation. It represents the most comprehensive EU-Central Asia digital governance agreement to date and will be operationalised through a dedicated Digital Cooperation Hub in Almaty.
Russia opens its winter campaign on Ukraine's grid before the heating season
The 30 September strikes were Russia's first mass combined attack on Ukraine's energy system since last winter, and they brought emergency power cuts back to Kyiv. A document Ukraine says is an intercepted Russian plan describes a three-stage campaign aimed at nearly 15 GW of capacity.