Europe needs to stop building regulatory moats, and start building markets instead

Faced with legitimate concerns about dependence on foreign cloud and AI infrastructure, European policymakers have reached for the tools they know best: regulation, certification and the promotion of national champions. This approach is understandable, the execution, however, is likely to cause more problems than it can solve.

European policy thinking has gradually moved thought three tiers of sovereignty. The first is data sovereignty, i.e. where servers sit and where data is stored, the second is operational sovereignty, concerning who controls encryption, patching and personnel access, while the third and most demanding one is legal and strategic sovereignty: which jurisdiction’s law applies and where foreign governments can compel disclosure. 

The three layers of the debate

Early EU frameworks such as the DMA (Digital Markets Act) and DSA (Digital Services Act) were almost entirely focused on the first tier, but the current debate, accelerated by transatlantic friction over the Digital Markets Act and the Digital Services Act, has pushed Europe toward the second and third. In June 2025, a European Parliament committee defined tech sovereignty as "the ability to build capacity, resilience and security by reducing strategic dependencies, preventing reliance on foreign actors and single service providers, and safeguarding critical technologies and infrastructure" . 

EU Member States signed the declaration in November 2025, pledging “to act autonomously and to freely choose their own solutions, while reaping the benefits of collaboration with global partners, when possible" .  However, these documents seem to neglect the importance of competitiveness as the foundation of resilience, true capacity and security. Without dynamic private markets in which innovative firms can enter, grow and challenge incumbents, in fact, sovereignty is a word that describes a bureaucratic architecture, not genuine strategic potential.

The compliance trap

European businesses are already navigating an unusually dense regulatory environment, formed by the AI Act, General Data Protection Regulation (GDPR), the NIS2 Directive, the Digital Operational Resilience Act (DORA), the Data Act and several national cloud certification frameworks. Proposals to layer a Cloud and AI Development Act, a revised EU Cloud Services (EUCS) scheme and Buy European procurement preferences on top of this infrastructure constitute a compliance industry rather than a strategy. 

The underlying issue is structural: large incumbents, including the American hyperscalers that European sovereignty seemingly aims to displace, have the legal team, compliance infrastructure and lobbying capacity to absorb new regulatory requirements, while startups and challengers do not. This means that every additional certification requirement that a large provider treats as a minor operational cost may represent and existential barrier for a smaller European competitor. As a result, regulatory complexity in the name of sovereignty ends up aiding the dominance of the organisations it was designed to constrain.

The champion illusion

Alongside the regulatory impulse we find the problematic belief that the government can identify and cultivate future technology champions through selective support. History shows that government are poor pickers of winners, and the vested interests that inevitably emerge make it politically very difficult to stop supporting losers once they are established. This approach leads to a set of protected national champions with little incentive to innovate and significant incentive to lobby for continued protection.

Europe already has the foundational elements that genuine champions require: world-class universities and research institutions, extensive fibre and mobile connectivity and pools of engineering talent. The obstacles are low availability of risk capital, the cost and speed of energy deployment and the structural fragmentation of the European market itself.

What actually needs fixing

Europe’s share of global AI compute capacity stands at roughly five percents, against the approximately seventy-five percent for the United States . This gap is not due to insufficient regulation but to permitting delays, grid congestion, energy cost disadvantages and a venture capital ecosystem that is a fraction of the size of its American counterpart. Addressing these issues would do more for European digital resilience than any sovereignty scoring frameworks. 

Regarding energy and infrastructure, defining pre-permitted sites with fast-track grid connection called Special Compute Zones, is a step in the right direction. Investors need speed, certainty, and a credible path to returns so accelerating the deployment of renewable energy and streamlining construction permits for data centre development would address two of the most binding constraints on European AI infrastructure. Space is scarce in Europe, but brownfield sites offer genuine opportunities if planning processes can be reformed.

The structural gap between Europe and the United States when it comes to capital reflects decades of pension system design: American and Canadian funded pension systems direct substantial capital into private equity and venture while European pay-as-you-go systems do not. Transitioning toward funded models, completing the Capital Markets Union and creating meaningful incentives for institutional investors to allocate to venture capital would begin to close this gap. University endowments capable of funding long-term research and spinouts would further deepen the ecosystem.

Additionally, talent attraction and retention should be addressed though easier immigration policies and better incentives. Building a technology company in Europe remains harder than it should be, partly because equity compensation structures are less rewarding than those available to founders and early employees in the United States. Simpler and more generous stock option schemes would have a significant impact for talented people weighing the risks of joining an early-stage startup.

Finally, there’s the issue of market fragmentation: scaling a technology company across Europe still means navigating twenty-seven distinct legal systems. A long-discussed but never delivered unified EU corporate structure, would remove one of the most practical and underappreciated barriers to building genuinely European tech firms capable of competing at global scale.

Competition should be the goal, not the obstacle

The countries that have achieved genuine digital resilience built that resilience by creating the conditions in which competitive firms could emerge, grow and challenge incumbent without being crushed by compliance costs or starved of capital, not through certification labyrinths or protected champions. 

Europe has all the potential to do the same, provided it implements a policy framework that treats competition as the goal rather than the obstacle. Digital sovereignty worth having is the one that emerges from a thriving, competitive, and well-capitalised technology sector.

