The future of cloud policy in the EU: have your say (until 4th of June)

The European Commission has opened a consultation, which will run until the 4th of June, seeking feedback on the preparatory work for the Cloud and AI Development Act (which is ambitiously set to be proposed in Q4 2025 or Q1 2026). This is part of a broader push towards a single EU-wide cloud policy for public administrations and public procurement.

The goals are to “at least triple the EU's data centre capacity in the next 5–7 years, prioritising highly sustainable data centres.” To put it more simply - create regulatory carveouts for European cloud service providers, partially through reducing red tape by cutting permitting times, making access to energy, water, land and capital easier by “offering possible financial support (in line with applicable State aid rules) to data centres with a high innovation and sustainability contribution”.

Scenarios set out by the Commission 

In the consultation paper, the Commission sets out four possible scenarios for further action, although, it may seem like option #4 is the one the Commission is most likely to go for - judging from its repeated ambition for European digital sovereignty in the Competitiveness Compass, Ursula von der Leyen’s mission letters to Commissioners, and the recent AI Continent Action Plan.

#0 (baseline scenario) - Baseline scenario against which the further policy options will be compared. It will take into account existing national and EU policies and important technological or social developments.

#1 (non-legislative option) - This option would foresee the adoption of non-binding measures such as the set-up of a network of Member States tasked with monitoring their strategies to achieve the Digital Decade targets or Guidelines for Member States to coordinate their cloud strategies, investments and designation of suitable sites for new data centres.

#2 (Directive approach) - Under this option, the Commission could adopt binding measures through a Directive, leaving national authorities the choice of form and methods to address their computing capacity deficit.

#3 (Binding regulatory approach) - Under this option, binding measures could be defined in the form of a Regulation. This option would identify a set of measures to be applied across Member States for the harmonisation of cloud policies in order to address the computational capacity deficit and coordinate the support for the emergence of a trustworthy EU infrastructure ecosystem.

#4 (Binding regulatory approach + strict enforcement) - Comprehensive regulatory approach, which would focus on binding measures to address the computational capacity deficit in the EU complemented with the creation of a distinct independent agency to ensure consistent enforcement and manage Member States’ joint investment to develop and own a trustworthy European cloud infrastructure ecosystem

Unanswered general questions on cloud adoption

With most public administrations accelerating the digitalization of public services, adopting artificial intelligence, and facing growing demand from foreign multinationals to build data centers in cold-climate EU countries, Europeans have a difficult task ahead of them: implementing interoperability requirements among cloud providers is still an issue; sneaky licencing practices is still an issue; in-house public sector workforce capacity and contract analysis expertise are still limited; and adjusting legacy systems to be compatible with cloud computing continues to be a major barrier.

Economy of scale vs. sovereignty. Yes, switching providers should be seamless and easy; EU Member States should avoid signing 25-year contracts (as seen in a similar case in Ottawa, Canada last year); and public administrations should be mindful of their cloud needs and leverage the latest market technologies and tools to measure them. Having dozens of different providers, however, may create additional burden for public administrations - in monetary and non-monetary terms.

Cloud adoption remains an issue in many Member States. While the EU measures cloud computing adoption among European businesses in the DESI index - and to some extent through Eurostat - the same is not being done for public administrations. Some public administrations remain hesitant to adopt cloud for their data needs due to fears of data breaches, institutional inertia, outdated IT systems, lack of in-house expertise, risk aversion, and overreliance on on-premises (often state-owned) data centers which are often physically vulnerable.

Eating cake and having it too: energy efficiency requirements vs nuclear. The European Commission puts a strong emphasis on environmental requirements for the development of the EU's data center capacity. The strength and capacity of energy grids are the core, yet often forgotten, elements of the successful development of cloud computing and AI. While the Spanish and Portuguese power outages over the recent weeks have sparked discussions on the need for more nuclear power, some European politicians remain hesitant.

High saturation of European cloud providers in Western Europe. The most potent European companies which could theoretically provide at least partial alternatives to multinational cloud service companies are French OVHcloud, Scaleway; German IONOS, Hetzner Online; the Dutch Fuga Cloud and LeaseWe; and Austrian cloud services provider with a peculiar name - Anexia. (Let us know if we're missing someone in the comments).

Under current conditions, Western European companies would be the main beneficiaries of the European-wide cloud framework, and alternatives from Southern or Eastern Europe would be unable to catch up, even if state aid requirements were liberalized. Possible easier mergers and liberalized competition policy for European companies remain an unanswered question.