For digital sovereignty and EU security, the first step is to neutralise the US CLOUD Act
UnsplashUnsplashUnsplash
· 12 min read
A collaborative roadmap for Europe’s sustainable digital value chain: Software, hardware, and beyond
Europe is actively pursuing technological sovereignty to enhance its competitiveness, autonomy, and resilience—particularly in key sectors such as critical infrastructure protection, security and defence. Or at least, that is the claim. The increasing reliance on US digital platforms and vendors is now widely regarded as both a security and economic risk.
Currently, approximately 80% of Europe’s digital infrastructure depends on foreign companies. The majority of chips are manufactured in Asia, often under US patents; three US corporations dominate the cloud services market; and 70% of AI models originate from the United States. As of the second quarter of 2022, US-based companies Amazon Web Services (AWS), Microsoft, and Google collectively held 72% of the European cloud services market. This dominance has steadily grown, with the European cloud market expanding fivefold since early 2017, reaching revenues of €10.4 billion by April 2022. Yet, despite this growth, local European service providers saw their market share shrink from 27% to 13% over the same period, as they struggled to compete with their US counterparts.
Although concerns over digital sovereignty are not new, recent geopolitical developments have made the issue more urgent. A clear example of this is the US’s escalation of pressure on Ukraine, including threats to disconnect Starlink service during negotiations. If a similar situation were to arise in the EU, how would Europe respond? More importantly, given what is happening to our neighbours, should we not consider restricting access to European data in order to protect ourselves?
The first and most pressing step would be to neutralise the US CLOUD Act (Lawful Overseas Use of Data Act). Enacted in 2018, this law allows US law enforcement agencies to compel US-based technology companies to provide access to data stored on their servers, even if that data is physically located outside the United States. This provision directly undermines the EU’s data sovereignty, has been the subject of a ruling by the EU Court of Justice, and conflicts with critical regulatory frameworks like the GDPR, which are designed to safeguard the personal data of EU citizens.
At the Paris AI Summit, EU Commission President Ursula von der Leyen emphasised a "distinctive approach to AI," countering US Vice President Vance’s criticism of European "overregulation." Europe, however, views its regulatory framework as a necessary system of checks and balances. Certainly, the situation is complex, reflecting a relationship of mutual interdependence. As Commissioner Maroš Šefčovič noted, the EU-US economic relationship accounts for nearly 30% of global trade.
The return of great power competition has reshaped global dynamics, with major players such as the US, China, Russia, Iran, and others vying for influence and control over key regions, resources, technologies, and international norms. At stake are power, prosperity, and the establishment of a new world order. This shift marks a tectonic change in how geopolitical rivals and regional powers pursue their national interests, often without resorting to traditional military conflict.
In Europe, we can expect mounting pressure from this great power competion, compounded by constantly evolving radicalisation pathways, all propelled by rapid technological advances. The speed and scale of technological change, coupled with the vast flood of data on human and machine activity, will likely concentrate economic and political power in the hands of dictators, terrorists, criminals, and the private sector. This seamless and pervasive aggression against nation-states, societies, businesses, and individuals would have profound consequences for the legitimacy and stability of political and social systems. In this environment, Europe cannot afford to leave the immense potential of emerging innovations solely in the hands of the private sector, or even external powers. Europe must strengthen its resilience, alongside its economic, technological, and military capabilities, to navigate a future filled with security surprises, diverse threats, and fewer norms to constrain harmful state and non-state behavior. Strategic alliances must be devised based on convergence of interests within open multilateral frameworks.
Technology has become a central pillar of both prosperity and security, unlocking new opportunities while creating new vulnerabilities. It enables precise, low-risk, high-impact operations and opens new avenues for both enhanced efficiency-led sustainability - if climate and environmental KPIs are prioritised alongside traditional metrics - and asymmetric warfare—where traditional military forces may be ill-equipped to respond. The integration of cyber warfare, AI, disinformation, drones, and other technological tools allows state and non-state actors to bypass conventional military strategies, achieving strategic objectives without directly confronting an adversary’s main military force. Today, the Internet can be used to disrupt communications, steal data, damage critical infrastructure, and even manipulate financial systems. Cyber-attacks—such as ransomware, data breaches, and denial-of-service (DoS) attacks—are becoming key components of broader hybrid warfare strategies. This technological landscape presents both opportunities and risks, and Europe must ensure it is not left behind in the race for technological autonomy.
