Two MEPs propose extending sovereign cloud rules to critical activities

MEPs Diego Solier and Reinier van Lanschot propose applying sovereignty requirements to cloud services used for the most critical activities, even when a private operator is responsible for those activities. They presented their joint draft report on the EU regulation on cloud computing and artificial intelligence on 11 November 2026 at 10 am at the European Parliament in Brussels.

On 3 June, the European Commission had proposed a common framework for assessing the sovereignty of cloud and artificial intelligence services. Its proposed regulation also envisaged encouraging the public sector to use these services.

Van Lanschot used the example of a private hospital to explain how far the proposed extension would reach. If the activity the hospital wants to host in the cloud is deemed critical, it might have to check the sovereignty guarantees of the various offerings before choosing a provider. The rapporteur also cited a power plant and an airport to illustrate the same criterion.

The two MEPs propose that accredited auditors assess the offerings using common rules. Van Lanschot wants small providers to be able to afford to have their offerings audited. The rapporteurs also envisage allowing providers established outside the European Union to qualify for the highest level of sovereignty in limited cases.

To reduce reliance on foreign providers, the rapporteurs want public authorities to buy more cloud services from European providers. Buyers would still be able to choose among several qualifying offerings. These contracts would bring customers to European providers, whose share of the European cloud market has fallen from around 30% ten years ago to less than 15% today, according to Van Lanschot.

At the European Parliament, the industry and internal market committees have yet to take a position on the text. At the close of the press conference, a joint discussion was announced for 1 December.