The European Commission last week published its long-awaited digital sovereignty package, a set of proposals aimed at reducing Europe’s dependence on U.S. technology companies and shielding the bloc from foreign interference. But critics say the plan, while a step forward, remains fundamentally shaped by the Silicon Valley ideology it purports to challenge.
The package, centered on the Cloud and AI Development Act (Cada), would create a ranking system for cloud providers handling public-sector data — including Amazon Web Services, Microsoft Azure, and France’s OVHCloud. In theory, the most sensitive operations and data, particularly those relating to national security and law enforcement, would be reserved for providers that met the highest sovereignty standards, establishing a preference for European providers.
The EU relies on non-EU countries for more than 80% of its technology and 70% of its cloud computing, according to the European Commission. The push for digital sovereignty comes as the Trump administration’s confrontational political approach toward Europe has exposed what analysts describe as a dangerous dependence on U.S. technology.
Max von Thun, director of Open Markets Institute Europe, an anti-monopoly think tank, wrote in an analysis published by The Guardian that the package is a “welcome, if belated, recognition that dependence on US tech companies isn’t just an economic problem — it’s a direct threat to the continent’s independence, resilience and security.”
But von Thun said the framework is “undermined by some major flaws.” The strictest assurance level — the only one where U.S. big tech would be banned from bidding for contracts — will apply only to a narrow segment of public-sector cloud procurement, which represents only a small fraction of overall European cloud spending, he wrote.
Worse still, von Thun argued, Cada’s enforcement would be delegated to individual EU governments, many of which have strong incentives to implement the rules weakly in order to attract U.S. tech investment or avoid U.S. government pressure. He said this would replicate the experience of the EU’s data protection rulebook, where Ireland’s financial dependence on big tech’s investments and tax payments has resulted in “systematic underenforcement.”
Von Thun also criticized the Commission’s approach on artificial intelligence. Rather than establishing how “careful, targeted and evidence-based AI adoption could help the EU achieve its policy objectives while minimising societal harm,” he wrote, Brussels largely defers to the AI vision proposed by U.S. big tech firms and backed by the Trump administration.
According to this vision, von Thun said, AI is “an end in itself” and the goal is to deploy it as quickly as possible, regardless of the consequences for society and the planet. He contrasted this with Pope Leo XIV’s recent encyclical on AI, which states that where “technological development advances without a corresponding ethical and social progress, the result may be an increase in means without a growth in humanity.”
The Commission’s proposals, von Thun wrote, “fail to engage critically with AI’s potential benefits, risks and technical limitations, and instead simply take the positive impact of AI as a given without providing much evidence.” He said the same shortsighted approach informs much of the EU’s overall strategy on tech, including rushed plans to weaken EU data privacy and AI safety rules as part of misguided attempts to “catch up” with the U.S.
The package includes a commitment to triple Europe’s datacenter capacity over five to seven years, centered on measures in the Cada forcing every EU country to set up zones intended to accelerate datacenter permitting. Within these zones, local authorities would have to approve datacenter applications within 12 months, including by watering down environmental and planning reviews to facilitate permitting.
Von Thun said the acceleration zones raise “serious concerns about transparency, democratic accountability and sustainability,” at a time when public opposition to datacenters is growing due to their impact on the environment and household electricity bills. He also said the zones risk undermining the Commission’s own sovereignty goals, because by failing to include criteria on company size or nationality, the zones could end up further entrenching the U.S. hyperscalers that dominate Europe’s cloud market.
“Brussels fails to recognise that digital sovereignty isn’t just about who owns or controls your technology,” von Thun wrote. “It’s also about having an independent vision for how that technology is designed, developed and deployed.”
“If Europe really wants to be sovereign, it needs to free itself from Silicon Valley’s ideology, not just its tech,” he said. “Without its own vision for how AI should serve society, Europe will remain a decision-taker rather than a decision-maker.”
Von Thun cited the case of Beti Hohler, a Slovenian national and judge at the International Criminal Court, as an extreme example of the risks Europe faces. When the Trump administration sanctioned Hohler last year for her work at the ICC, her ability to use Apple’s app store, Amazon, Airbnb, Booking, Visa, Mastercard, and PayPal vanished overnight. Her credit cards and accounts with U.S. companies were all cut off, leaving her and her colleagues living in “constant uncertainty,” she said.
The ICC judges’ ordeal, von Thun wrote, illustrates a reality Europe is starting to reckon with: the Trump administration’s confrontational political approach toward the EU has exposed the continent’s dangerous dependence on U.S. technology.
He noted that Elon Musk has already used his ownership of X and Starlink to interfere in European public debate and influence the war in Ukraine, and that the U.S. government has ordered the AI company Anthropic to limit foreign nationals’ access to its products on security grounds.
“What if Washington were to cut off Europe’s access to US advanced chips during a trade dispute, or exploit its control of social media and cloud computing to spy on European governments and influence elections?” von Thun asked. “Given that the EU relies on non-EU countries for more than 80% of its technology and 70% of its cloud computing, as well as the Trump administration’s commitment to ‘cultivating resistance’ in Europe, none of this seems too far-fetched.”