In this context, the demand for investment from Europe in open-source tools or the construction of large-scale infrastructure and data centres is growing. Some initiatives are already underway, such as the OpenDesk project in Germany. Mario Draghi himself has expressed a vision for the development of Europe’s digital industry in his report. However, open-source solutions alone have shown limitations, struggling with a lack of coordination and standardisation, which undermines efficiency, effectiveness, industrialisation, and scalability.
On the other hand, large-scale data centres, following the model of American hyperscalers, are not the solution for Europe, given the geographical and demographic layout, as well as the fragility and territorial density of our states. These enormous data centres would entail significant costs, while simultaneously reducing resilience and sustainability in Europe's diverse and constrained territories.
Mega data centres create single points of failure, which could disrupt entire regions in the event of technical failures, cyber-attacks, or natural disasters. Additionally, they consume vast amounts of energy, water, and material resources, significantly contributing to Europe's environmental vulnerability, directly contradicting the EU's sustainability and security objectives. In times of increasing drought, the risk of conflicts over water usage or complete disruption of data centre operations grows. In the summer of 2022, drought in the Netherlands prompted the government to reevaluate Microsoft's development strategy in the country.
As a system engineering company that provides advanced digital solutions and living virtual twin applications in the industrial, building, construction, and infrastructure sectors—fostering innovation in territorial and urban management—our experience confirms that Draghi is right in his judgement. However, it also shows that the solution he proposes is neither efficient nor suitable for the European Union. As suppliers to public sector organisations and an independent partner of Dassault Systèmes, working with Europe’s sole sovereign cloud with military-grade security certifications, we recognise the need for a tailored approach to Europe’s unique challenges and are committed to promoting cross-border, pan-European collaboration.
Once again, Draghi has called for action. "Do something," he shouted to the European Parliament. We believe we can answer this call together, leveraging the strength of Europe's innovation ecosystem, its businesses, and its public and private actors, including the large corporations that follow.
A systemic approach to civil and military resilience is required, one that adapts Chinese industrial planning to the scale and socio-political characteristics of Europe.
From a technical standpoint, to turn Europe’s good intentions into concrete actions, a more structured and strategic vision is necessary—one inspired by the Unix philosophy for software, combined with a distributed, regionally connected structure for data centres. This approach should focus on SMEs, as they are the only entities capable of generating disruptive and systemic innovation. Large corporations, which defend market positions are reluctant to change, and generally seek to impose technological lock-ins - along with the myth of unicorns and start-ups promoted by the financial models of Silicon Valley platforms - are not the key to Europe's recovery, its businesses, workforce, or autonomy. Instead, a model governed through project management led by Brussels is essential.
This should be accompanied by a more decentralised approach for data centres: smaller, energy-efficient units with optimised resources, lower CAPEX, and higher ROI, powered by renewable sources. This model would increase resilience and align with Europe's green, resilience, and resource autonomy ambitions. On a larger scale, however, the investment and common research infrastructure, such as that promoted by the European Digital Infrastructure Consortium (EDIC), aiming to implement multi-country projects, should be the focus. These infrastructures must be predominantly in public hands to avoid oligopolies and ensure control over enabling technologies for research and the competitiveness of SMEs. They should be accessible to all small and medium-sized enterprises across Europe, selected based on merit through public market procedures in accordance with common procurement standards for all national markets of the EU. Gold plating—the practice of proliferating excessive regulations at national and regional level called by Enrico Letta in his report—must be avoided. This is fundamental.
In a programme organised along these lines, there will also be space—and a market—for large European companies. A “Digital Airbus” initiative would provide the necessary framework, aligning with ongoing efforts to rethink European and national funding in line with Mario Draghi's call for streamlined, focused investments that support European supranational policy priorities, while avoiding the technological missteps outlined in Draghi’s report.
One thing must be clear: until now, many have believed that the digital world simply replicates the real world. In reality, the situation has long been completely reversed. No economic or social process can function today if the digital technostructure collapses. The physical world around us can no longer operate independently of the virtual world we have created.
The use of highly detailed virtual models of technical systems is expected to become increasingly common over the next decade, driven by extensive embedded sensor networks, including those connected to the human and informational aspects of these systems. Distributed sensors, autonomy, new communication technologies (e.g., 5G/6G), expanded use of space, virtual socio-cognitive spaces, and digital twins, along with enhanced analytical methods, are generating a "tsunami of data" that threatens to undermine the climate and environmental security goals of the European Union and the international community (Socio-Environmental Risks). Distributed sensors, autonomy, new communication technologies (e.g., 5G/6G), expanded use of space, virtual socio-cognitive spaces, digital twins, and the development of enhanced analytical methods have amplified the ability of state and non-state actors to understand the human, physical, and information spaces of entities, competitors, or individuals they are targeting (Security and Defense Risks).
