Cybersecurity and European Strategic Autonomy: Can Europe Reduce Its Dependence on Foreign Digital Infrastructure?

Digital infrastructure has become essential to the functioning of European economies, governments and critical services. Cloud computing, software and digital platforms now support activities ranging from public administration and financial services to healthcare and energy. As a result, cybersecurity is increasingly a question of strategic autonomy: the EU’s ability to strengthen the resilience of the digital services, products and infrastructure on which its economy and society depend.^[1]

Yet Europe remains significantly reliant on non-European providers, particularly in cloud computing. This dependence can create strategic vulnerabilities when critical digital infrastructure is concentrated among external providers or subject to foreign jurisdictions. The European Commission has explicitly identified dependence on external cloud providers and third-country legislation as sources of vulnerability and legal uncertainty for European businesses, citizens and public authorities.^[2] However, foreign dependence does not automatically translate into insecurity. International providers can offer highly secure and resilient technologies, and complete technological independence would be both difficult and unnecessary in an interconnected global digital economy.

The central challenge for the EU is therefore to strengthen its cybersecurity resilience without pursuing an unrealistic form of technological autarky. This article argues that the EU can significantly strengthen its cybersecurity resilience by reducing excessive dependence, diversifying providers and imposing stronger security requirements, but complete technological independence is neither realistic nor necessary for European strategic autonomy.

Why Foreign Digital Dependence Creates Cybersecurity Vulnerabilities

Cloud Concentration and Systemic Risk

Europe’s dependence on non-European cloud providers is particularly significant because cloud infrastructure increasingly underpins public administrations, businesses and critical services. The European cloud market is highly concentrated: in 2024, Amazon, Microsoft and Google together accounted for approximately 70 percent of the regional market, while European cloud providers accounted for only around 15 percent.^[3]

This concentration creates a potential systemic vulnerability: an operational failure, cyberattack or major disruption affecting a dominant provider could affect a large number of organisations simultaneously. More broadly, ENISA has warned that the growing interconnectedness of digital systems allows attacks targeting critical dependencies and third-party providers to amplify their impact across digital ecosystems.^[4]

The issue, therefore, is not simply that these providers are foreign. Rather, critical European services can become dependent on infrastructure they do not directly control. The more organisations rely on a limited number of providers, the greater the potential for disruption affecting one part of the digital ecosystem to generate consequences across many others.

Foreign Jurisdiction and Control

Dependence also creates vulnerabilities through the legal frameworks governing major cloud providers. Data being physically stored within the EU does not necessarily guarantee complete European control over access to that data or the infrastructure supporting it. Providers headquartered outside the EU may remain subject to the laws of their home jurisdictions. The US Clarifying Lawful Overseas Use of Data (CLOUD) Act, for example, can require providers subject to US jurisdiction to disclose data in their possession, custody or control in response to qualifying legal orders, including when that data is stored outside the United States.^[5]

This does not mean that US authorities can freely access European cloud data. Rather, foreign jurisdiction creates potential legal and strategic uncertainty where external legal obligations intersect with European data-protection, security and sovereignty objectives. The issue is therefore one of control and predictability, rather than an assumption that foreign providers are inherently insecure.

Software and Supply-Chain Vulnerabilities

The same dependency extends beyond cloud infrastructure to enterprise software, operating systems, cybersecurity tools and the numerous third-party components on which digital systems rely. Modern software ecosystems are highly interconnected, meaning that a compromise affecting one supplier can propagate to downstream organisations. ENISA identifies supply-chain risks as a significant component of the European cyber threat landscape, accounting for 10.6 percent of the threats analysed in its 2025 assessment. The report also documents attacks exploiting third-party providers, software repositories, browser extensions and malicious software packages designed to resemble legitimate libraries.^[6]

For Europe, this means that reducing vulnerability cannot rely solely on replacing foreign providers with European ones. If dependence cannot be eliminated, the EU must instead make the infrastructure and software it relies upon more resilient through diversification, stronger security requirements and greater oversight.

