On European technological sovereignty and digital infrastructure

MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION

on European technological sovereignty and digital infrastructure

(2025/2007(INI))

The European Parliament,

– having regard to the Treaty on European Union (TEU), in particular Article 4 thereof,

– having regard to the Treaty on the Functioning of the European Union (TFEU), in particular Articles 173, 179 and 190 thereof,

– having regard to the communication of 9 March 2021 from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions entitled ‘2030 Digital Compass: the European way for the Digital Decade’ (COM(2021) 118 final),

– having regard to the communication of 29 January 2025 from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions entitled ‘A Competitiveness Compass for the EU’ (COM(2025) 30 final),

– having regard to Regulation (EU) 2023/1781 of the European Parliament and of the Council of 13 September 2023 establishing a framework of measures for strengthening Europe’s semiconductor ecosystem (the European Chips Act),

– having regard to Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive),

– having regard to the detailed report ‘Foresight Cybersecurity Threats For 2030 - Update 2024’ by the European Union Agency for Cybersecurity (ENISA),

– having regard to Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements,

– having regard to Regulation (EU) 2025/28 of the European Parliament and of the Council of 19 December 2024 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents (EU Cyber Solidarity Act),

– having regard to Regulation (EU) 2025/37 of the European Parliament and of the Council of 19 December 2024 amending Regulation (EU) 2019/881 as regards managed security services (Cybersecurity Act),

– having regard to the European Commission White Paper of 21 February 2024 entitled ‘How to master Europe’s digital infrastructure needs?’,

– having regard to Regulation (EU) 2023/606 of the European Parliament and of the Council of 15 March 2023 amending Regulation (EU) 2015/760 as regards the requirements pertaining to the investment policies and operating conditions of European long-term investment funds and the scope of eligible investment assets, the portfolio composition and diversification requirements and the borrowing of cash and other fund rules (text with EEA relevance),

– having regard to the report by Mario Draghi, ‘The future of European competitiveness (Part A | A competitiveness strategy for Europe)’, September 2024,

– having regard to the Enrico Letta Report, ‘Much more than a market - Speed, Security, Solidarity - Empowering the Single Market to deliver a sustainable future and prosperity for all EU Citizens’, April 2024,

– having regard to the communication of 2 July 2024 from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions entitled ‘State of the Digital Decade 2024’ (COM(2024) 260 final),

– having regard to the GSM Association recommendation in its report ‘The Mobile Economy Europe 2025’,

– having regard to the US Clarifying Lawful Overseas Use of Data Act (‘Cloud Act’), enacted in 2018,

– having regard to the US Foreign Intelligence Surveillance Act (FISA), enacted in 1978,

– having regard to the US Buy American Act and Small Business Act,

– having regard to Executive Order 13771, ‘Reducing Regulation and Controlling Regulatory Costs’ (‘One-In, Two-Out’), signed on 30 January 2017 in the USA and revoked on 20 January 2021,

– having regard to Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of insurance and reinsurance (Solvency II),

– having regard to Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (the IORP II Directive),

– having regard to Council Directive 2011/96/EU of 30 November 2011 on the common system of taxation applicable in the case of parent companies and subsidiaries of different Member States (Parent-Subsidiary Directive),

– having regard to Regulation (EU) 2019/943 of the European Parliament and of the Council of 5 June 2019 on the internal market for electricity,

– having regard to Council Regulation (EC) No 139/2004 of 20 January 2004 on the control of concentrations between undertakings,

– having regard to the Commission communication of 30 December 2021 on the criteria for the analysis of the compatibility with the internal market of State aid to promote the execution of important projects of common European interest (IPCEIs) (2021/C 528/02528/02),

– having regard to the European Parliament Research Service report by Guillaume Ragannaud, ‘The EU chips act: Securing Europe's supply of semiconductors’, June 2023,

– having regard to Rule 55 of its Rules of Procedure,

– having regard to the report of the Committee on Industry, Research and Energy (A10-0000/2025),

A. whereas technological sovereignty is our ability to master the strategic technologies necessary for our economic, security and political independence;

