Earlier this week, the European Commission put forward the European Technology Sovereignty Package. The new package hopes to address concerns raised in the previous Draghi Report, namely that the EU remains structurally reliant on non-EU providers for over 80% of its digital products, infrastructure, and IP.
The fundamental objectives of the package have been stated to be:
- to transform the EU economy by driving the adoption of new technologies and AI;
- to reinforce resilience of EU supply chains; and
- to promote the European way for technology sovereignty.
What are the components of the Technology Sovereignty Package
The package includes two new legislative proposals, the Chips Act 2.0 which will build upon the previous Chips Act which entered into force in September 2023, and the Cloud and AI Development Act (“CADA”). As well as this, the Commission published a new Open Source Strategy, and a Strategic Roadmap for Digitalisation and AI in Energy.
Cloud and AI Development Act
CADA builds upon the Commission’s AI Continent Action Plan which was launched in April 2025, and intends to strengthen the EU’s cloud and AI ecosystem, investment and infrastructure. The focus of the legislative proposal is on research, development, and innovation, as well as enhancing capacity and autonomy. CADA requires that each Member State establish a national cloud and AI strategy within one year of CADA entering into force, which must include measures to increase the development and deployment of AI in various sectors including healthcare, energy, and mobility.
Under Title III of CADA, EU Member States will be obligated to designate at least one data centre acceleration zone, taking into account the infrastructure which will be available when determining location. Any “data centre strategic project”, being developed in a data centre acceleration zone will enjoy the benefit of a baselines permit authorising the deployment of the data centre, an efficient, transparent and timely administrative process for additional permits falling outside of this baseline permit, and a further dedicated toolbox.
In addition, Title IV provides for a new “cloud computing sovereignty framework”. This is designed to assess, by way of conformity self-assessment or independent audit, each cloud computing service provider against “assurance levels”. These assurance levels are based on the location of the provider and the associated infrastructure, the cybersecurity standards met, the supply chain measures in place and the sub-contracting caried out by the provider. The assurance level will have important implications for public procurement processes for union entities and public sector bodies throughout the EU, and may also be considered by private sector entities operating in sectors of high criticality. Each Member State will designate one or more competent authorities under CADA to enforce the cloud computing sovereignty framework.
Other aspects of the proposed legislation relate to the establishment of a European public sector cloud federation and promoting open source software solutions (particularly by public sector bodies).
Chips Act 2.0
As previously mentioned, the Chips Act 2.0 sets out to build upon the progress made by the original Chips Act. Today, semiconductors are the third most highly traded commodity in the world, and the Commission states that this legislative proposal will reinforce the EU’s current strengths in this market while further developing its capacity in semiconductor technology.
The proposals include simplified permitting for manufacturing plants of semiconductors, and coordination of direct EU investment to ensure funding for strategic semiconductor projects. This will be beneficial to any entity basing their semiconductor development in the EU.
In order to reinforce the semiconductor supply chain in Europe, a monitoring and crisis response framework is also proposed. Any entity operating in the semiconductor sector will need to be aware of the information they may be required to share with the Commission, but as part of ongoing sector monitoring and crisis response. Undertakings may face fines of up to €300,000 or periodic penalties of up to 1.5% of current daily turnover where they fail to respond to request for information under the Chips Act 2.0.
As with CADA, Member States will designate one or more competent authorities to oversee the application of the Chips Act 2.0 once it comes into force. There will also be a European Semiconductor Board established with representatives from each Member State to assist with EU-wide semiconductor policy going forward.
Open Source Strategy
Open source software has been identified by the Commission as a potential avenue to lessen the EU’s current dependence on third-country IT products and services. The strategy has four primary objectives:
- leverage open source for technological sovereignty;
- strengthen and promote a vibrant open source ecosystem;
- promote open and interoperable digital ecosystems for public administrations, including EU institutions; and
- reinforce digital standards and international outreach.
The strategy seeks to both promote the use of existing open source technologies and foster the development of new open source software, building upon the concept of “open source software stewards” found in the Cyber Resilience Act (previously discussed here).
Strategic Roadmap for Digitalisation and AI in Energy
The roadmap is structured around three central pillars each designed to support the sustainable growth of the digital sector in the EU:
- Pillar I – Energy for AI: The Commission has highlighted the critical role that data centres play in terms of competitiveness and digital sovereignty and aim to triple EU data centre capacity in the next 5-7 years. The Commission also recognises the challenges that come with the additional energy requirements. To address these challenges, the Commission intends to publish a model tripartite agreement for the sustainable integration of data centres into the energy system before the end of 2026 and design an EU energy rating scheme for data centres also to be adopted this year.
- Pillar II – Digitalisation and AI for the energy system: The Commission intends to accelerate investment in more resilient and smarter electricity grids throughout the EU. This echoes the previous aims of the European Grids Package presented earlier this year. A further legislative proposal to accelerate the rollout of smart metres is expected in 2026. In addition to this, Horizon Europe will provide ~€75 million for the development of AI models for grid management and planning in the energy sector.
- Pillar III – Data for AI and the energy system: Smart energy systems require accurate data to build. In order to assist with the pursuit of Pillar I and Pillar II, the Commission aims to make cross-border energy exchange simpler, more efficient and more predictable. A framework to accomplish this will be developed in 2027, following an initial assessment this year.
In order to further bolster the use of AI systems in the energy sector, the Commission intends to work with Member States to establish AI regulatory sandboxes specifically for energy AI applications, and to issue additional guidance on high-risk AI systems in line with the AI Act.
Next steps
The Open Source Strategy and Strategic Roadmap for Digitalisation and AI in Energy will now form a basis for future policies of the European Commission. We can expect to see the first initiatives and / or legislative proposals which result from these strategies later this year.
The two legislative proposals, the Chips Act 2.0 and CADA, will be negotiated by the European Parliament and Council of the European Union prior to entering into force. This process will certainly involve in-depth trilogue negotiations, and changes to the initial proposals are to be expected before a final agreement is reached. We will monitor the negotiations closely and provide any relevant updates.
Contact us
If you have any questions on anything contained in this article or on the European Technology Sovereignty Package in general, please feel free to reach out to a member of the Technology and Innovation Group or your usual Matheson contact.
