The Technology Sovereignty Package, [1] presented by the European Commission on 3 June 2026, marks an evolution in the EU’s digital and industrial strategy: alongside the regulatory leadership that has characterised EU digital policy over the past decade, the Commission now places the development of its own technological and industrial capabilities at the forefront.
The Commission links this strategy to the concept of open sovereignty, aimed at reducing strategic dependencies and exposure to external interference, without falling into isolationism, protectionism or technological decoupling. The logic of the package responds to the need to mitigate a structural vulnerability: the EU remains structurally dependent on non-European providers for more than 80% of its digital products, services, infrastructure and digital intellectual property.[2] This situation becomes particularly problematic in a context of geopolitical fragmentation, market concentration, export controls and the potential weaponisation of supply chains
The objective is to progressively build a “European Technology Stack”: a more complete, resilient and competitive European digital value chain capable of supporting AI, cloud, data, chips, open-source software, cybersecurity and energy under conditions compatible with the Union’s strategic interests.
Architecture of the package
The package is specifically structured around four interrelated instruments:
- Chips Act 2.0:
- Cloud and AI Development Act (CADA)
- Open Source Strategy
- Strategic Roadmap for Digitalisation and AI in Energy
The package combines legislative and strategic instruments. The first two initiatives are proposals for Regulations subject to the ordinary legislative procedure[3]; the other two are strategies or communications, although certain open-source measures are incorporated into CADA as binding provisions.
What does each instrument contribute?
- Chips Act 2.0 translates technology sovereignty into industrial capacity. The EU seeks to accelerate the transition from research to production (“lab-to-fab”), strengthen pilot lines, photonics, quantum chips, competence centres and financing, and complement supply-side measures with demand-side tools such as grand challenges, demand accelerators, innovative public procurement and crisis-response mechanisms. The key point is that Europe cannot sustain digital autonomy if it cannot design, manufacture, package and secure the supply of critical semiconductors for automotive, energy, defence, telecommunications, health and AI.
- CADA positions cloud and AI as strategic infrastructure. It responds to two vulnerabilities: insufficient European capacity and dependence on non-European hyperscalers. Its novelty lies not only in expanding data centres, but also in structuring the market through national strategies, acceleration zones, strategic projects, faster permitting and a Cloud Sovereignty Framework with four assurance levels. [4] In addition, it transposes that framework into public procurement: the public sector will have to assess sovereignty risks and procure services with appropriate levels of assurance where relevance to public order exists. This is intended to prevent “sovereign washing” and give scale to European providers.
- The Open Source Strategy turns openness into a mechanism of control. Open source makes it possible to audit, adapt and reuse software, reduces lock-in and facilitates interoperability. Although the strategy does not impose direct obligations by itself, CADA incorporates measures to promote open solutions in the public sector, reuse software developed by or for public administrations, create a European catalogue and establish a network of Open Source Programme Offices. The Commission also aims to better integrate open-source communities into digital standardisation.
- The Roadmap for Digitalisation and AI in Energy addresses the physical bottleneck of the technology stack. More AI and cloud mean more data centres, electricity consumption, pressure on grids and water consumption. Accordingly, digital sovereignty also depends on clean, flexible and available energy. The Roadmap provides for agreements between authorities, data centres and energy actors, a European sustainability rating, smart grid indicators, regulation on smart meters, AI testing for grids and a framework for cross-border energy data sharing.
Legal and market impact
The Package shifts the centre of gravity from a purely regulatory logic towards a capacity-building policy. Its effects will not be limited to large technology providers: they will affect public procurement, critical infrastructure, cloud, data centres, energy, software providers, public administrations and companies operating in strategic sectors.
For private operators, the message is clear: the EU intends to promote a more resilient and interoperable technology ecosystem that is less dependent on external providers or jurisdictions. Although the package does not establish a general preference for European technologies, it does introduce incentives, certification mechanisms and procurement criteria aimed at strengthening technological autonomy and security of supply in strategic sectors.
For the public sector, the change is more profound. Technology procurement is no longer assessed exclusively in terms of price, functionality or performance, but now incorporates technology sovereignty considerations, such as dependence on certain providers, exposure to extraterritorial laws, security of supply, audit and control capacity, interoperability, sustainability and the resilience of the infrastructure used. In this context, public procurement becomes a tool for reducing strategic dependencies and supporting the development of European technological capabilities.
Next steps
Implementation of the package will be gradual. Chips Act 2.0 and CADA will have to proceed under the ordinary legislative procedure, while the Open Source Strategy and the Roadmap for Digitalisation and AI in Energy will guide future regulatory initiatives, funding programmes and coordination actions at European level. Although many of its measures will require further regulatory development and progressive implementation by the Member States, the package already provides a clear signal as to the direction of European technology policy: strengthening Europe’s own capabilities in technologies and infrastructure considered strategic for the Union’s competitiveness, security and resilience.
Conclusion
The package’s main strength lies in the interdependence of its different instruments. There is no AI without cloud; no cloud without data centres; no data centres without energy; no digital autonomy without chips; and no effective control without auditable software, open standards, cybersecurity and aligned public demand.
The EU is not proposing to close its market, but rather to reduce structural dependencies that could constrain essential sectors of the European economy, security and democracy. Technology sovereignty is therefore framed as an open, industrial and systemic strategy: open because it preserves international cooperation; industrial because it requires productive capacity; and systemic because it connects technology, energy, data, public procurement and geopolitical resilience.
[1] https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1187
[2] https://digital-strategy.ec.europa.eu/en/policies/eu-tech-sovereignty
[3]Articles 173(3) and 114 of the Treaty on the Functioning of the European Union
[4]The Cloud Sovereignty Framework is analysed in greater detail in another post in this series, available here: https://acrosslegal.com/cloud-sovereignty-framework-eu/
↳ Discover more content in the section Insight.
↳ Do you want to stay up today about the sector related news? Follow us on LinkedIn.
