In partnership with
In 2017, Europe banned Huawei from its 5G networks.
The justification was Chinese law: Beijing can compel Chinese companies to hand over data on demand. That made Huawei infrastructure a security risk regardless of where the hardware physically sat.
The US CLOUD Act of 2018 requires American companies to hand over data to US authorities on valid legal demand, regardless of where that data physically sits. A Microsoft data center in Frankfurt is still a Microsoft data center. The data lives in Germany. The legal jurisdiction lives in Washington.
Europe stored its government data on the other country's technology anyway.
On May 27th, the European Commission is expected to present what it is calling the tech sovereignty package: a set of regulations designed to restrict US cloud providers from processing sensitive government data across EU member states. Health records, financial data, judicial documents, police files. The most sensitive categories of public sector information would need to be hosted on European cloud infrastructure operated by European companies under European legal jurisdiction.
The package will not ban American cloud providers outright. Private companies can continue using AWS, Azure, or Google Cloud without restriction. The target is specifically the public sector: government agencies, public health systems, state financial institutions, courts.
The implementation timeline, according to sources familiar with the discussions, aims for a finalised proposal by Q3 2026, with migration phased over 18 to 24 months. Member states retain some flexibility in defining what qualifies as sensitive, but minimum standards apply uniformly across the bloc.
Analytics on Live Data Without Leaving Postgres
When analytics on Postgres slows down, most teams add a second database. TimescaleDB by Tiger Data takes a different approach: extend Postgres with columnar storage and time-series primitives to run analytics on live data, no split architecture, no pipeline lag, no new query language to learn. Start building for free. No credit card required.
The numbers behind the decision are not complicated. AWS, Microsoft Azure, and Google Cloud together account for approximately 70% of the European cloud infrastructure market. Public procurement across the EU represents roughly 15% of GDP, around two trillion euros per year. A significant portion of that spending flows through American cloud infrastructure.
Microsoft's president Brad Smith admitted the company cannot guarantee European data sovereignty under the US CLOUD Act. When pressed, Microsoft's position is that it would go to court before complying with a shutdown order. That is not a sovereignty guarantee. That is a litigation promise.
The ICC incident last year made the theoretical concrete. In February 2025, following US sanctions on ICC staff over arrest warrants connected to Israeli Prime Minister Benjamin Netanyahu, ICC chief prosecutor Karim Khan lost access to his Microsoft email account. Microsoft disputed the framing. Brad Smith told reporters "at no point did Microsoft cease or suspend its services to the ICC." The ICC subsequently migrated to openDesk, an open source office suite provided by the Centre for Digital Sovereignty on behalf of the German Federal Ministry of the Interior.
The dispute over what exactly happened is less important than what European security analysts took from it. The concern is no longer only that Washington might read the files. The concern is that Washington might switch them off entirely.
The Huawei comparison is the frame that makes Brussels's position unavoidable rather than merely inconvenient. Europe applied one standard to Chinese technology and a different standard to American technology that operates under functionally identical legal architecture. The tech sovereignty package is the acknowledgment that the contradiction was noticed.
What happens next follows a predictable expansion logic. Sensitive government data moves first. Then defence systems. Then critical national infrastructure. Then financial systems. Then health systems. The definition of sensitive will only ever grow.
Each expansion creates a larger guaranteed procurement market for European cloud providers. The same regulatory mechanism that created protected markets for European steel and aluminium is now being applied to servers.
Turn AI Into Extra Income
You don’t need to be a coder to make AI work for you. Subscribe to Mindstream and get 200+ proven ideas showing how real people are using ChatGPT, Midjourney, and other tools to earn on the side.
From small wins to full-on ventures, this guide helps you turn AI skills into real results, without the overwhelm.
For builders developing cloud infrastructure, data residency tooling, or compliance products for European public sector clients: the migration timeline is 18 to 24 months from a Q3 2026 proposal. That is a procurement window, not a distant policy debate. The institutions that will need to move their workloads are already identifying what they are running and where. The alternative providers that exist today will be evaluated in that window. The ones that do not exist yet will not.
The full EuroScanner dataset, covering current hosting infrastructure for 210 EU domains, is at
404 Found covers AI and digital infrastructure developments from a European Insider, three times a week.
Benchmark against 2,000+ private B2B SaaS and AI companies
Is your growth in-line with your peers in B2B SaaS & AI?
Benchmark yourself against actual billings data for Maxio’s 2000+ global customers.
Key takeaways from the report:
Average growth across 2,000 companies
Growth by revenue band
AI-led vs AI-enhanced. Who performed better?