Policy Briefs
from Belfer Center for Science and International Affairs

EU Tech Sovereignty Package Policy Brief

12 minutes

Following the 2024 Draghi report, the European Commission has now published a Tech Sovereignty Package, an important step forward for Europe’s tech independence. Filippo Gualtiero Blancato examines the legislation and its objectives in a new policy brief. 

Download the PDF
Belgium - Brussels - Schuman - Berlaymont - Seat of the European Commission

Overview

Europe imports over 80% of its digital services, infrastructure, and IP, mainly from the US. This creates issues of strategic dependence and competitiveness, as the EU is exposed to supply chain shocks and dependence on foreign technologies widens its innovation gap with the US.

Following the 2024 Draghi report, the European Commission has now published a Tech Sovereignty Package. This consists of two proposed legislations – the Cloud and AI Development Act (CADA) and the Chips Act 2.0 – and two strategic documents, the EU Open-Source Strategy and a Strategic Roadmap for Digitalisation and AI in the Energy Sector. CADA and Chips Act 2.0 are the most consequential parts of the package, which can potentially change Europe’s technological landscape.

The tech sovereignty package is an important step forward for Europe’s tech independence, although some provisions could have been more ambitious. The two legislations now enter the EU legislative process, where the European Parliament and the Council of the European Union can amend the text.

Cloud and AI Development Act (CADA)

Objectives:

  • · At least triple EU data center capacity by 2035 (now 12GW, expected 32-60GW, €300 billion by 2036).
  • · Reducing public sector reliance on US cloud services.

Provisions:

  • Creating “data centre acceleration zones” to boost data centers buildout in Europe, with a faster permit-granting procedure (max 12 months). 
  • Establish a “cloud computing sovereignty framework” based on four assurance levels that cloud providers must meet to host public sector data. The levels establish progressively stricter criteria on data localisation, absence of third country interference, control over the supply chain, and cybersecurity.

 

  • Level 1: baseline level of sovereignty – US hyperscalers would qualify. 
  • Level 2: US hyperscalers have partnered with EU companies to create “sovereign clouds” where the EU entity is majority owner and there is more indirection between EU data and the US, so they could qualify
  • Level 3: US hyperscalers would not qualify unless the Commission grants an exception with an adequacy decision.
  • Level 4: full EU control required, only 1% of public sector data would fall under this level (defence, national security, and critical infrastructures).   

CADA will steer some public sector procurement away from US hyperscalers, but:

  • The sovereignty framework does not feature an explicit “Buy European” (or Made in Europe) mandate – on the model of the Buy American Act (1933) – to avoid US retaliation. France favours a European preference while Germany wants a more inclusive approach. 
  • In the absence of a Buy European mandate, acceleration zones risk cementing the advantage of US hyperscalers, which are already spending hundreds of billions to build data centers in Europe and beyond. 
  • Data centres’ high environmental footprint will have to be squared with the EU’s climate goals. 
  • The EU has higher energy costs than the US and China, so it is unclear how more data centers and computing will not cause higher electricity prices. 
  • CADA delegates Member States with enforcing the sovereignty framework instead of enforcing it from the top-down. Hyperscalers could obtain contracts with more lenient states.

 

Chips Act 2.0

The first Chips Act (2022) focused on boosting Europe’s share of semiconductor manufacturing through supply-side measures (i.e. subsidizing semiconductors fabs in Europe), but did not generate results in the absence of a strong market. The Chips Act 2.0 therefore focuses on boosting Europe’s demand for advanced chips. 

Objectives:

  • Increase EU’s capacity in leading edge AI chips (est. €120 billion public/private investment).
  • Develop a strong user market across key industry sectors (cloud, automotive, defence, etc). 
  • Improve intelligence sharing in case of disruptions to the supply chain.

Provisions:

  • Supporting strategic projects, such as an EU-based foundry for advanced manufacturing in AI chips (3 nanometres and below).
  • Setting up demand accelerators to connect chip manufacturers with customers in key industries.
  • Fast-tracking permits for advanced manufacturing semiconductor initiatives (12 months).
  • Creating European Semiconductor Regions of Excellence to attract investments and promote innovation clusters.
  • Establishing a “crisis stage” intelligence sharing mechanism in case of serious disruptions to the supply chain causing shortage of chips, intermediate products, or raw and processed materials. 

I believe the Chips Act 2.0 will only modestly boost semiconductor manufacturing in Europe (EU share is stable at 8-10% since the 1990s) but might add some capabilities in leading edge chips. It will more realistically build a stronger design ecosystem for niche AI chips. The Act has the merit of shifting its focus from just subsidizing manufacturing to emphasizing the creation of a full semiconductor ecosystem, including R&D, fast permits, public procurement, and partnerships with industries.

EU Open-Source Strategy

The EU spends around $300 billion a year mostly on US proprietary IT products and services. This locks-in public and private sector customers with foreign vendors, creating strategic dependencies that can be weaponised. 

Objective: boost open-source adoption, especially in the public sector, to reduce strategic dependencies (est. €2 billion over next seven years to mobilise public and private sectors).

  • Use public sector as a buyer of first resort to diffuse open-source services.
  • In the Strategy and especially CADA, however, public sector adoption is not mandated, just encouraged, which reflects a much softer approach than in earlier drafts of the text. 

Strategic Roadmap for Digitalisation and AI in the Energy Sector

Objective: integrating AI into energy infrastructure (est. annual investment gap €400 billion).

  • Supporting integration of data centers in the energy system. 
  • Digitalise the energy system through smart grids, smart meters.
  • Simplifying cross-border data exchange across smart energy services.

Conclusion

The Tech Sovereignty Package is the most ambitious set of provisions Europe has adopted so far to reduce its strategic dependence on foreign technologies and close the competitiveness gap with the US and China. The package shows the EU is betting on its large single market to drive demand and scale homegrown alternatives to foreign services and infrastructures. Major provisions – like a Buy European mandate in public procurement – have been toned down to avoid more tensions with the US, yet the text can still be amended to make some provisions sharper. Ultimately, bureaucracies don’t create markets, but the initiatives in the Tech Sovereignty package have the potential to put Europe on the tech map. 


Statements and views expressed in this commentary are solely those of the authors and do not imply endorsement by Harvard University, the Harvard Kennedy School, or the Belfer Center for Science and International Affairs.

Recommended citation

Blancato, Filippo Gualtiero. “EU Tech Sovereignty Package Policy Brief.” Belfer Center for Science and International Affairs, July 6, 2026