Europe’s Cloud Rules Admit the Obvious: Digital Sovereignty Is Not a Slogan
## News summary
Reuters reports that European Union cloud-rule discussions could limit Amazon and Google access to strategic public tenders, a direct challenge to the assumption that governments can outsource critical digital infrastructure to the biggest foreign platforms and still call themselves sovereign. The immediate fight is about procurement rules, cloud security and access to sensitive public-sector work. The larger issue is power. Governments increasingly run on private cloud systems: tax records, defense workflows, health data, courts, identity systems, surveillance tools and AI infrastructure. If those systems are controlled by firms subject to another country’s law, lobbying structure and intelligence ecosystem, “digital transformation” becomes a sovereignty trade. Europe’s move is not automatically protectionist virtue; domestic champions can become rent-seekers too. But the core question is legitimate: when public services depend on cloud platforms, who can turn the key, inspect the system and refuse outside pressure?
## Commentary
Europe’s latest cloud-rule fight is the kind of story that sounds technical until you translate it into power. Procurement. Strategic tenders. Cloud eligibility. Data residency. These are dull words for a very old question: who actually controls the state?
Reuters reports that EU cloud rules could curb Amazon and Google access to strategic public tenders. The predictable response will be that Europe is being protectionist, that Brussels wants to punish American champions, or that bureaucrats are once again slowing innovation. Some of that may be true in places. Europe has never been shy about dressing industrial policy in moral language.
But dismissing the issue as anti-American regulation misses the point. Governments now run through digital infrastructure. Tax agencies, courts, welfare systems, hospitals, police databases, military logistics, border systems and AI tools increasingly sit on cloud platforms. A public-sector cloud contract is not just an IT purchase. It is a sovereignty decision.
If the infrastructure is owned and operated by companies headquartered abroad, subject to foreign legal demands and embedded in a foreign political economy, then a government has not merely bought efficiency. It has accepted dependency. That dependency may be manageable. It may even be worth it. But pretending it does not exist is childish.
This is where the Tom Luongo lens is useful. Sovereignty is not flag-waving. It is the ability to say no. A country that cannot control its money, energy, borders, industrial base or information systems is not fully sovereign, no matter how many speeches its politicians give. Cloud infrastructure now belongs on that list.
The United States understands this when China is involved. Washington does not treat Chinese telecom gear, apps or data systems as neutral market products. It sees them as potential instruments of state power. Europe is now applying a version of that logic back toward U.S. cloud giants. American officials and companies may hate the symmetry, but they cannot honestly claim the category is illegitimate.
The danger, of course, is that “digital sovereignty” becomes another subsidy machine. Domestic cloud providers can lobby for protected contracts, charge more, innovate less and hide behind national-security language. Bureaucrats can write rules that protect incumbents instead of citizens. Europe can turn a real sovereignty problem into a rent-seeking program. That is why the details matter.
The standard should not be “foreign bad, domestic good.” The standard should be control, auditability, resilience and accountability. Can the public authority inspect what matters? Can it migrate if terms change? Can courts enforce limits? Can citizens know where sensitive data is stored and who can access it? Can the government continue operating if a foreign dispute, sanctions fight or corporate policy shift interrupts service?
Those questions are not anti-technology. They are basic governance.
For citizens, the issue is especially important because cloud power is invisible. When a bridge fails, people see concrete. When a public cloud dependency fails, they see forms that do not process, benefits that do not arrive, hospitals that cannot access records, police tools that misfire, or agencies that blame “the vendor.” The public pays for the system but often cannot see the contract that governs it.
So Europe’s cloud rules should be judged by whether they increase real resilience or merely move the tollbooth from Seattle to Paris. The same test should apply in the United States. Outsourcing everything to a handful of private platforms is not modernization if it leaves public institutions unable to act without permission from the platforms.
Digital sovereignty is not a slogan. It is procurement, law, hardware, software, audit rights, exit rights and political courage. The cloud made dependence look weightless. It was never weightless. It was just hidden.