EU Eyes Restrictions on U.S. Cloud Platforms for Sensitive Government Data

The European Commission is considering rules that would impose EU cloud restrictions on how member governments use American cloud platforms to process sensitive public data, CNBC reported Thursday, citing two Commission officials speaking on condition of anonymity.

The proposals are being drafted ahead of the Commission’s planned “Tech Sovereignty Package,” due for presentation on May 27. That package will bundle the Cloud and AI Development Act and a refreshed Chips Act into a single push for European strategic independence in digital infrastructure.

What the Proposed Rules Would Cover

Under the measures being discussed, cloud platforms operated by non-EU companies would face limits on their role in processing government-held financial, judicial, and health data. The restrictions would be tiered according to data sensitivity rather than representing an outright ban. U.S. providers could remain eligible for some public contracts, but their access to the most critical workloads would narrow considerably.

A Commission official told CNBC that the core ambition is designating specific sectors where data must be hosted on European cloud capacity. The discussions apply exclusively to public-sector bodies and would not extend to private companies.

Background: Growing Unease Over U.S. Tech Dependence

Pressure to diversify away from American cloud giants has built steadily since relations between Washington and Brussels deteriorated earlier this year. One driver is the U.S. CLOUD Act of 2018, which permits American law enforcement to compel domestic tech companies to hand over stored data regardless of where that data physically resides. European policymakers have long viewed that provision as an inherent vulnerability in any reliance on U.S.-hosted infrastructure.

Several EU governments have already begun acting unilaterally. France launched Visio, a state-developed video conferencing platform, in January and plans to make it standard across all public services by 2027. Other member states told CNBC in February they were actively budgeting for open-source and homegrown alternatives to American software.

What Comes Next

The Tech Sovereignty Package requires unanimous endorsement from all 27 member states before any measures take effect, a bar that has historically slowed Brussels’ most ambitious digital ambitions. A Commission spokesperson framed the package as Europe “waking up and getting its act together,” noting it would widen procurement pathways for sovereign cloud providers and encourage a broader range of competitors in the market.

Officials cautioned that internal deliberations are still fluid and no final positions have been locked in ahead of the May 27 unveiling.

Read Next: Fed Holds Rates Steady as Tariff Uncertainty Clouds Outlook