Tech Sovereignty Package: Europe takes back control of its public data

On 27 May 2026, the European Commission will officially present its Tech Sovereignty Package: a legislative package that could profoundly reshape the cloud and AI landscape in Europe. For the first time, Brussels is moving from a voluntary framework (Gaia-X, 2019) to legal restrictions with direct effect on the use of American platforms.

Here is what it contains, what really changes, and what you should do right now in your SME if you process public data or work with public bodies.

What the Tech Sovereignty Package contains #

The package brings together two major legislative texts:

• The Cloud and AI Development Act (CADA), which governs the use of cloud and AI for sensitive public data
• The Chips Act 2.0, which strengthens the semiconductor strand and European hardware autonomy

Both texts are based on Article 114 of the EU Treaty, which gives them direct effect in all Member States as soon as they are adopted. This is no longer a charter of good intentions like Gaia-X: it is hard law that applies.

The starting point: 70% of the European cloud is American #

The figure justifies the intervention. AWS, Microsoft Azure and Google Cloud capture around 70% of the European cloud market. For public authorities, this is a problematic situation of strategic dependency: a change in American policy, a massive price rise or a suspension of service could paralyse entire sections of the European administration.

On top of this comes the legal risk of the American CLOUD Act (2018), which allows US authorities to ask American companies for access to the data they host, including in their European subsidiaries. Its exact reach over foreign subsidiaries remains legally contested, but the risk is considered serious enough to justify countermeasures.

In practice: who can do what? #

The most telling phrase from the preparatory work: “AWS can continue to host an institutional website; it can no longer process medical records or tax data”. Three sectors of the public sphere are explicitly targeted:

• Financial data of public bodies (taxes, administrative accounts, contracts)
• Judicial data (proceedings, investigation files, criminal records)
• Health data (medical records, hospital platforms, clinical research)

What it really changes for SMEs #

If you are a French SME with no public-sector clients and no sensitive data, nothing changes directly for you in the short term. But in the medium term, several concrete effects are already visible:

• Public tenders increasingly include sovereignty criteria: a non-compliant provider is ruled out
• Large B2B accounts (banks, insurers, energy) pass these requirements on to their subcontractors in a domino effect
• The cost of US cloud offerings is likely to rise to absorb compliance costs (stronger DPAs, audits, dedicated EU zones)
• European alternatives (OVHcloud, Scaleway, Mistral, Outscale) are gaining commercial maturity thanks to this boost in demand
• Generative AI in business (a burning issue) clearly falls within the scope, with a clear advantage for Mistral and self-hostable models

This knock-on effect was confirmed on the French side from 2026, with a Prime Minister's circular that makes sovereignty an enforceable purchasing criterion and a decree that imposes SecNumCloud for the state's sensitive data: the details of the French plan to reduce dependencies.

What to do right now in your SME #

1. Map your sensitive data flows: which ones leave the EU today, to which supplier, under which contract
2. Identify unmanaged uses of generative AI (ChatGPT, Copilot in Office, Claude used directly): these are the first that will need to switch
3. Check your current DPAs: Microsoft, Google and OpenAI updated their terms in 2024-2025, and many companies have not signed them again
4. Prepare a gradual migration roadmap: not a big bang, but a switch use case by use case according to sensitivity
5. Plan ahead for the 2026-2027 public tenders: sovereignty will become an eliminatory criterion
6. Train your IT and purchasing teams: the question is no longer “is it cheaper on AWS?” but “is it legally defensible?”

The market taking shape #

If adopted as announced, the Tech Sovereignty Package will structure a European cloud and AI market that until now has been highly fragmented. Three families of players will benefit:

• The European hyperscalers, OVHcloud, Scaleway and Outscale (a Dassault Systèmes subsidiary), which have been competing head-on with the US for 10 years with no regulatory lever until now
• French AI vendors, led by Mistral AI but also Kyutai, LightOn and the INRIA/CEA ecosystem, which see public contracts opening up that were previously out of reach
• Integrators and freelancers who master the sovereign stack, able to set up an HA Proxmox cluster, deploy a local Ollama, integrate Mistral via API, and guarantee a clean GDPR audit

Conversely, purely commercial Azure / AWS resellers will have to reinvent themselves or lose a significant part of their public-sector business over 2027-2028.

My view #

I have been working on sovereign AI and European sovereign hosting since well before it became a regulatory obligation, out of conviction and for technical consistency. What the Tech Sovereignty Package changes is that SMEs that kept putting the subject off on the grounds that “ChatGPT works very well and it's cheaper” no longer have that argument. Compliance will become a prerequisite, not a sales argument.

For the SME leaders listening to me: do not wait until 27 May 2026 to start thinking about it. Migrating an AI stack from OpenAI to Mistral, moving from Microsoft 365 to a European suite (LibreOffice, Bluemind, Nextcloud), auditing your cloud subcontractors: all of this takes 6 to 18 months depending on the size of the company. If you start now, you will be ready when your institutional or key account clients start asking these questions in their tenders.

How I can help #

If you want to audit where you stand on tech sovereignty, I offer a free 30-minute AI audit to identify the main risks and the priority workstreams. To go further: a sovereign AI scoping workshop (€1,500 excl. VAT) to build your migration roadmap. And of course, I then support the technical integration: Mistral, self-hosted Ollama, RAG on a sovereign Postgres, HA Proxmox hosting in France.

Sources #

• Stéphane Le Calme, “Europe wants to take back control of its public data with the Tech Sovereignty Package” (in French), Developpez.com, 12 May 2026: https://droit.developpez.com/actu/383097/
• European Commission, agenda for 27 May 2026 (official presentation of the package)
• Article 114 of the Treaty on the Functioning of the European Union (TFEU)
• CLOUD Act (Clarifying Lawful Overseas Use of Data Act), Public Law 115-141, March 2018