Inside the EU's Tech Sovereignty Package: Chips, Cloud, and the 'Kill Switch' Fear

This fear is not abstract. The US CLOUD Act grants American law enforcement the right to access data held by US-based cloud companies—even when that data sits on servers inside Europe. For EU policymakers, this means a sovereign risk is baked into every contract signed with a major American cloud provider for sensitive public-sector workloads. The Cloud and AI Development Act (CADA) is designed specifically to close this legal loophole .

Policy groundwork laid in 2025 also primed the pump. The EU’s Competitiveness Compass had already identified closing the innovation gap, reducing strategic dependencies, and decarbonising the economy as non-negotiable transformational imperatives . A November 2025 Franco-German Summit on European Digital Sovereignty launched a joint task force to report back in 2026, signalling that the bloc’s two largest economies were ready to move beyond rhetoric .

By April 2026, the European Parliament had added its voice. A formal report called for coordinated EU action to stimulate European digital public infrastructure, explicitly warning that regulation alone—without significant public investment—would fail . The message from legislators was clear: if the EU wanted digital sovereignty, it had to pay for it.

The package also echoes the hard lesson of Europe’s energy crisis. Analysts and officials have compared the current digital dependency to the bloc’s former over-reliance on Russian gas, suggesting that Brussels is now moving to reduce a structural risk before it becomes an emergency .

What's in the package? The four pillar initiatives

The Tech Sovereignty Package is actually four interlinked measures, not a single regulation. Each targets a different layer of the technology stack .

1. Chips Act 2.0: From supply to demand

The proposed sequel to the 2023 European Chips Act represents a fundamental shift in industrial strategy. The original Act focused on expanding manufacturing capacity. Chips Act 2.0 pivots toward boosting domestic demand for European-made semiconductors, especially AI chips .

Key mechanisms include:

• Accelerated permitting for fabrication facilities, capped at a maximum of 12 months .
• “Grand Challenges” — mission-driven R&D competitions designed to spur breakthrough designs for advanced AI chips .
• Demand aggregation tools that connect EU chip producers with large industrial buyers, ensuring the volume needed to sustain domestic fabs .
• Emergency powers for the Commission to override national permitting processes and compel chipmakers to prioritise crisis-critical EU orders during shortages .

2. Cloud and AI Development Act (CADA): Securing European data

If Chips Act 2.0 secures the hardware, CADA is designed to secure the software and data running on it. It introduces a single EU-wide sovereignty framework for cloud services, with four assurance levels that member states must use to conduct sovereignty risk assessments for public-sector contracts .

The practical upshot is significant. The highest-risk government contracts will effectively be barred to US hyperscalers because their legal exposure to the US CLOUD Act makes them unable to meet the EU’s data-access sovereignty requirements .

Beyond risk management, CADA also introduces a “Free Software first” principle for public cloud and AI software procurement. This means software purchased with public funds must be made available for reuse, a measure explicitly aimed at breaking vendor lock-in to proprietary non-European providers .

3. EU Open Source Strategy: A new centre of gravity

For the first time, open-source software has been placed at the centre of EU digital policymaking as a structural lever for sovereignty . The strategy is not a side note—it is a standalone pillar of the package.

Its operational mandate is to reduce dependencies across the entire technology stack . In practice, this means that government-funded software development will increasingly default to open-source, with licences that permit reuse and collaborative improvement. The strategy also aims to level the playing field for European small and medium enterprises (SMEs) and open-source companies that have historically struggled to compete with proprietary vendors in public tenders .

The Commission has already backed this principle with money. Through Horizon Europe, it has allocated €50 million to advance open-source AI models, treating open-source AI as a core principle of a “Made in Europe” AI ecosystem .

4. Strategic Roadmap for Digitalisation and AI in Energy

The least publicised component of the package is a targeted roadmap for the energy sector. Its purpose is to coordinate EU-level action to identify and reduce critical technology dependencies in the digital infrastructure underpinning energy grids and systems. It reflects the same risk-reduction logic applied to a sector where a cyber-incident or foreign control point could have immediate physical consequences .

The money: Mobilising billions for tech independence

Sovereignty is expensive. The package itself does not create a single new funding pot but coordinates and leverages existing financial instruments to achieve massive scale.

• Chips Act 2.0 targets approximately €120 billion in public and private investment, building on the first Chips Act framework .
• The European Innovation Council (EIC) Fund, already one of the EU’s largest deep-tech venture capital funds, aims to raise up to €20 billion by 2027 specifically for startups .
• InvestEU, the EU’s flagship investment programme, continues to provide seed capital, growth financing, and manufacturing deployment support across all company stages .
• The Strategic Technologies for Europe Platform (STEP) directs existing EU budget instruments toward critical technology fields, with ambitions to reach up to €160 billion in overall investment .

European Parliament negotiators have already signalled that the upcoming Multiannual Financial Framework (MFF), the EU’s seven-year budget, should include significant additional funding specifically for the base layer of European digital public infrastructure .

The policy logic: Coercion, competition, and collaboration

The package’s mechanisms are designed to work through three levers simultaneously.

Coercion comes through emergency powers and prohibitions. Chips Act 2.0 lets the Commission override national permitting and, during a declared crisis, commandeer commercial chip production . CADA wields an implicit ban on US hyperscalers for the most sensitive contracts, using procurement law rather than trade law to achieve its goal.

Competition comes through demand-side innovation. The “Grand Challenges” framework for AI chips is a bid to create European innovation ecosystems that can compete on merit, not just survive behind regulatory walls . The demand aggregation mechanisms for semiconductors attempt to solve the chicken-and-egg problem where European foundries cannot scale without committed local buyers.

Collaboration runs through the open-source strategy and procurement reform. By mandating that publicly funded code be reusable, the Commission is building a common digital commons designed to lower long-term development costs and prevent any single government from becoming locked in to a proprietary foreign vendor .

What happens next?

The two legislative proposals—Chips Act 2.0 and CADA—now require approval from all 27 EU member states and the European Parliament before they become law. The Open Source Strategy and the Energy Roadmap are non-legislative but will shape funding and policy guidance across the EU’s digital programmes.

This is not a done deal. The proposals explicitly challenge the market position of US tech giants, and trade diplomacy between Brussels and Washington will inevitably influence final text. Member states with close intelligence-sharing relationships with the US may resist parts of CADA that limit cloud provider choice. And the €120 billion chip target is an aspiration requiring sustained political commitment across multiple electoral cycles.

But the direction is set. The Tech Sovereignty Package institutionalises a view that digital infrastructure is critical infrastructure, no different from energy grids or defence supply chains. For better or worse, the EU has decided it cannot afford to rent its digital future.