B. whereas the European Union depends heavily on infrastructure developed and controlled by foreign powers, particularly the USA and Asia, weakening its competitiveness, exposing its sensitive data and limiting its capacity for strategic action;

C. whereas 92 % of the West’s data are stored in the USA, and whereas 69 % of Europe’s cloud market share is held by US companies compared to 13 % by European companies, exposing European data to extraterritorial legislation, particularly the US FISA law and the US Cloud Act;

D. whereas the Union accounts for only 7 % of global investment in artificial intelligence (AI), well below the USA (40 %) and China (32 %);

E. whereas recent global shortages of semiconductors have led to factory closures; whereas the EU’s share of global microchip production is only 10 %;

F. whereas fibre optic networks only cover approximately 64 % of households, and ‘high quality’ 5G network coverage extends to merely 50 % of EU territory;

G. whereas one in eight businesses were affected by cyberattacks in 2020; whereas in 2023, according to the Hiscox report, this figure reached 58 % in Germany and 53 % in France;

H. whereas high energy costs for the operation of digital infrastructure are penalising European companies;

I. whereas public procurement is a strategic tool for supporting research and development (R&D) and European stakeholders in key sectors such as cloud infrastructure, cybersecurity, AI, semiconductors and communication infrastructure;

J. whereas, in a fragmented market, many European businesses struggle to offer solutions that are globally competitive with the international giants;

K. whereas by scattering small public subsidies among too many different projects, the EU does not enable any of them to reach a genuine critical mass;

L. whereas financial and tax incentives encourage private investment;

1. Recalls that technological sovereignty is a fundamental pillar for the EU’s competitiveness, security and strategic independence;

2. Notes that heavy reliance on foreign technologies exposes Europe to major risks, in particular legal, economic and security risks;

3. Expresses its concern that European businesses struggle to compete with US and Chinese companies in strategic sectors such as the cloud, cybersecurity, AI, semiconductors and communication infrastructure;

4. Regrets the fact that European regulations increase the administrative burden and costs for local businesses without effectively counteracting the domination of the foreign giants;

5. Reiterates that sensitive data should be hosted in sovereign infrastructure, protected from foreign extraterritorial laws;

6. Stresses the urgency of reforming European public procurement to allow Member States to restrict their strategic procurement procedures to European companies that meet sovereignty criteria;

7. Calls on the Commission to align the ‘high’ level of the European Cybersecurity Certification Scheme for Cloud Services (EUCS), still under discussion, with the SecNumCloud certification requirements to ensure hosting providers are not subject to extra-European legislation;

8. Urges the Commission to facilitate the roll-out of 5G by relaxing the conditions on the concentration of firms, in order to encourage the sharing of infrastructure;

9. Calls on the Commission and the competent committees of the European Parliament to promote public-private partnerships and make it easier for European technology companies to access private financing;

10. Calls on the Commission and the competent committees of the European Parliament to allow life insurance and pension funds to invest in strategic and emerging sectors such as the cloud, cybersecurity, AI and semiconductors; suggests reducing regulation that makes risky assets less attractive by imposing high capital requirements and a prudential principle that is too strict;

11. Requests the Commission and the competent committees of the European Parliament to review the legal framework of important projects of common European interest (IPCEIs) to include exemptions for strategic mergers and acquisitions where a project responds to a sovereignty issue;

12. Calls on the Commission to remove two regulations for each new regulation created in strategic sectors, based on the model of the US ‘One-In, Two-Out’ Executive Order;

13. Calls on the Commission to reform the European electricity market by putting an end to the merit order mechanism, which aligns prices to the most expensive sources, and by re-establishing a context in which nuclear can supply competitive, stable electricity;

14. Instructs its President to forward this resolution to the Council and the Commission.

EXPLANATORY MEMORANDUM

The European Union is currently heavily dependent on foreign technologies. This reduces its capacity for strategic action and its economic competitiveness. It also exposes its sensitive data, in particular due to US extraterritorial laws. Given the ambitions of the new Trump administration, which has announced 500 billion dollars for the key sector of artificial intelligence (AI) between now and 2029, this situation looks set to continue.

