Fears of a US-controlled ‘kill switch’ are widespread in Europe. According to a recent survey by Proton, 74% of British, German and French companies are concerned that their businesses could be severely disrupted by American Big Tech pulling the plug on critical digital infrastructure. This is roughly equal to the percentage of enterprises that fear a cyberattack of some kind, yet the Swiss email provider also found that most European firms aren’t particularly well-prepared for a loss of (US-based) services.
For instance, 54% of European companies could not remain operational for more than a day if they lost access to their cloud service. And while two thirds say they would switch providers if a foreign government restricted access to one of their essential digital services, only 28% have a continuity solution in the event of a cloud outage, while even fewer – at 24% — have continuity plans in the event of not being able to access their usual AI tools.
Most European firms aren’t particularly well-prepared for a loss of US-based services
These percentages highlight the significant gap between tech sovereignty aspiration and reality. Yes, European businesses and governments are aware of the substantial benefit that would come from having more power over key infrastructure, but the fact remains that Europe is still largely dependent on the United States for much of its tech. And according to analysts speaking with Raconteur, this is likely to remain the case for at least the medium-term, even if the EU’s Technological Sovereignty Package will tip the scales in Europe’s favour.
The nature of tech sovereignty
According to Proton, there are strong signals that European companies are serious about moving away from non-European tech providers. Chief Operating Officer Raphaël Auphan points out that 56% of European firms say that geopolitical risk is driving purchasing decisions, and that geopolitical issues — as underlined by the withdrawal of Fable 5, or by the denial of Microsoft services to ICC officials — carry “the same weight” as cyber issues in the boardroom.
Such a shift has made itself known at Proton, which offers privacy-focused email, VPN, password management, and cloud services. “Signups have surged across Europe, up nearly 80% in the Nordics alone, the region among the most dependent on US Tech, with similar figures across Europe as organisations seek alternatives built on European tech,” Auphan explains. “But what’s changed most isn’t just the volume, it’s the nature of the conversations.”
Auphan reveals that organisations have approached Proton with “structured dependency-reduction roadmaps,” often stretching as much as 24 months into the future. These changes lead him to conclude that the question isn’t whether European organisations will move away from the US, but rather “how fast” such a migration will be.
The bigger investment, the bigger scale
But for analysts and policy experts, this could be a slow process. This is because the vast majority of core tech infrastructure — particularly cloud and AI services — is provided by big American players such as Google, Microsoft and Amazon. And not only do such names already provide superior products that many European firms are unwilling to renounce, but they’re also investing much, much more in development. This is why they’re likely to remain ahead of the European tech sector for some time to come.
“While there is a desire for Europe to become more tech independent, US-based cloud and tech providers will continue to dominate in Europe,” says Penny Naas, SVP of Innovation and Competitiveness at The German Marshall Fund. “The US companies invest more in R&D and in cutting edge technologies, as well as offering the largest global scale for European customers.”
Europe’s US-based counterparts are “investing 10-fold” in R&D and new data centres
Naas suggests that, despite potentially offering a less expensive service, EU-based cloud providers are “increasingly niche,” and that even the biggest account for less than 2% of the European market. On top of this, their US-based counterparts are “investing 10-fold” in R&D and new data centres. This includes Microsoft, which on its own has invested €3.2bn in Germany-based centres in the past two years, whereas the entire German cloud industry invested just under €2bn in their own domestic offerings.
“Local issues such as permitting, the price of electricity and energy, and access to cutting edge chips and other components are also important, but the real issue is that not enough private sector investment is occurring in Europe,” she adds. “European demand is then met by the US providers.”
Other analysts agree that, at least for cloud and AI, US–based providers continue to lead the pack, and that European businesses recognise this, to the detriment of sovereignty. “There is no significant shift underway,” says Philipp Eckhardt, the Head of Financial Markets and Information Technologies at the Centre for European Policy.
US–based providers continue to lead the pack, and European businesses recognise this, to the detriment of sovereignty
“Although an increasing number of companies and institutions are becoming aware of their dependency on US-based providers and the ‘kill-switch’ scenario, they remain reluctant to diversify and strengthen their sovereignty,” he explains. As with Naas, Eckhardt agrees that American providers “set the gold standard” for digital products and services, and that switching would currently mean “using less competitive” alternatives.
However, he also cites a couple of other factors that may be in play, including an instance of cognitive dissonance whereby many European organisations may believe that a kill switch could affect other organisations, but not themselves. If that weren’t enough, he believes that a free-rider dynamic is disincentivising private investment, creating an impasse.
“While a company that invests in reducing its dependency has to carry the costs, the profits from such behaviour will also accrue to other companies,” he says. “Consequently, no company will invest until others do […] nobody changes their behaviour.”
Pros and cons of the EU Tech Sovereignty Package
For Eckhardt, this is a situation that can be altered only through regulation, with one suggestion being to oblige critical infrastructure providers to diversify and/or to develop backup solutions. While there is currently no such rule in Europe, most commentators agree that the EU’s recently unveiled Tech Sovereignty Package is a welcome step towards increasing European self-sufficiency, even if it may not be equal to the sheer scale of the challenge.
