Brussels itself says EU countries spend €264 billion a year on American tech, with three U.S. giants — Microsoft, Google and Amazon — dominating the cloud services market that underlies everything from email communication, the storage and processing of public and private data and many of the tools powering government services.
Some EU governments have warned that it is neither realistic nor desirable to decouple the continent from U.S. tech.
With the European Parliament in the process of finalizing a controversial trade deal with the U.S., the Commission has taken pains to insist the new measures are not aimed at American firms.
The U.S. could still retain a high level of access to the European market, given an existing data privacy pact between the EU and the U.S. and recent efforts by big U.S. companies to put safeguards in place against foreign interference.
But whether the American tech sector can continue to serve some of the most sensitive sectors of the European economy is a politically charged question that will depend on the final form of the legislation — and crucially, how it gets implemented.
As part of its proposal to keep a list of trustworthy countries, the Commission would require EU governments to run a so-called “sovereignty risk assessment” for every digital service they rely on, measuring foreign control, potential access to sensitive data and the risk of operational disruption.
Within a year, they would have to determine the appropriate level of protection for each public sector and procure digital services accordingly — unless they can prove doing so would come at a “disproportionate cost,” the proposal reads. However, the Commission reserves the right to overrule their assessment in future legislation if it believes they downplayed the risks.
The Commission estimated that just one percent of Europe’s public services are so sensitive that they would be required under the proposed certification scheme to rely on the strict level that totally excludes foreign technology.