Introduction to EU Tech Sovereignty
The European Commission has proposed a set of laws and strategies aimed at reducing the European Union's reliance on foreign technology, amid concerns that its long-standing tech dependencies are becoming a security vulnerability.
According to the Commission's tech lead, Henna Virkkunen, the proposals amount to “a major shift in how Europe approaches technological sovereignty.” The package bundles two draft laws — a Chips Act 2.0 and a Cloud and AI Development Act (CADA) — alongside an Open Source Strategy and a roadmap for digitalizing the energy system.
Goals of the Package
The proposals aim to “help widen choice in core technologies for EU businesses, citizens and public administrations.” Virkkunen stated, “We live in a world where geopolitics and technology are inseparable. Those who champion technological innovation will shape the future — and we must ensure that Europe plays a leading role in this.”
The Commission says it will scale up European open-source alternatives in priority areas that explicitly include cybersecurity, and fund the long-term maintenance and security of Europe's critical open-source infrastructure.
Open-Source Security
The strategy builds on what the Commission says are the more than 3 million European open-source contributors, and would push public administrations toward open-source tools through procurement guidance and an open internet stack.
Open-source vendor SUSE said the approach validated its argument that inspectable, openly maintained software is better placed to meet sovereignty goals than proprietary stacks, while warning that implementation would be the real test.
Chip Sovereignty
When it comes to semiconductors, “Europe still relies heavily on third countries for advanced production and chip design,” the Commission said. The Chips Act 2.0 introduces concrete tools for the manufacturing gap, requiring national governments to complete planning, environmental and regulatory approvals for new fabrication plants within 12 months.
The act would also extend state aid for “first-of-a-kind” facilities not present anywhere in the EU. The original 2023 Chips Act mobilized more than €52 billion in public and private investment but fell short of its flagship target of 20% of global semiconductor production by 2030.
Cloud and AI Sovereignty
The most contested element of the package is CADA's cloud sovereignty test, with lower tiers providing legal assurances while the upper tiers effectively demand graded protections against foreign jurisdictional reach and supply-chain compromise.
The act defines four assurance levels for public bodies to apply based on risk: Level 1 requires data to be processed and stored in the EU; Level 2 requires demonstrated independence from non-EU countries; Level 3 requires EU ownership and control, including personnel criteria; and Level 4 requires full supply-chain control with no third-country interference.
Industry Reaction
Industry reaction has been sharply split, with CCIA Europe calling CADA discriminatory and “a dangerous recipe for progressive market shutdown.” European cloud providers welcomed the direction but warned of loopholes.
Trade body CISPE called it “a step forward for Europe's strategic autonomy” but said it failed to require public buyers even to check whether a European alternative existed before contracting foreign providers.
Conclusion
The proposals have landed amid a broader debate about whether sovereignty delivers security. Analyst Josh Gold argued that European cyber resilience depends on design rather than control, and that the bloc should keep sovereignty “thin and targeted while building thick autonomy” — favouring transparency, portability and recoverability over EU ownership and location requirements.
All of the proposals will need to be passed by the European Parliament and European Council, where the sovereignty criteria, procurement obligations and funding are subject to political negotiation.
Source: The Record