However, the increased adoption of digital twins can significantly enhance system efficiency and effectiveness, while also reducing lifecycle financial, environmental, and natural resource costs across sectors—provided that the underlying digital solutions are eco-designed and climate, social, and environmental KPIs are seamlessly integrated. By embedding principles of digital sobriety and frugality, minimizing data redundancy, and following transition and systems engineering principles, we can develop cutting-edge technologies that strengthen regional resilience at the EU level, accelerate growth pathways for our Small and Medium-Sized Enterprises (SMEs), and provide competitive advantages to our PMEs. Contrary to popular belief, we don't need more data; we need less. This also holds true for the development of artificial intelligence models. For instance, DeepSeek is a prime example of such digital eco-design approaches, as is the application of compressed sensing to telecom business models.
This is why our company challenges the traditional approach, offering a novel, disruptive definition of living digital twins and a set of innovative products and systems. We reverse conventional methods, minimizing data requirements and consumption flows, to address the limits and vulnerabilities of existing technologies while fully leveraging their benefits. As a result of our approach, our digital solutions and living virtual twins are at least 60 per cent more energy efficient and use at least nine times less data volume than other models.
In the construction sector, for example, conventional digital twins typically start with geographical mapping of sites (GIS), followed by data-driven insights, architectural and technical details, and then real-time data measurements of various parameters. Instead, we take a user-centred, holistic approach, where the development of the digital twin is process-led and grounded in real-life use cases. By focusing on the needs of the end-users from the very beginning, we ensure that the digital twin is tailored to practical applications and aligned with the specific requirements of its users.
Contrary to common misconceptions, ecological design does not hinder economic and technological growth—it accelerates it. Sustainable innovation leads to greater efficiency, lower operational costs, and increased resilience, with better use of increasingly scarce natural resources (water first). It makes businesses, industries, and territories more competitive and secure in the medium term, with some significant benefits already visible in the short term.
This approach not only improves functionality but also results in a significantly lower emissions and resource footprint, contributing to sustainability. Additionally, it enhances security resilience, ensuring that the digital twin is robust and adaptable to evolving challenges, providing long-term value while safeguarding both infrastructure and data.
This user-centred, process-led approach is being mainstreamed in collaboration with our partners: among public sector initiatives are the Transilvania IT Cluster in Romania, the 34 municipalities of the Golfe du Morbihan Agglomeration in Vannes, Region of Brittany, France, and a social housing company working together with the municipality of Turin, Italy.
With them, we are developing process-based living virtual twins that are not only aligned with the practical needs of these diverse communities but also prioritise sustainability, resource efficiency, and security resilience, ensuring long-term benefits for both the users and the environment. Through these partnerships, we are working to create digital twins that cater directly to the unique needs of each community, strengthening local territorial governance and public sector capabilities to deliver better and faster services and democratic processes.
*The topics covered in this initial article will be explored in greater depth in an upcoming essay, featuring contributions from co-authors who are experts and key personalities from both the defence and digital industries across European Member States. This collaborative work will provide a more comprehensive analysis and insight into the issues surrounding Europe's technological sovereignty and its digital future.
The article is co-authored by Arvea Marieni and Thierry Albert CEO of BEAM CUBE, with contributions by Colonel (ret.) Ralph Thiele, and Alexandryu Roja from the Transilvania IT Cluster in Cluj-Napoca. Cluj-Napoca has been awarded the EU Mission - Climate Neutral & Smart Cities label, placing it among the first 10 cities in the European Union. It partners with BEAM CUBE on an initiative focused on living virtual twins and advanced solutions.
illuminem Voices is a democratic space presenting the thoughts and opinions of leading Sustainability & Energy writers, their opinions do not necessarily represent those of illuminem.
Andrea Bonime-Blanc
Green Tech · AI
illuminem briefings
AI · Public Governance
illuminem briefings
Public Governance · Social Responsibility
Green Central Banking
Public Governance · Sustainable Finance
The Washington Post
Public Governance · Social Responsibility
France24
Public Governance · Climate Change