The EU Response: From Cybersecurity Regulation to Digital Resilience

NIS2 and the Expansion of Cybersecurity Obligations

The EU’s response to cybersecurity vulnerabilities has increasingly focused on strengthening the resilience of organisations operating within interconnected digital environments. The NIS2 Directive, which entered into force in January 2023 and had to be transposed by Member States by 17 October 2024, significantly expanded the scope of EU cybersecurity rules beyond the framework established by the original NIS Directive. It covers a broader range of entities classified as essential or important, including organisations operating in sectors such as energy, transport, health, digital infrastructure and public administration.^[7]

Organisations must implement appropriate and proportionate cybersecurity risk-management measures, including measures addressing supply-chain security, and must report significant incidents within defined timeframes. NIS2 also places greater responsibility on management bodies, which must approve and oversee cybersecurity risk-management measures and can be held accountable for their implementation.^[8]

These requirements seek to reduce the likelihood that weaknesses within one organisation can become systemic vulnerabilities across interconnected networks. NIS2 therefore does not eliminate technological dependence. Instead, it attempts to reduce the security risks associated with operating within a highly interconnected digital environment.

The Cyber Resilience Act and Software Security

The Cyber Resilience Act (CRA), adopted in 2024, addresses cybersecurity at the level of products with digital elements. It introduces mandatory cybersecurity requirements for products placed on the EU market, covering their design, development, production and maintenance. These requirements include secure-by-default configurations, vulnerability management, security updates and responsibilities for manufacturers throughout the product’s expected support period.^[9]

The CRA requires manufacturers to identify and remediate vulnerabilities, provide security updates and, from 11 September 2026, report actively exploited vulnerabilities and severe incidents affecting the security of their products. The Regulation will fully apply from 11 December 2027.^[10]

This represents a shift from treating cybersecurity primarily as the responsibility of users towards imposing greater responsibility on manufacturers and suppliers. Importantly, the CRA does not require products to be developed by European companies. Instead, it seeks to make the digital products operating within the European market more secure regardless of their country of origin. In this sense, regulation can partially compensate for technological dependence by reducing vulnerabilities at the level of products and supply chains.

Cloud Cybersecurity and European Certification

The EU has also sought to establish common cybersecurity requirements for cloud services through the European Cybersecurity Certification Scheme for Cloud Services (EUCS), which is still being developed and finalised.^[11] Its objective is to provide a common EU framework for assessing the cybersecurity of cloud services, while broader questions concerning cloud sovereignty and non-technical risks are increasingly addressed through the EU’s wider cybersecurity and cloud policy framework.^[12]

The key question is therefore whether European cybersecurity requirements can make reliance on foreign cloud providers sufficiently manageable without requiring European ownership of the infrastructure.

European Digital Initiatives

Alongside regulation, the EU has supported initiatives aimed at strengthening European cloud and edge capabilities. Newer initiatives such as EURO-3C aim to develop federated, multi-provider digital infrastructure and reduce reliance on third-country providers.^[13] These initiatives do not eliminate foreign dependence, but they can contribute to greater diversification and technological autonomy.

Can Europe Actually Reduce Its Dependence?

Building Credible European Alternatives

Reducing excessive dependence requires Europe to develop credible alternatives to dominant non-European providers. European cloud companies already operate in the market, but Europe’s cloud and computing capacity remains constrained by limited and geographically concentrated infrastructure and continued dependence on non-European suppliers.^[14]

EU initiatives seek to expand cloud and edge-computing infrastructure and strengthen European technological capabilities. Public-sector procurement can also help strengthen European cloud capabilities by leveraging the purchasing power of public administrations and promoting EU-added value.^[15]

Yet European ownership should not be treated as a guarantee of cybersecurity. A European provider can still suffer from vulnerabilities, outages or supply-chain compromises. The goal should be to develop European providers that can compete on security, reliability, interoperability and resilience. Simply replacing foreign companies with European ones would not, by itself, make Europe more secure or strengthen strategic autonomy.

Diversification Rather Than Independence

A more realistic approach to strategic autonomy is therefore diversification rather than complete independence. Europe does not necessarily need 100 percent European digital infrastructure. It needs to avoid situations in which critical services become excessively dependent on a small number of providers.

