In a significant shift, the European Union (EU) has scrapped sovereignty requirements in its proposed Cybersecurity Certification Scheme (EUCS), potentially easing the path for tech giants like Amazon, Google, and Microsoft to bid for cloud computing contracts in the region. A leaked document obtained by Reuters indicates that the EU has eliminated a clause mandating vendors’ independence from non-EU laws.
The EUCS initiative aimed to establish a framework certifying the cybersecurity of cloud services, assisting governments and businesses in the EU in selecting secure and trustworthy vendors. However, disagreements within the EU have hindered the scheme’s progress.
This development arrives amidst the growing interest of tech behemoths in securing government cloud contracts, seen as a lucrative avenue for business expansion. While Big Tech eyes this opportunity for growth, the EU harbors concerns over potential illegal state surveillance. In addition, some EU member states fear that the dominance of U.S. cloud providers could stifle emerging European competitors.
Earlier drafts of the EUCS proposal circulated among EU governments, included stringent sovereignty requirements. For instance, U.S. tech giants were mandated to establish joint ventures with EU-based companies and process customer data within the EU to qualify for the cybersecurity label. However, these provisions faced backlash from European financial institutions, clearinghouses, insurance groups, and startups, arguing for a focus on technical provisions rather than political obligations.
The most recent draft of the EUCS, dated 22 March 2024, has notably removed sovereignty requirements. Instead, cloud vendors are now only obligated to disclose information regarding the location of data storage and processing, along with applicable laws.
The revised draft is currently under review by EU member states. Following this review, the European Commission is expected to finalize the scheme. As of now, the EU executive has not provided any official comment on the matter.