Europe needs to stop building regulatory moats, and start building markets instead

By Daniele Viappiani, Economics and venture capital advisor

Faced with legitimate concerns about dependence on foreign cloud and AI infrastructure, European policymakers have reached for the tools they know best: regulation, certification and the promotion of national champions. This approach is understandable, the execution, however, is likely to cause more problems than it can solve.

European policy thinking has gradually moved thought three tiers of sovereignty. The first is data sovereignty, i.e. where servers sit and where data is stored, the second is operational sovereignty, concerning who controls encryption, patching and personnel access, while the third and most demanding one is legal and strategic sovereignty: which jurisdiction’s law applies and where foreign governments can compel disclosure. 

The three layers of the debate

Early EU frameworks such as the DMA (Digital Markets Act) and DSA (Digital Services Act) were almost entirely focused on the first tier, but the current debate, accelerated by transatlantic friction over the Digital Markets Act and the Digital Services Act, has pushed Europe toward the second and third. In June 2025, a European Parliament committee defined tech sovereignty as "the ability to build capacity, resilience and security by reducing strategic dependencies, preventing reliance on foreign actors and single service providers, and safeguarding critical technologies and infrastructure" . 

EU Member States signed the declaration in November 2025, pledging “to act autonomously and to freely choose their own solutions, while reaping the benefits of collaboration with global partners, when possible" .  However, these documents seem to neglect the importance of competitiveness as the foundation of resilience, true capacity and security. Without dynamic private markets in which innovative firms can enter, grow and challenge incumbents, in fact, sovereignty is a word that describes a bureaucratic architecture, not genuine strategic potential.

The compliance trap

European businesses are already navigating an unusually dense regulatory environment, formed by the AI Act, General Data Protection Regulation (GDPR), the NIS2 Directive, the Digital Operational Resilience Act (DORA), the Data Act and several national cloud certification frameworks. Proposals to layer a Cloud and AI Development Act, a revised EU Cloud Services (EUCS) scheme and Buy European procurement preferences on top of this infrastructure constitute a compliance industry rather than a strategy. 

The underlying issue is structural: large incumbents, including the American hyperscalers that European sovereignty seemingly aims to displace, have the legal team, compliance infrastructure and lobbying capacity to absorb new regulatory requirements, while startups and challengers do not. This means that every additional certification requirement that a large provider treats as a minor operational cost may represent and existential barrier for a smaller European competitor. As a result, regulatory complexity in the name of sovereignty ends up aiding the dominance of the organisations it was designed to constrain.

The champion illusion

Alongside the regulatory impulse we find the problematic belief that the government can identify and cultivate future technology champions through selective support. History shows that government are poor pickers of winners, and the vested interests that inevitably emerge make it politically very difficult to stop supporting losers once they are established. This approach leads to a set of protected national champions with little incentive to innovate and significant incentive to lobby for continued protection.

Europe already has the foundational elements that genuine champions require: world-class universities and research institutions, extensive fibre and mobile connectivity and pools of engineering talent. The obstacles are low availability of risk capital, the cost and speed of energy deployment and the structural fragmentation of the European market itself.

What actually needs fixing

Europe’s share of global AI compute capacity stands at roughly five percents, against the approximately seventy-five percent for the United States . This gap is not due to insufficient regulation but to permitting delays, grid congestion, energy cost disadvantages and a venture capital ecosystem that is a fraction of the size of its American counterpart. Addressing these issues would do more for European digital resilience than any sovereignty scoring frameworks. 

Regarding energy and infrastructure, defining pre-permitted sites with fast-track grid connection called Special Compute Zones, is a step in the right direction. Investors need speed, certainty, and a credible path to returns so accelerating the deployment of renewable energy and streamlining construction permits for data centre development would address two of the most binding constraints on European AI infrastructure. Space is scarce in Europe, but brownfield sites offer genuine opportunities if planning processes can be reformed.

The structural gap between Europe and the United States when it comes to capital reflects decades of pension system design: American and Canadian funded pension systems direct substantial capital into private equity and venture while European pay-as-you-go systems do not. Transitioning toward funded models, completing the Capital Markets Union and creating meaningful incentives for institutional investors to allocate to venture capital would begin to close this gap. University endowments capable of funding long-term research and spinouts would further deepen the ecosystem.

Additionally, talent attraction and retention should be addressed though easier immigration policies and better incentives. Building a technology company in Europe remains harder than it should be, partly because equity compensation structures are less rewarding than those available to founders and early employees in the United States. Simpler and more generous stock option schemes would have a significant impact for talented people weighing the risks of joining an early-stage startup.

Finally, there’s the issue of market fragmentation: scaling a technology company across Europe still means navigating twenty-seven distinct legal systems. A long-discussed but never delivered unified EU corporate structure, would remove one of the most practical and underappreciated barriers to building genuinely European tech firms capable of competing at global scale.

Competition should be the goal, not the obstacle

The countries that have achieved genuine digital resilience built that resilience by creating the conditions in which competitive firms could emerge, grow and challenge incumbent without being crushed by compliance costs or starved of capital, not through certification labyrinths or protected champions. 

Europe has all the potential to do the same, provided it implements a policy framework that treats competition as the goal rather than the obstacle. Digital sovereignty worth having is the one that emerges from a thriving, competitive, and well-capitalised technology sector.