“The Tech Sovereignty Package is the most ambitious plan the EU has made to address its digital dependencies, and we welcome it as a genuine step forward,” says OpenForum Europe’s Aimilia Givropoulou and Sivan Pätsch. “Notably, for the first time, open source is embedded in a coherent industrial policy framework, the value capture problem is named and backed by policy action, and the Cloud and AI Development Act introduces sovereignty assurance levels that give public sector bodies a structured way to assess their risk structure.”
For the first time, open source is embedded in a coherent industrial policy framework
There is general consensus that the framework the Sovereignty Package creates is largely positive. On the other hand, some analysts believe that a more favourable environment will need to be cultivated before Europe can achieve a meaningful degree of technological sovereignty.
“If the EU wants to boost their digital capabilities, they first need to attract private sector investors and capital,” says Penny Naas. “Regulatory advantages provide a single standard for Europe, but Europe needs to exploit its scale and its market to attract investment and ultimately provide services that citizens and consumers want.”
Eckhardt offers a complementary point, which is that any approach excluding competition from non-European companies would invite complacency among European tech companies. They would potentially have less incentive to invest and improve their products, making Europe’s tech ecosystem weaker in the longer term.
“Thus, the focus must be to ensure that European companies can act freely and independently,” he says. “They should always be able to choose among different providers in the digital sector, to switch to a different provider without incurring ruinous costs, and to keep critical or highly sensitive work and business processes under domestic jurisdiction whenever this appears truly important.”
Ultimately, Eckhardt doubts whether the Tech Sovereignty Package will make Europe fully technologically sovereign, if only because “the gap is simply too wide.” One other issue is that, within the Chips Act 2.0 (a key component of the Package), the conditions on public procurement leave space for procurement from countries with which the EU has signed strategic partnerships. Likewise, the Cloud and AI Development Act introduces four sovereignty “assurance levels” for public procurement, with the first (lowest) tier allowing for non-EU providers if the public body “explicitly requires” such providers. Article 30 of the act also exempts public bodies from “applying the requirements of this Regulation [if it] would require the contracting authority to procure services at disproportionate cost.”
Blanket sovereignty requirements would only make public procurement more expensive
While such exemptions might undermine the notion that the EU will attain tech sovereignty before the Earth becomes an uninhabitable oven, Eckhardt argues that distinctions are necessary for several reasons.
“The introduction of blanket sovereignty requirements would only make public procurement more expensive and carry the risk of wasting taxpayer money,” he explains. “This would further increase the already growing bureaucratic burden associated with tendering, and there would be a risk of creating conflicts of interest between the very different procurement objectives.”
Of course, openness to procurement from non-EU providers doesn’t necessarily entail slavish dependence on US-based hyperscalers. Chloe Teevan, an Associate Director of Geostrategy at the European Centre of Development Policy Management, explains that Europe has made a point of openness in recent years, and has invested heavily in forging stronger partnerships with other economies. As a result, the procurement question “has many facets,” and needs to be balanced with other concerns and priorities.
“Technology is one of the key areas of cooperation with a whole host of so-called ‘middle-powers,’ and Europe’s tech sovereignty will also depend on diversifying some critical supply chains into India, South East Asia and beyond,” she says. “It is vital that when the EU signs new trade agreements with countries like India, it does not undermine those agreements by making meaningful cooperation impossible.”
Adapting while sovereignty remains an ideal
The upshot of all this is that major tech sovereignty is several years away, at best. That said, Proton advises enterprises to adopt robust continuity plans in the meantime. According to Raphaël Auphan, such plans have several planks, with the first involving diversification beyond the US (wherever possible).
“Don’t use one US-owned platform for all your email, cloud storage and collaboration,” he says. “Only diversifying outside the US jurisdiction provides a solution.”
Secondly, Auphan strongly recommends testing against “full” kill switch scenarios, whereby many or all of an organisation’s digital services go offline. “Critically, test the kill switch before you need it,” he says. “Our research shows that most organisations have some form of continuity plan, but fewer than half have ever tested it under real conditions.”
Indeed, only 44% of European enterprises test their continuity plans regularly, according to Proton’s research. And given that a US-based kill switch will probably be hanging over Europe for some time, organisations should be working very hard on increasing this percentage, and quickly.
Fears of a US-controlled ‘kill switch’ are widespread in Europe. According to a recent survey by Proton, 74% of British, German and French companies are concerned that their businesses could be severely disrupted by American Big Tech pulling the plug on critical digital infrastructure. This is roughly equal to the percentage of enterprises that fear a cyberattack of some kind, yet the Swiss email provider also found that most European firms aren’t particularly well-prepared for a loss of (US-based) services.
For instance, 54% of European companies could not remain operational for more than a day if they lost access to their cloud service. And while two thirds say they would switch providers if a foreign government restricted access to one of their essential digital services, only 28% have a continuity solution in the event of a cloud outage, while even fewer – at 24% — have continuity plans in the event of not being able to access their usual AI tools.
Most European firms aren’t particularly well-prepared for a loss of US-based services
