On a morning in May 2025, the chief prosecutor of the International Criminal Court arrived at work in The Hague and found he could not access his email. There was no cyberattack, no server failure. Karim Khan had been placed under US sanctions following an executive order from the Trump administration, and Microsoft — which hosted the ICC’s email infrastructure — complied with American law. Khan switched to Proton Mail.
It was, in the retelling, almost mundane. One man locked out of one Outlook account. But it landed in European policy circles with the force of a demonstration, not an anecdote. In March 2025, Amsterdam Trade Bank lost access to cloud services entirely when Microsoft and AWS complied with a US court order to suspend operations. A Dutch bank, in Amsterdam, locked out of its own infrastructure by a decision made in Washington. Dutch parliamentarians asked publicly whether ordinary citizens could lose access to their Microsoft accounts because of American sanctions. The answer, under the US CLOUD Act — which allows American authorities to compel access to data held by US cloud providers regardless of where that data is stored — was: possibly.
That is the context in which the European Commission published its Technological Sovereignty Package on June 3. And it is the context in which, on June 4 — the very next day, with timing that was not accidental — the European Parliament quietly switched the default search engine on every computer in its buildings from Google to Qwant.
What the package actually says
The Technological Sovereignty Package has four components. Two are legislative proposals that will go through Parliament and Council before becoming law. Two are strategies and roadmaps that will shape the Commission’s own actions.
The Cloud and AI Development Act — CADA — is the most consequential text. Three US cloud providers currently control around 70% of Europe’s cloud market, and the US CLOUD Act means American authorities can compel those providers to hand over data regardless of where it is stored. CADA responds to this by introducing a single EU-wide sovereignty framework for cloud and AI. For government digital services, the regulation introduces sovereignty risk assessments covering foreign control, data access risk, and disruption risk, with the strictest restrictions on non-EU providers applying to sensitive public-sector workloads in healthcare, finance and justice.
The regulation also mandates tripling EU data centre capacity over the next five to seven years, with the Commission setting minimum performance standards for both new and existing data centres and a “needs assessment” due by 2027. This is not a minor infrastructure goal. Europe is currently running a significant deficit in compute capacity relative to the United States and China at exactly the moment AI workloads are driving exponential growth in demand for that capacity.
The Chips Act 2.0 updates the 2023 original. The new act proposes the first EU open foundry for sub-3nm semiconductor manufacturing, with pilot production planned for 2030 to 2033. It also introduces “Demand Accelerators” — mechanisms linking chip producers to buyers through offtake agreements, designed to make the investment case for new fabrication plants in Europe commercially viable rather than purely politically aspirational. The EU currently purchases most of its microchips from Taiwan, followed by South Korea and China. AI-related components are projected to account for more than 70% of the global semiconductor market by 2030, and Europe’s position in that market — both as a manufacturer and as a buyer — is structurally weak.
The Open Source Strategy and the energy digitalisation roadmap are less legislative and more directional. The open source document pushes public administrations toward open source software and promotes European alternatives to proprietary US platforms. The energy roadmap addresses the role of AI in managing smart grids, a question that connects directly to energy security concerns that have dominated EU policy since the Hormuz crisis.
Commissioner Henna Virkkunen, who holds the Technological Sovereignty portfolio, framed the package in terms that left little ambiguity about who it is aimed at: “We live in a world where geopolitics and technology are inseparable. Those who drive technological innovation will shape the future. It is time for Europe to take control of its own data, its own supply chains, and its own future.”
Von der Leyen was blunter: “We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure. We want to be sure nobody has a kill switch.”
Qwant and what it represents
The Parliament’s switch from Google to Qwant is, measured in actual impact, small. The change affects 720 lawmakers alongside thousands of assistants and administrative staff — a meaningful number within the institution, but a rounding error in the context of Google’s roughly 90% share of Europe’s search market. Windows is still running on Parliament computers. Microsoft Office is still the productivity suite. Foreign-built phones and email clients are firmly established. One think tank analyst, contacted by Notebookcheck, put it plainly: Google is no longer the default search engine in the European Parliament, but it remains deeply embedded in European institutional life in essentially every other way.
Qwant is a French search engine founded in 2013. Its core pitch is that it does not track users — no behavioural profiling, no ad-targeting, no quietly feeding data to an advertising machine. The switch was announced in an internal Parliament email on June 3, timed to coincide with the Commission’s sovereignty package launch the same day.
The timing matters more than the technology. The Parliament’s decision to drop Google was not driven by Qwant’s superiority as a search product. Reviewers have consistently noted that Qwant’s search quality, while adequate, does not match Google’s. The switch was driven by what Qwant is not: it is not an American company subject to American law. That distinction is, in the current political environment, the product.
The risk embedded in that logic is the flip side of the opportunity. Being chosen for sovereignty reasons rather than product quality creates a fragile competitive position. If Qwant’s results frustrate enough lawmakers, the revert-to-Google option is always one click away. Sovereignty preferences imposed from the top down on users who have a better alternative at their fingertips are difficult to sustain. The EU experienced this in industrial policy with solar panels and steel — protection can generate capacity but not competitiveness.
The kill switch question, examined properly
The phrase “kill switch” has become shorthand in European policy discussions for a specific fear: that the US President could, at will, order American cloud providers to cut services to European customers. The ICC prosecutor incident is cited as evidence that this is not hypothetical.
