US Cloud Act collides with EU tech sovereignty push

So the proposals include things like a second CHIPS Act to try and onshore more chip manufacturing in Europe, basic semiconductors as well as advanced AI chips, but also something called the Cloud and AI Development Act, which is a pretty sprawling legislative proposal.

It includes loads of stuff to try and encourage the adoption of AI, making it easier to build data centers.

Environmentalists are not very pleased about that part.

but also setting up a framework for public procurement, which sounds dull, but it's big bucks.

The framework sets up four assurance levels for the cloud services that public sector organizations in Europe will be buying.

And assurance level one is for the least sensitive data that you'll be handling.

Assurance level two is for more sensitive stuff.

Three, four.

You get it.

Now, it doesn't tell public sector organisations, or it doesn't tell European countries, which assurance levels they should use for which kinds of public services.

But nonetheless, it sets up the framework for what they'll be doing.

And levels three and four are where things get really sticky for big tech.

That's because these levels come with the condition that the provider of the cloud services is, quote, not subject to the control of a third country or a legal entity established in a third country.

Now, with level three, you can get an exemption from this, but only if the provider, so your Microsoft, Amazon, whoever's providing the cloud services, can show that the country that controls it is not able to access the data that it holds.

This is where an American law called the Cloud Act starts to become a serious problem for big tech.