iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Europe’s cloud dilemma is that businesses and public bodies increasingly rely on cloud services, while much of the market is concentrated among providers headquartered outside the EU. The European Commission says three non-EU hyperscalers control more than 70% of the European cloud market, a figure in its 2026 proposal for a Cloud and AI Development Act—not an independently audited or timeless market measure. Europe’s response combines plans to expand infrastructure with efforts to improve sovereignty, resilience and the ability to switch providers.
Why is Europe dependent on US cloud providers?
Cloud services are already part of ordinary business operations. Eurostat reported that 52.7% of EU enterprises used paid cloud services in 2025, up 7.4 percentage points from 2023. The survey covers enterprises with at least 10 employees or self-employed persons in specified NACE Rev. 2 sectors; it does not describe every company, individual consumer or public body.
Among enterprises using cloud services, email was the most commonly reported use: 85.2% used paid cloud for email, 71.7% for office software and 71.5% for file storage. These are service-use shares among cloud-using enterprises, not market-revenue shares. Eurostat’s 3 February 2026 release provides the survey results and population details.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe concentration concern is distinct from adoption: when many organizations depend on a small number of providers, disruptions, contractual changes or difficulty moving workloads can have broader consequences. The Commission’s proposed Cloud and AI Development Act identifies dependence on non-European cloud and AI suppliers as a policy risk. Its more-than-70% figure describes the Commission’s case for action; it should not be read as a complete, independently audited account of every cloud service or as a permanent market share.
#1 Best Overall
What does cloud sovereignty mean?
Cloud sovereignty is not simply a question of where servers sit or which country a company is from. The Commission’s framework assesses control and resilience across eight categories, using 48 criteria. Its dimensions include legal and jurisdictional control; data and AI; operations; supply chain; technology; security and compliance; and environmental sustainability. The framework distinguishes a Sovereignty Effectiveness Assurance Level from an overall score, with levels tied to thresholds for data sovereignty, technological autonomy and full sovereignty.
This broader view matters because a service can have European operations while relying on technology developed elsewhere, or store data in Europe while remaining exposed to foreign legal jurisdiction or supply-chain dependencies. A sovereignty assessment therefore asks who can access and operate the service, what technology it depends on, how it can be maintained during disruption, and whether workloads can be moved—not only where the data centre is located. The Commission explains its European Cloud Sovereignty Framework and its assessment categories.
Rank #2
Does storing data in Europe make a cloud sovereign?
No. European data-centre location can be relevant, but it does not by itself establish legal independence, operational control, technological autonomy or supply-chain resilience. Those factors need to be evaluated separately for the service and workload in question.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The Commission’s April 2026 procurement provides a concrete illustration. It says the Proximus/S3NS environment is based on Google Cloud technology but operated exclusively by EU companies. The example shows how the underlying technology and operational control can differ; it does not establish that the arrangement is equivalent to a wholly European technology stack, nor that it is suitable for every workload.
Rank #3
How is the EU responding to the cloud dilemma?
Build more capacity
The Commission’s proposed Cloud and AI Development Act aims to at least triple EU data-centre capacity over five to seven years and meet business and public-administration needs by 2035. These are policy targets, not achieved outcomes. The proposal also aims to streamline deployment and address energy demand through efficiency, cooling, power management and integration with energy systems. More capacity could widen the available infrastructure base, but it does not by itself solve concentration, legal control or switching problems. The Commission’s Cloud and AI Development Act page sets out the proposal and its stated aims.
Use procurement to diversify providers
In April 2026, the Commission awarded sovereign-cloud contracts under its Cloud III Dynamic Purchasing System, with a ceiling of up to €180 million over six years. The Commission said: “The Commission awarded four contracts to ensure diversification and resilience, avoiding potential lock-in by a single provider.” It named four providers or provider partnerships:
- A Luxembourgish-French partnership led by Post Telecom, with OVHcloud and CleverCloud.
- German provider STACKIT.
- French provider Scaleway.
- A Belgian-French-Luxembourgish partnership led by Proximus, with S3NS, Clarence and Mistral.
The procurement framework set eligibility at SEAL-2, which the Commission describes as data sovereignty. Most successful providers reached SEAL-3, described as digital resilience; Proximus/S3NS reached SEAL-2. These awards show how the Commission is applying its criteria in procurement, not that one provider or level is automatically right for every organization. The contract ceiling is not a statement of spending already made. The Commission’s announcement of 17 April 2026 gives the recipients and award details.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Make switching more practical
Infrastructure diversity only helps if organizations can move between services. The Commission says the Data Act seeks to make switching cloud providers “fast, free and technologically fluid” by tackling vendor lock-in. That policy goal does not mean a real migration has no cost or effort: applications may rely on provider-specific services, and moving data, changing integrations and validating operations still require planning. The Commission describes the Data Act’s cloud-switching provisions on its Data Act policy page.
Best Value
Can Europe build its own cloud infrastructure?
The EU proposal is an attempt to expand capacity, not evidence that Europe has already replaced external providers or met its own future needs. Tripling data-centre capacity is a stated target; the proposal also recognizes that expansion must account for energy use, cooling and the power system. Physical capacity alone is not the full measure of a cloud service: organizations also need dependable operations, capable managed services, secure supply chains and workable routes between providers.
In practice, the policy response is not limited to choosing between an entirely European stack and an overseas one. The procurement example involving Google Cloud technology operated by EU companies demonstrates that control and technology can be separated in some arrangements. Whether that balance meets an organization’s needs depends on its legal obligations, workload, resilience requirements and tolerance for technology or supply-chain dependencies.
How can a business compare cloud options?
For a business or public body, the useful comparison is workload-specific. Assess the provider and service—not just the corporate headquarters or data-centre address—against the factors that affect control and continuity:
- Legal and jurisdictional control: Identify which entities can access or administer data and which legal jurisdictions may apply.
- Operations and resilience: Establish who operates the service, how incidents are handled and what continuity arrangements exist.
- Technical capability: Check that the service supports the workload’s performance, security and managed-service requirements.
- Interoperability and switching: Identify provider-specific dependencies, data-export routes and the work needed to move applications and integrations.
- Concentration and diversification: Consider whether critical services depend on one provider, technology stack or operational partner.
- Supply chain and sustainability: Examine relevant technology dependencies and how energy use and environmental considerations are addressed.
The Commission’s sovereignty framework can help structure those questions, but a level or score should not substitute for an organization’s own requirements and risk assessment. A different provider may be appropriate for a sensitive public workload than for a routine business application, and a mixed-provider strategy may improve choice while adding management complexity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