However, the EU has indisputable assets, a high capacity for research and an ecosystem of start-ups and innovative companies, as highlighted by the AI Action Summit held in Paris in February 2025.

This report analyses the main weaknesses in European strategic infrastructure. It goes on to make recommendations for rapidly achieving technological sovereignty based on competitiveness and the protection of strategic markets.

The concepts of technological sovereignty and digital infrastructure

Technological sovereignty aims to guarantee our independence and security by protecting our strategic infrastructure and reducing our dependence on non-European technology providers.

It is defined by our ability to design, develop, produce, control and protect our digital infrastructure, i.e. all the hardware and software used in data centres, high-performance computers, quantum computing, the cloud, AI, semiconductors, cybersecurity and communication networks.

1. The EU is dependent on foreign technologies, which means it faces significant risks.

1.1. With the majority of data stored and hosted outside its territory, the EU remains heavily dependent as regards the cloud.

The European cloud market is unquestionably dominated by US companies: Amazon Web Services, Microsoft Azure and Google Cloud hold approximately 69 % of cloud infrastructure market share in Europe. European suppliers such as OVHcloud and Deutsche Telekom hold only 13 %. Finally, 92 % of the West’s data are stored in the USA, in infrastructure owned and operated by US providers.

This concentration poses two problems:

• Infrastructure dependence: the EU is not able on its own to meet its growing needs.

• Legal vulnerability: the FISA law allows intelligence agencies to access US technology companies’ data. The Cloud Act allows US authorities to access data hosted by US companies, even if those data are physically stored outside the USA.

1.2. Weak investment and too much regulation are causing the EU to fall further behind on AI.

In 2021 the Union accounted for only 7 % of global investment in AI, compared to 40 % for the USA and 32 % for China. In 2023 Europe invested approximately 5 billion euros in AI, compared to 20 billion euros for the USA. The US Stargate Project plans to invest 500 billion dollars over four years.

The AI Action Summit in Paris showed that the EU was seen as a blocking factor because of its regulations.

1.3 Semiconductors: a strategic industry lagging behind.

Europe lacks cutting-edge factories capable of producing advanced semiconductors (<10 nm). Europe produces only 10 % of the world’s semiconductors, well below the 54 % manufactured in Taiwan (mainly by TSMC) and the 16 % produced in China. In parallel, according to the IndustriALL trade union federation, the EU consumed 16 % of global production in 2021. This dependence exposes the EU to geopolitical tensions and supply disruption.

The European Chips Act paves the way for offering substantial aid to foreign companies to establish production units in Europe. If Europe is simply an industrial base for technologies designed and controlled elsewhere, this will not guarantee technological independence or the acquisition of know-how.

1.4. Control of communication infrastructure is essential to facilitate and protect data circulation.

Europe’s weaknesses are apparent in three key segments:

• Terrestrial: In its White Paper of 21 February 2024, the Commission notes the inadequacy of fibre optic coverage and the delays in rolling out standalone 5G networks.

• Subsea: Cables carry 95 % of international communications. Europe has a leader, Alcatel Submarine Networks (ASN), which holds approximately one third of global market share, but the disruptions that occurred in the Baltic Sea demonstrate a lack of resilience.

• Space: Whereas US company Starlink already has more than 4,000 satellites in orbit, Europe is still in the design phase with its LEO constellations.

These dependencies make the EU vulnerable to cyberattack, sabotage and foreign interference. One in eight businesses were affected by cyberattacks in 2020 and this figure is only increasing. In 2023, according to the Hiscox report, it reached 58 % in Germany and 53 % in France.

1.5. Quantum computing and high-performance computing (HPC): the EU has indisputable assets.

The EU has launched its Quantum Flagship programme with a budget of one billion euros over ten years, and in parallel 32 EU countries have launched the EuroHPC initiative with a budget of seven billion euros. The aim is to make it easier for European companies to access advanced computing capabilities.

In Europe the Dutch company ASML produces lithography technologies used in high-performance computing (HPC) and advanced applications, including quantum computing. It means that the EU remains a vital link and maintains a strategic position in the production chain.

2. The EU can regain its technological sovereignty by focusing on research, R&D and investment.

2.1. Instead of public subsidies, priority should be given to private investment in R&D and the development of European companies.

