The European Commission on Wednesday introduced its long-delayed technology sovereignty package, a set of four proposals aimed at reducing Europe’s reliance on American and Asian suppliers in semiconductors, cloud computing, artificial intelligence and open source. While the Commission framed the plan as a route to becoming an “AI continent,” the draft legislation itself suggests a more defensive goal: regaining control over critical technologies.
Two of the four measures carry most of the weight. The first is a revised Chips Act, often called Chips Act 2.0, which shifts focus away from subsidizing factories and toward creating demand for chips made in Europe. The original 2023 law directed public money into fabrication plants but failed to meet its targets, a shortfall highlighted when Intel abandoned plans for two large fabs in Germany.
The new version expands emergency powers. According to a draft seen by the Financial Times, the Commission could require chipmakers to prioritize orders for crisis-critical products during shortages, override existing contracts, purchase chips centrally on behalf of member states, and fine companies as much as €300,000 for failing to disclose information about their supply-chain capacity.
The urgency is clear. The EU accounts for less than 10% of global semiconductor production and depends almost entirely on the US and Asia for the most advanced chips—those below five nanometres, which are used to train AI models. Although more than €52 billion in public and private funding has been pledged, the bloc’s share of global production has barely moved.
The second major instrument is the Cloud and AI Development Act, which would establish a single EU-wide framework with four tiers of cloud “sovereignty.” Public authorities would be required to assess how much of their infrastructure relies on non-EU companies. The tiers would consider control over the service and supply chain, where AI inference data is processed, where infrastructure is located, and cybersecurity.
Under current drafts, the practical effect would be to restrict member states from using US cloud providers to process sensitive public-sector data in healthcare, finance and judicial systems. Private-sector use would remain untouched.
Henna Virkkunen, the Commission vice-president for tech sovereignty, told reporters the aim was to ensure providers of critical workloads cannot hold a “kill switch” over European data. She added that US companies would struggle to reach the highest sovereignty tier because of the US CLOUD Act, which can compel American firms to hand over data regardless of where it is stored.
Commission President Ursula von der Leyen put the case more bluntly, saying the bloc cannot afford to depend on others for the technologies that keep its hospitals running and its grids stable.
The remaining two measures are softer: an open-source strategy to fund European alternatives and push public administrations toward open-source tools, and a roadmap for digitalisation and AI in the energy system. The whole package leans on the Draghi competitiveness report, which found the EU reliant on non-EU suppliers for more than 80% of its digital products, services and infrastructure.
What happens next is a question of politics as much as drafting. The texts must be approved by all 27 member states, and they are split: France and Germany have pushed for a stricter European-preference line, while the Nordics and Ireland, where US cloud firms base much of their European operations, want a softer reading.
The package also carries the EU’s first formal legal definition of “digital sovereignty,” a phrase Brussels has used for years without pinning down. Whether the instruments move the needle is the open question. Earlier efforts—from the 2023 Chips Act to the bloc’s stalling AI gigafactory programme and its sovereign cloud contracts—set ambitious targets that spending has not yet met.