Microsoft May Be Excluded from Top-Tier Contracts Under EU Cloud and AI Act

The European Commission released the Cloud and AI Development Act to classify cloud providers into four sovereignty tiers based on data handling, supply chain origins and physical facility location. Public authorities will be obligated to store highly sensitive government information only with providers meeting EU-based operations, and evaluate sovereignty risks of any external provider. This framework aims to reduce reliance on non-EU technology firms and bolster control over critical data within the bloc.

Under the new rules, U.S. cloud giants including Microsoft may struggle to achieve top-tier status due to the extraterritorial reach of the U.S. Cloud Act, which empowers American authorities to demand access to data stored worldwide. Providers in top tiers will be eligible for sensitive government contracts, leaving Microsoft at a competitive disadvantage for these engagements. Microsoft and other U.S. firms have launched sovereign cloud offerings in Europe to address these concerns, but full compliance with the highest sovereignty requirements remains challenging.

The act also targets tripling EU data center capacity over the next five to seven years, offering priority grid connections and reduced network fees for facilities using European-manufactured chips or achieving lower energy consumption. This initiative is designed to spur investment in local infrastructure and support the growth of sovereign cloud services across key industries such as banking, energy and healthcare. Companies meeting these criteria are positioned to capture a larger share of future public procurement in strategically sensitive sectors.