The legal and technical reality is somewhat more complicated. A paper published in April by researchers drawing on the text of the CLOUD Act, IEEPA, and recent Supreme Court case law argues that the popular “kill switch” framing rests on a substantial oversimplification of both American constitutional structure and modern cloud architecture. Power in the US system is divided between president, Congress and the courts; emergency authority is institutionally bounded.
Microsoft’s own position on the ICC incident illustrates the ambiguity. Microsoft president Brad Smith told Politico that there was no ICC blockade — that when Khan’s Outlook account was affected, Microsoft remained in contact with the ICC to keep services running. The company denied that services were interrupted at any point. The ICC itself subsequently migrated to openDesk, the German open-source alternative, regardless of what Microsoft said.
Meanwhile, Cori Crider, executive director of the Foundation for Open Technology Innovation, called the sovereign cloud products offered by AWS, Google, and Microsoft “sovereign-washing” — arguing that in the event of sanctions, the companies will be unable to update their software regardless of where the data is stored, which renders the sovereignty guarantees hollow under the conditions that most matter.
The honest assessment is that Europe’s concern is legitimate even if the worst-case scenario is less mechanically simple than the kill switch metaphor implies. The CLOUD Act gives American authorities meaningful leverage over data held by US providers. Executive Order 14203 demonstrated that US sanctions can reach into European digital infrastructure in ways that disrupt operations. The question of whether that constitutes a “switch” that can be flipped at will, or a complex legal and political process with significant friction, is important but somewhat beside the point. Sixteen European countries are assessed as being at high risk of being affected by US cloud leverage, including Germany, France, Poland, Denmark, Finland and Ireland; seven more are at medium risk. That is not a theoretical vulnerability.
Whether the package is enough
The Centre for European Policy Network published its assessment of the tech sovereignty package on June 3, the same day as the launch. Its conclusion was double-edged: the package is “the most coherent attempt the European Commission has made so far to address structural technology dependencies,” while also warning that “sovereignty pursued through procurement preferences and protectionist certification produces protected industries, not competitive ones.”
The Commission’s own strategy document says explicitly that technological sovereignty “does not mean isolation, protectionism, or tech decoupling.” What matters, the document argues, is having the freedom to choose between providers, to switch without ruinous costs, and to keep sensitive workloads under domestic legal jurisdiction when that genuinely matters. This does not automatically mean foreign competition must be excluded from public tenders.
That is the right principle. The problem is in the execution. European fabs face higher construction costs, slower permitting, and skill shortages relative to competitors in Taiwan and South Korea. The Chips Act 2.0’s Demand Accelerators are designed to address the chicken-and-egg problem — you need domestic customers to justify building fabs, and you need fabs before you can have domestic supply — but whether offtake agreements between chip producers and buyers can replicate the scale and pace of investment happening in the US and Asia is genuinely uncertain.
On cloud, the CADA framework will take years to implement, and the strictest sovereignty requirements will apply only to sensitive public-sector workloads. AWS, Microsoft Azure, and Google Cloud will continue to dominate European enterprise and consumer cloud for the foreseeable future. The question is not whether that changes overnight — it will not — but whether the regulatory architecture being put in place now creates the conditions for viable European alternatives to compete on merit over the next decade.
The Tony Blair Institute’s Director of Science and Technology, Keegan McBride, offered a pointed summary to CNBC: “This package is an important step — in the age of AI, access to computing power, energy, talent and digital infrastructure will determine which countries prosper. But a full retreat into a Europe-first tech approach will leave the continent weaker.”
That tension — between the legitimate security logic of reducing dependency and the economic logic of staying integrated with the world’s most advanced technology providers — is the one the Technological Sovereignty Package does not fully resolve. It acknowledges both sides. It tilts toward action. Whether the action is calibrated correctly will take years to know, and by then the competitive landscape will have shifted again.
For now, the European Parliament is running Qwant. It is a small thing. It is also, in its way, the whole argument in miniature.
Sources: European Commission, Technological Sovereignty Package press release (June 3, 2026), https://commission.europa.eu/news-and-media/news/strengthening-europes-tech-sovereignty-2026-06-03_en;
European Commission, Chips Act 2.0, https://digital-strategy.ec.europa.eu/en/policies/chips-act-2;
European Commission, Cloud and AI Development Act overview, https://digital-strategy.ec.europa.eu/en/news/commission-proposes-tech-sovereignty-package-strengthen-europes-digital-autonomy-and-resilience;
Silicon Republic, “EU sovereignty package aims to end reliance on foreign cloud, chips and AI” (June 3, 2026), https://www.siliconrepublic.com/business/eu-sovereignty-package-aims-to-end-reliance-on-foreign-cloud-chips-and-ai;
Centre for European Policy Network, assessment of tech sovereignty package (June 3, 2026), https://www.cep.eu/eu-topics/details/eu-tech-sovereignty-package.html;
Euronews, “Europe’s defence cloud reliance risks US kill switch, think tank warns” (April 17, 2026), https://www.euronews.com/next/2026/04/17/europes-defence-cloud-reliance-risks-us-kill-switch-think-tank-warns
Subscribe to EuroLuminant for independent European journalism.
