The EU Cloud and AI Development Act

(Kenneth Propp – Lawfare) On June 3, the European Commission published its long-gestating European Technological Sovereignty Package, a sprawling and ambitious compendium of measures intended to strengthen Europe’s capacity in semiconductors, artificial intelligence (AI), cloud services, and open-source software. “We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” a press statement from Commission President Ursula von der Leyen asserted. A senior commission official who worked on the package jubilantly declared that its launch represented “Tech Liberation Day!”. The proposed Cloud and AI Development Act (CADA) is the centerpiece of the package. It also is the most important piece of legislation from the perspective of transatlantic relations, since it is squarely aimed at U.S. cloud service companies’ oligopolistic position in the European market. Indeed, as a leading European tech policy observer commented, “CADA represents a significant change in tone for the Commission, which has maintained its ‘open market’ credentials long after the U.S. and China abandoned them”. The commission’s Explanatory Memorandum accompanying the legislation delicately acknowledges that “the current landscape of cloud and AI is characterized by a pronounced dependence on a limited pool of third-country providers.” The market share of EU providers has diminished steadily in the past decade to about 15 percent. Even worse, as outlined by the commission in the memorandum, is that three U.S. cloud service providers—Microsoft, Amazon Web Services, and Google—currently control more than 70 percent of the European cloud market. According to the memorandum, the commission sees two potential legal risks from this situation. First, these providers are subject to the U.S. CLOUD Act, which enables unilateral U.S. government access to European data for law enforcement purposes. And second, unilateral U.S. sanctions measures could result in the disruption of services to European users (the so-called kill switch). – The EU Cloud and AI Development Act | Lawfare