🤚 The Open-Palm Decree

The European Commission has decided that importing 80% of your digital infrastructure from two countries that can’t agree on TikTok is, perhaps, a suboptimal national security strategy. On June 5, Brussels unveiled its Tech Sovereignty Package — a four-part legislative offensive designed to reduce EU dependence on American and Chinese technology with the quiet urgency of a continent that just realized its cloud providers have a foreign accent.

The package includes:

• Chips Act 2.0 — which requires governments to approve semiconductor fabrication plants within 12 months and extends state aid for new facilities, because the first Chips Act was apparently just a warm-up lap for the subsidy treadmill
• Cloud and AI Development Act (CADA) — establishing four assurance levels for public bodies, ranging from Level 1 (“data stored in the EU, pinky promise”) to Level 4 (“full supply-chain control, notarized in triplicate, blessed by a sovereignty priest”)
• Open Source Strategy — funding long-term maintenance of critical open-source infrastructure and scaling European alternatives in cybersecurity, because nothing says “independence” like building your own version of software Americans wrote for free
• Energy Digitalization Roadmap — because you can’t run sovereign AI on someone else’s power grid without at least acknowledging the irony

👐 The Two-Handed Trade Barrier

Let us be precise about what CADA means in practice. When the European Commission says “assurance levels,” what they mean is: Amazon Web Services, Microsoft Azure, and Google Cloud — which currently handle the vast majority of European government and enterprise workloads — will need to demonstrate increasingly rigorous levels of European-ness to keep those contracts.

At Level 4, the requirements include full supply-chain control, which is a polite way of saying *”we would like American hyperscalers to build a European subsidiary that is European enough to not be American, but American enough to still work.”*

European cloud providers, predictably, love this. U.S. technology firms have already called CADA “discriminatory” — which is technically accurate in the same way that a lock on your front door discriminates against burglars. The Centre for European Policy Network offered the most measured take, cautioning that sovereignty through procurement “produces protected industries, not competitive ones.” Which is true, but has never stopped anyone from trying.

The AI implications are particularly spicy. Any AI company serving European public institutions — and that includes OpenAI, Anthropic, Google DeepMind, and every startup with a “.ai” domain — will need to navigate a compliance framework that makes the EU AI Act look like a warm handshake. The models themselves aren’t regulated here. The pipes are. And if your pipes run through Virginia, Brussels would like a word.

🌿 The Gentle Awakening

There is something deeply human about a continent that spent forty years building the world’s most interconnected single market suddenly discovering that interconnection cuts both ways. The EU didn’t choose to depend on American cloud infrastructure any more than you chose to depend on your phone’s autocorrect. It just happened, one procurement decision at a time, until one day you wake up and your entire government runs on a platform controlled by a company whose CEO testifies before someone else’s Congress.

The 12-month fab approval deadline in Chips Act 2.0 is the most revealing provision. Currently, semiconductor plant approvals in Europe take three to five years — roughly the same amount of time it takes for a chip generation to become obsolete. The EU is essentially admitting that its own bureaucracy has been the primary obstacle to its own sovereignty. The solution? More legislation about faster legislation.

👑 The Gold-Leaf Reckoning

The real question isn’t whether the Tech Sovereignty Package will pass — it will, because “sovereignty” is the word that makes every European Parliament member’s hand move toward the voting button on pure reflex. The question is whether it will produce actual European technology champions, or merely produce European subsidiaries of American companies with very expensive compliance departments.

History suggests the latter. But history also suggested that European data protection regulation would be toothless, and then GDPR fined Meta $1.3 billion and made every website on earth ask you about cookies. So perhaps Brussels knows something the skeptics don’t. Or perhaps Brussels simply enjoys the process of finding out.

Either way, if your AI startup serves European customers and your servers live in us-east-1, you now have homework.

“We depend on foreign suppliers for 80% of our digital infrastructure, and we’d like to get that number down to 79% by 2035 — but with European paperwork, so it’ll feel like 40%.” — The Slap of Wisdom Brussels Bureau, drafting this compliance memo from a laptop running Windows on an American cloud instance