Using multiple cloud and software providers can reduce dependence on any single supplier. The EU’s ICT Supply Chain Security Toolbox explicitly recommends multi-vendor strategies as a way of overcoming dependencies on high-risk suppliers. Interoperability is equally important because it makes it easier for organisations to move workloads and data between providers. The EU Data Act addresses these barriers by requiring measures to facilitate switching and interoperability and by reducing the contractual and technical obstacles associated with vendor lock-in.^[16]

European alternatives can further strengthen this flexibility by providing additional options rather than necessarily replacing existing providers. Strategic autonomy is therefore less about technological self-sufficiency than about having meaningful choices. Europe should be able to select, combine and switch providers without putting critical services at unacceptable risk.

The Limits of European Capacity

There are, however, significant limits to this strategy. US hyperscalers benefit from substantial financial resources, global infrastructure and economies of scale that make them difficult to replace quickly. In 2024, Amazon, Microsoft and Google together accounted for around 70 percent of the European cloud market, while European providers held approximately 15 percent; Synergy Research Group also describes cloud computing as a “game of scale,” with US providers investing heavily in European infrastructure.^[17]

European providers therefore face significant structural disadvantages when competing with the largest global hyperscalers. Switching established systems can also involve technical and organisational costs, although recent EU rules aim to reduce these barriers.

Replacing dominant providers would therefore require sustained investment and could itself create new dependencies if alternatives remain unable to operate on a comparable scale. Europe can reduce excessive dependence, but complete technological independence is neither economically realistic nor necessary for cybersecurity resilience. The more achievable objective is to ensure that foreign dependence does not become a single point of failure.

The Limits of Regulation and European Alternatives

The EU’s regulatory approach can significantly reduce the cybersecurity risks associated with technological dependence, but its capacity should not be overstated. Regulation can establish common security requirements, strengthen vulnerability management, increase transparency and improve incident reporting and response. NIS2 imposes cybersecurity risk-management and reporting obligations on entities operating in critical sectors, including requirements relating to supply-chain security, while the Cyber Resilience Act establishes cybersecurity requirements for products with digital elements placed on the EU market.^[18]

Regulation, however, cannot create technological capacity where it does not already exist. European legislation cannot create competitive hyperscale’s overnight, replace established foreign software ecosystems or eliminate the structural advantages of major US technology companies. Nor can regulation guarantee immunity from sophisticated cyberattacks. Even highly regulated systems remain vulnerable to technical failures, human error and attacks targeting previously unknown vulnerabilities. Regulation should therefore be understood as a mechanism for managing dependence, rather than eliminating it.

The same distinction applies to European alternatives. European ownership is not synonymous with cybersecurity. A European cloud provider can still experience an outage, suffer a cyberattack or depend on globally sourced hardware and software components. Conversely, a non-European provider can operate highly resilient and secure infrastructure while complying with stringent European requirements. What matters is therefore not nationality alone, but the architecture of the digital ecosystem: the ability to diversify providers, limit concentration, manage vulnerabilities and maintain continuity when individual components fail.

The EU’s strategic objective should consequently combine regulatory autonomy with technological resilience. Regulatory autonomy can reduce the risks created by technological dependence, but it cannot substitute entirely for technological capacity. A resilient European digital ecosystem will depend on the interaction of security architecture, diversification, regulatory oversight and credible technological alternatives, rather than on European ownership as an objective in itself.

Conclusion

The European Union can reduce its strategic cybersecurity vulnerabilities to a meaningful extent, but not by eliminating foreign dependence. Europe’s digital economy is deeply integrated into global technology markets, making complete technological independence neither realistic nor necessary. The more relevant objective is to reduce the security risks associated with excessive and concentrated dependence.

The analysis has shown that cloud concentration can create systemic risks when critical services rely on a limited number of providers, while dependence on software and digital components exposes European organisations to supply-chain vulnerabilities. Foreign jurisdiction can also create strategic uncertainty where providers remain subject to legal obligations outside the EU. In response, measures such as NIS2 and the Cyber Resilience Act strengthen cybersecurity requirements, vulnerability management and organisational resilience. European cybersecurity certification and the development of European digital alternatives can further reduce exposure, while diversification and interoperability can limit the risks associated with excessive provider concentration and vendor lock-in.

European strategic autonomy should therefore not be understood as technological autarky. The objective is not to ensure that every cloud service, software product or digital infrastructure component is European. Rather, Europe must ensure that dependence on foreign technologies does not become an inability to protect European data, infrastructure or decision-making capacity. Strategic autonomy ultimately depends not on eliminating dependence, but on making that dependence manageable, diversified and resilient.