European defence officials are resisting the part of the EU's Cloud and AI Development Act that was written with them in mind, the Financial Times reported on 4 September via AI Weekly.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source The Act, proposed by the Commission on 3 June as part of a technological sovereignty package, sorts public sector cloud contracts into four assurance levels; the top level, reserved for providers and components free of foreign control, is expected to cover about 1 percent of contracts, and that 1 percent is defence.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source The generals' objection is that the workloads in question, the F-35's digital backbone among them, run on American cloud services that are embedded in the systems rather than rented as a swappable subscription, and that ripping them out risks inferior replacements, cyber exposure during transition and friction with NATO, especially for eastern and Nordic members.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source Our assessment, with high confidence, is that the fight is over the definition of the top tier, not the existence of the law; with moderate confidence, that the derogation for cases with no adequate alternative will end up doing most of the work; and with moderate confidence that the Act's real effect will land at levels 2 and 3, on the 30 percent of contracts where European providers can actually compete.
The four levels
Lawfare's Kenneth Propp lays out Article 16. Level 1 requires EU hosting and no obligation to report unpatched vulnerabilities to a third country. Level 2 adds proof that foreign actors cannot access the data or trigger a kill switch. Level 3 requires that the provider itself not be foreign controlled. Level 4 extends that to the components and adds the highest cybersecurity certification.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source The Commission's own estimate is that 70 percent of contracts sit at level 1, 20 percent at level 2, under 10 percent at level 3 and about 1 percent at level 4.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source Two derogations soften the edges: where no adequate or comparable alternative exists, and for third countries with EU adequacy decisions.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source
The structural problem for American providers is not the tiers but the US Cloud Act, which can compel an American company to hand over data wherever it is stored; IndexBox describes it as the barrier to top tier status that no European data centre can remove.3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source That is why Google partnered with Thales to form S3NS, a French controlled entity, and why Microsoft and Amazon market European sovereign variants that keep data and staff in region while the core code stays proprietary.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source 3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source AWS is backing a 7.8 billion euro sovereign cloud investment in Germany through 2040.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source Together the three hold about 70 percent of the EU market.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source 2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source
Why defence is the hard case
Defence is the sector sovereignty rhetoric was written for and the sector where sovereignty is least available. The F-35 is the example the FT reporting uses: its maintenance, logistics and mission data systems are American cloud services woven into the aircraft's operation, not a contract a ministry can rebid.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source NATO interoperability runs on the same infrastructure. A level 4 requirement that excluded foreign controlled providers would, read literally, require European air forces to operate their most expensive aircraft off systems that do not exist.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source
The officials' three objections, per the reporting, are inferior replacements, transition risk and NATO coordination.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source All three are arguments for the derogation, and the derogation is already in the text.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source The political question is whether Brussels writes level 4 narrowly enough that the exception is rarely needed, or broadly enough that defence ministries spend the next decade filing for it.
Who gains and who loses
European providers such as OVHcloud gain a protected market at levels 3 and 4 and a preference at level 2, which is where most of the Act's commercial effect will be felt.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source Thales gains through S3NS as the model of a compliant structure.3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source The Commission gains leverage over hyperscalers who now have a reason to localize control, not only data.3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source Germany gains 7.8 billion euros of Amazon investment aimed at exactly this rule.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source
Defence ministries lose predictability while the tier definitions are argued, and face the possibility of running two stacks. The American hyperscalers lose the top of the market by statute and must decide whether to build genuinely European controlled entities or accept exclusion from 1 percent of contracts they may not have wanted anyway.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source 3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source NATO's eastern and Nordic members, who the reporting singles out, lose the most if coordination suffers, because they are the ones the alliance's cloud runs toward.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source
The counter case
The assessment that the derogation will do most of the work could underestimate Brussels. The Act is a proposal with a roadmap targeting agreement in the fourth quarter of 2027, and the Parliament and Council could tighten the exceptions rather than widen them, especially if transatlantic relations deteriorate.4 EU Cloud and AI Act tracker 2026-09-01 Proposal 3 June 2026; roadmap agreed 23 April 2026 targeting agreement in Q4 2027; leadership initiatives; sectors covered; entry into force after Q4 2027. Open source It is also possible that the defence objection is a negotiating position: ministries that say a transition is impossible often mean it is expensive, and a sovereign cloud with 7.8 billion euros of Amazon money behind it may be less inferior than the generals expect.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source On the other side, the whole Act may matter less than its critics fear if the three hyperscalers succeed in building European controlled structures that qualify at level 3, in which case sovereignty becomes a corporate form rather than a market shift.3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source And the FT's reporting rests on unnamed officials whose ministries have not stated a position in public.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source
What to watch
- The level 4 definition in the Council text. If member states' negotiating mandate, expected in 2027, narrows level 4 to exclude alliance integrated systems, the defence ministries won; if it keeps the Commission's wording, the fight moves to derogations.2 Lawfare 2026-06-24 Four assurance levels under Article 16 with their requirements; estimated shares 70, 20, under 10 and about 1 percent; derogations for no adequate alternative and adequacy countries; OVHcloud as beneficiary; proposal stage. Open source
- A hyperscaler qualifies at level 3. Any of AWS, Microsoft or Google achieving level 3 recognition for a European controlled entity before the Act is adopted would show the corporate form route works.3 IndexBox 2026-06-05 Jurisdiction based tiers; EU owned storage for sensitive data; tripling data centre capacity in five to seven years; US Cloud Act as the structural barrier; S3NS and sovereign cloud offerings. Open source
- A defence ministry signs a sovereign cloud contract. A European ministry moving a named defence workload to a European provider by the end of 2027 would show the transition is possible; none would support the officials' case.1 AI Weekly 2026-09-04 FT sourced; defence officials against rapid withdrawal; top tier about 1 percent of services; objections on inferior systems, transition risk and NATO coordination; F-35 cloud embedded not swappable; 70 percent US share; AWS 7.8 billion euro German investment to 2040. Open source
- Agreement in the fourth quarter of 2027. Meeting the roadmap date would keep the Act on track for entry into force in 2028; slipping into 2028 would suggest the sovereignty coalition is fraying.4 EU Cloud and AI Act tracker 2026-09-01 Proposal 3 June 2026; roadmap agreed 23 April 2026 targeting agreement in Q4 2027; leadership initiatives; sectors covered; entry into force after Q4 2027. Open source
The law reserves the top shelf for European clouds and the people who would use that shelf say the things on it cannot be moved. The definition of that 1 percent is where sovereignty meets the aircraft.