EU mulls restricting use of U.S. cloud for sensitive government data: sources

The European Union is evaluating the rules It would restrict member governments from using U.S. cloud providers to process sensitive data, sources familiar with the talks told CNBC.

The European Commission, the EU’s executive body, is expected to present the “Technology Sovereignty Package” on May 27, which will include a series of measures aimed at strengthening the bloc’s strategic autonomy in key digital areas.

As part of preparations for this package, discussions are ongoing within the Commission about limiting the disclosure of sensitive public sector data to cloud platforms provided by companies outside the EU, two Commission officials, who requested anonymity because they were not authorized to discuss private conversations, told CNBC.

As tensions with the administration of US President Donald Trump intensify, there are calls for Europe to move away from the US cloud providers that currently dominate the European market and turn to local providers for its most critical workloads.

“The basic idea is to identify sectors that need to be hosted on European cloud capacity,” one of the officials said. They added that companies providing cloud solutions from third countries, including the US, may be affected.

They added that the proposals would not completely ban offshore companies’ cloud platforms from government contracts, but would limit their use in processing sensitive data in public sector organizations, depending on the level of sensitivity. Officials said negotiations are continuing but have not been concluded yet.

As a result of the proposals, “US cloud providers may face restrictions in certain sensitive and strategic sectors within public institutions of EU member states,” an official said.

Officials told CNBC that there is discussion about the proposal that financial, forensic and healthcare data processed by governments and public sector organizations require highly independent cloud infrastructure.

One of the officials said that the talks were not about private sector companies and that the “Technology Sovereignty Package” would not propose rules on the use of cloud platforms by these companies.

Once submitted by the Commission, the package will need to be given the green light by all 27 member states. The “Technology Sovereignty Package” will include the Cloud and Artificial Intelligence Development Act (CADA) and the Chips Act 2.0; These bills aim to promote dominant, indigenous solutions and products in both of these areas.

When asked for comment, a Commission spokesperson told CNBC that the package was “about Europe waking up and taking action together.”

They added that this would “improve opportunities for dominant cloud offerings, including public procurement, and support market entry of a more diverse set of cloud and AI service providers.”

Public sector organizations of EU member states are currently able to use cloud platforms provided by overseas companies, which are often US-based due to the country’s dominance in the sector. — To process highly sensitive data, including health and financial data, in accordance with the legislation.

However, scrutiny of this trust has increased in recent months as transatlantic relations have deteriorated. Under the Cloud Act of 2018, US law enforcement can request user data from American companies regardless of where the data is stored.

European governments He told CNBC in February that they were exploring domestic and open-source alternatives to U.S. tech platforms and increasing budgets for digital sovereignty.