根据欧洲国际政治经济中心（ECIPE）的一份报告，欧洲对云主权的追求正导致成员国倾向于选择本国供应商，而非构建泛欧洲云服务市场。该报告对欧盟提出的《云和人工智能发展法案》（CADA）持批评态度。ECIPE对九个欧盟成员国的公共云合同进行研究发现，凡是援引了围绕“主权”这一新词汇的合同，全部授予了国内供应商，而非其他欧盟国家的供应商。
Europe’s drive for cloud sovereignty is leading to member states favoring providers from their own nation instead of building a Europe-wide cloud services market, according to a report critical of the EU’s proposed Cloud and AI Development Act (CADA). A study by the European Centre for International Political Economy (ECIPE) looked at public cloud contracts in nine EU member states and found that every one that invoked the new vocabulary around “sovereignty” went to a domestic provider, rather than one based in another EU country.
报告指出，在主权成为关键政策目标之前，欧洲的云采购已经高度集中于国家层面，这一结论基于对2018年至2025年间8725份与云相关的采购合同的分析。几乎所有合同都流向了同一国家的供应商，欧盟内部跨境竞争可忽略不计。此外，报告称，这些国内供应商的胜出往往实际上来自依赖大型超规模运营商提供基础设施的总承包商，而主权归属于运营商的国籍，而非服务所依赖的基础设施层。
It says that European cloud procurement was already highly concentrated nationally before sovereignty became a key policy objective, based on analysis of 8,725 cloud-related procurement contracts between 2018 and 2025. Nearly all went to providers in the same country with negligible intra-EU cross-border competition. Furthermore, the report claims that those domestic wins often turn out to be from prime contractors that are relying on infrastructure provided by the big hyperscale operators, where sovereignty attaches to the nationality of the operator, not to the infrastructure layer on which the service depends.
报告认为，问题在于对“云主权”概念的混淆，ECIPE指出，这一概念被用来代表两种不同的问题。一种将主权视为安全和韧性目标，即保障数据安全和管理风险。在此语境下，主权意味着用户对其云服务需求的供应商和设计拥有选择权。另一种将主权视为工业政策目标，即主权更多体现在欧洲总部的企业若不暴露于非欧洲供应商的竞争之下，就会更成功。
At issue is a conceptual confusion over cloud sovereignty, which is being used to represent two different problems, according to ECIPE. One treats sovereignty as a security and resilience objective, securing data and managing risks. Sovereignty here means that the user has choices over the provider and design of their cloud service needs. The second treats sovereignty as an industrial policy objective, where sovereignty is more about the notion of Europe-headquartered firms becoming more successful if they are not exposed to competition with non-European providers.
CADA同时包含了这两种不同的逻辑，且令人困惑地试图同时实现两种结果，报告如是指出。
CADA includes the two different logics and, confusingly, aims to achieve both outcomes, the report states.
该立法将欧盟的四个保证水平框定为安全、韧性和可信云服务提供的标准，但这些标准实际上旨在通过关于欧盟所在位置基础设施的要求、对第三国控制的限制以及对软件供应链的控制来强制实施主权。因此，云主权的目标有可能成为促进偏向特定供应商、限制竞争和导致数字市场碎片化的政策工具，ECIPE 警告称。
The legislation frames the four European Union assurance levels as criteria for security, resilience and trustworthy cloud provision, but the criteria actually aim to enforce sovereignty through requirements concerning EU-located infrastructure, restrictions on third-country control, and control over software supply chains. The goal of cloud sovereignty is therefore at risk of becoming a vehicle for policies that favor selected providers, restrict competition and fragment digital markets, ECIPE warns.
与其让大型美国云服务商的泛欧竞争对手得以成长和繁荣，该框架反而可能产生相反效果，即鼓励成员国倾向于本国境内的供应商，从而在欧洲造成碎片化。报告作者指出，更连贯的做法应保持韧性目标，但通过技术中立要求来限制其使用，以保持互操作性、可移植性和多云选项。该报告提出了一系列政策建议，包括将主权定义为可证明的结果，而非所有权状态。
Instead of allowing pan-European rivals for the big US cloud providers to grow and flourish, the framework may thus have the opposite effect in encouraging member states to favor providers within their own borders, leading to fragmentation across Europe. A more coherent approach would keep the resilience objectives, but temper their use through technological neutrality requirements that preserve interoperability, portability, and multi-cloud options, the report authors state. It makes a number of policy recommendations, including defining sovereignty as a demonstrated outcome, not an ownership status.
“真正的主权意味着公共采购者能够证明其数据安全，并且在必要时能够更换供应商。供应商的护照无法告诉你这一点”，ECIPE 总裁兼该研究合著者弗雷德里克·埃里克松说道。“欧洲的云市场实际上已经是国家化的。CADA 有可能将这种状况固化下来。”起草模糊但并非所有人都可能同意。今年早些时候，科技贸易协会 CISPE（欧洲云基础设施服务提供商）敦促欧盟委员会立法实现真正的技术主权，而非仅仅是其幻象。
“Real sovereignty means a public buyer can show its data is secure and that it can switch provider if it has to. A provider’s passport does not tell you that”, said ECIPE Director and co-author of the study, Fredrik Erixon. “Europe’s cloud market is already national in practice. CADA risks locking that in.”Vague drafting But not everyone might agree. Earlier this year, tech trade association CISPE (Cloud Infrastructure Service Providers in Europe) urged the European Commission to legislate for real tech sovereignty, rather than the illusion of it.
它主张，主权必须由控制权来定义，而不仅仅是看供应商是否仅仅在欧盟有存在，这意味着对底层技术的有效所有权以及免受域外法律如美国《CLOUD法案》的保护，根据该法案，华盛顿可以迫使美国科技公司（如大型云运营商）交出其持有的任何数据，包括存储在海外的数据。该组织此前曾警告称，欧委会关于云主权的标准制定得过于模糊，以至于有利于现有企业——即已经主导欧洲云市场的大型美国运营商。®
It argued that sovereignty must be defined by control, not by whether a provider merely has an EU presence, and that means effective ownership of the underlying technology and protection from extraterritorial laws like the US CLOUD Act, under which Washington can compel American tech companies such as the big cloud operators, to hand over any data they hold, including data stored overseas. The same group had earlier warned that the EC’s criteria for cloud sovereignty had been drafted so vaguely as to favor incumbents – meaning the big American operators that already dominate Europe's cloud market. ®