The EU sprinkles public money across thousands of companies through a variety of small State aid mechanisms. Scattering subsidies among too many different projects means that none of them can reach a genuine critical mass. Strategic mergers and acquisitions should be promoted to enable strong European players to emerge by explicitly including strategic mergers and acquisitions in the framework of important projects of common European interest (IPCEIs).

It is private capital that has enabled the USA and Asia to dominate the semiconductors sector. European pension funds represent 3,000 billion euros of assets but, according to the European Central Bank, they allocate only 0.02 % of their assets to venture capital, compared to 2 % in the case of US pension funds.

Recommendation 1: Private institutional investors should be encouraged to invest in a diversified portfolio of European technology companies with strong potential by simplifying the regulatory framework of the European Long-Term Investment Fund (ELTIF 2.0), by promoting mergers and acquisitions and, where the EU has competence, by offering tax incentives.

2.2. Make public procurement a tool for developing Europe's technological sovereignty by reserving a share of public procurement for European companies.

Public procurement, already used in sectors like defence, is a strategic lever for stimulating R&D by creating a competitive environment. In China all public procurement contracts in strategic sectors go to national companies. In the USA the figure is 70 %. By comparison, in some EU Member States only 8 to 12 % of public procurement procedures benefit European companies.

The Buy American Act and the Small Business Act as yet have no equivalent in the EU. The Draghi report therefore recommends introducing an ‘explicit minimum quota’ for local production in public procurement procedures to act as a ‘launch customer’ for new technologies.

Recommendation 2: European public procurement should be reformed to allow Member States to restrict their strategic procurement procedures to European companies that meet sovereignty criteria.

In the case of sensitive data, a European cybersecurity criterion should be introduced that takes sovereignty into consideration. The European Cybersecurity Certification Scheme for Cloud Services (EUCS), still under discussion, does not include sufficient guarantees on the hosting of sensitive European data, even for its ‘high’ certification level. To ensure hosting providers are not subject to extra-European legislation, the EUCS should be aligned with the guarantees required by the French SecNumCloud certification on data ‘immunity’ criteria in relation to extraterritorial laws and corporate control laws.

Recommendation 3: The ‘high’ level of EUCS certification should be aligned with the SecNumCloud certification requirements.

2.3. Reduce the use of public funding by encouraging public-private partnerships.

As highlighted by the Letta report, public-private partnerships can be used to mobilise private investment while limiting the impact on public finances. Unfortunately, the Solvency II Directive on pension funds and the IORP II Directive on life insurance impose prudential rules that are too strict regarding strategic and emerging sectors.

Recommendation 4: European regulations that make assets considered to be risky and emerging less attractive by imposing high capital requirements and a prudential principle that is too strict should be reformed.

2.4. A simplification drive should reduce the regulatory burden.

Regulation is ‘an obstacle to investment’ for over 60 % of EU companies, and 55 % of SMEs identify regulatory burdens as their greatest challenges. The recent Draghi and Letta reports highlighted the same problem.

Recommendation 5: Two regulations should be removed for each new regulation created in strategic sectors, based on the model of the US ‘One-In, Two-Out’ Executive Order.

2.5. Strengthening digital infrastructure requires a sustainable and competitive energy policy.

Sustainable and competitive energy is essential to attract investment in digital infrastructure, which is highly energy-intensive.

Recommendation 6: The European electricity market should be reformed by putting an end to the merit order mechanism, which aligns prices to the most expensive resources, and by re-establishing a context in which nuclear can supply competitive and stable electricity.

ANNEX: ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

Pursuant to Article 8 of Annex I to the Rules of Procedure, the rapporteur declares that she has received input from the following entities or persons in the preparation of the draft report:

The list above is drawn up under the exclusive responsibility of the rapporteur.

Where natural persons are identified in the list by their name, by their function or by both, the rapporteur declares that she has submitted to the natural persons concerned the European Parliament’s Data Protection Notice No 484 (https://www.europarl.europa.eu/data-protect/index.do), which sets out the conditions applicable to the processing of their personal data and the rights linked to that processing.