2026年10月20日

The Proposed EU Technological Sovereignty Package and European Innovation Act

作者:

Several recent developments reflect the European Union’s ambition to decrease dependence on non-EU technology, and to boost the development of technology in the European Union:

On 3 June 2026, the European Commission proposed the EU Technological Sovereignty Package, a sweeping legislative initiative aimed at strengthening Europe’s ability to develop, control, and scale its critical technologies, infrastructure, services, and data. It is composed of several measures aiming at transforming the European economy through new technologies and artificial intelligence (AI), reinforcing supply chain resilience, and establishing European standards for critical technologies.
On 9 September 2026, the European Commission proposed the European Innovation Act, a Regulation under the EU Startup and Scaleup Strategy and the Competitiveness Compass for the EU, aiming at strengthening Europe's competitiveness and technological sovereignty.

In this Legal Update, we describe these developments, present some of the potential impacts of the proposed measures on global businesses and technology providers, as well as key recommendations for private companies.

The Proposed EU Technological Sovereignty Package

The proposed EU Technological Sovereignty Package comprises four main legislative and policy components, which we describe below in more detail:

(1) The proposed Chips Act 2.0;

(2) The proposed Cloud and AI Development Act (CADA);

(3) A proposed EU Open-Source Strategy; and

(4) A proposed Strategic Roadmap for Digitalization and AI in Energy.

The Package reflects the Commission’s view that Europe’s reliance on non-EU providers for over 80% of its digital products, services, and infrastructure creates unacceptable strategic risks. Legislative proposals will now be negotiated by the European Parliament and Council. In parallel, related initiatives are ongoing, including a formal call for the development of AI Gigafactories launched on 30 July 2026, intended to mobilize EUR 20 billion through InvestAI, combining EU and Member State funding with private investment and involvement from the European Investment Bank.

Proposed Chips Act 2.0

The original European Chips Act, proposed in February 2022 and in force since 2023, was the EU’s first strategic response to semiconductor supply chain vulnerabilities. However, that legislation was predominantly supply-driven. Chips Act 2.0 shifts emphasis toward demand-side measures, reflecting lessons learned from supply shortages since 2020 and growing geopolitical tensions over chip production.

The backdrop is stark: according to market analyses by the EU institutions while preparing the proposed Chips Act 2.0, the EU currently produces less than 10% of global semiconductors and is almost entirely dependent on the US and Asia for advanced chips below five nanometers, including AI chips. Semiconductors are the third most traded product in the world, and AI-related components are expected to drive around 70% of semiconductor-market growth by 2030.

Chips Act 2.0 is structured around three pillars:

Pillar I: Innovation Capacities: support for advanced chip design and R&D in Europe;
Pillar II: Investment in Advanced Manufacturing: faster permitting procedures for semiconductor manufacturing facilities and enhanced investment incentives; and
Pillar III: Coordinated Monitoring and Crisis Response: reinforced mechanisms for supply chain monitoring and responding to shortages.

The European Semiconductor Board (ESB) remains the central governance body. The Act also strengthens international cooperation on chip supply chains.

Proposed Cloud and AI Development Act

CADA addresses one of Europe’s most significant digital vulnerabilities: its reliance on non-EU cloud and AI providers. US hyperscalers currently hold approximately 70% market share in the EU cloud market. CADA aims to triple data centre capacity in Europe over five to seven years and ensure that the most critical and sensitive data is stored and processed within Europe.

CADA establishes a four-level “cloud sovereignty framework” designed primarily for public-sector procurement. Under the current draft, cloud providers may seek recognition at “Union Assurance Levels” 1-4, and public-sector bodies must use the framework when procuring cloud services. Private-sector companies are generally not required to adopt the framework, although entities operating in sectors covered by the NIS2 Directive (NIS2) may voluntarily carry out similar impact assessments and could be made subject to additional requirements in the future through delegated acts. The framework is therefore most relevant for private companies that (i) provide cloud services to public-sector customers, or (ii) operate in highly regulated or critical sectors and wish to align with emerging sovereignty expectations.

The applicable Union Assurance Level is determined through a risk-based assessment of the sensitivity of the data and the importance of the activity concerned. The four Union Assurance Levels can be summarized as follows:

Level 1 – Baseline Union Assurance: Recognition is based on a provider self-assessment. The cloud provider must be established in the EU, customer data (including metadata and telemetry) must remain in the EU, infrastructure used to provide the service must be located in the EU (unless otherwise required by the customer), providers must maintain transparency over subcontractors and demonstrate compliance with state-of-the-art cybersecurity standards.
Level 2 – Enhanced Sovereignty Assurance: Requires an independent third-party audit. In addition to the Level 1 requirements, the relevant subcontractors and personnel must also be located in the EU; technical and operational support must be performed exclusively from the EU; customer data may not be transferred outside the EU or used to train AI systems operated by third-country entities; providers and subcontractors subject to third-country control must demonstrate safeguards preventing third-country access to data or disruption of service continuity; software supply chain transparency measures must be in place (including a software bill of materials (SBOM)); the service must also meet at least a “substantial” cybersecurity assurance level under a European cybersecurity certification scheme.
Level 3 – Advanced Sovereignty Assurance: Requires an independent third-party audit and introduces stricter sovereignty requirements. In addition to the Level 2 requirements, personnel involved in delivering the service must be EU citizens (and, where relevant, hold appropriate security clearances); technical support must be provided from the EU by EU-resident personnel; and, as a general rule, the provider and relevant subcontractors must not be controlled by a third-country entity, subject to limited exceptions.
Level 4 – Highest Sovereignty Assurance: Intended for the most sensitive public-sector use cases. In addition to the Level 3 requirements, the provider and relevant subcontractors may not be subject to third-country control; the service must achieve a “high” level of cybersecurity assurance under a European cybersecurity certification scheme; and the provider must demonstrate effective control over critical software components and their long-term evolution.

The Commission estimates that approximately 70% of public-sector use cases fall under Level 1, 20% under Level 2, 9% under Level 3, and only 1% under Level 4.

For private companies that do not serve public-sector clients and are not covered by NIS2, the CADA sovereignty framework has no binding effect, although if passed, it may over time influence market standards and contractual expectations.

Proposed EU Open-Source Strategy

Europe currently spends approximately EUR 264 billion annually on non-EU proprietary digital products and services. The EU Open-Source Strategy seeks to reduce this dependency by encouraging wider adoption of open-source technologies, supporting development of open-source alternatives, and strengthening the existing ecosystem of three million European open-source contributors and 500 for-profit open-source companies.

Priority areas include cloud computing, AI, internet technologies, cybersecurity, and semiconductors. The strategy promotes open-source adoption in public administrations through updated procurement guidelines and best practices. These guidelines primarily target public administrations, but private companies bidding for public-sector contracts should monitor these developments, as they may impact procurement processes and preferences.

Proposed Strategic Roadmap for Digitalization and AI in Energy

The intersection of digital and energy policy is a strategic priority for the EU, reflecting growing demand from data centers, currently accounting for 2.5% of EU electricity consumption, with demand expected to grow from 12 GW (2025) to 28 GW (2030).

The Roadmap is structured around three pillars:

Pillar I: Sustainable integration of data centers into the EU energy system;
Pillar II: Deploying digital and AI solutions across the energy system; and
Pillar III: A data governance framework for smart energy services and AI at scale.

A complementary cross-cutting section of the Roadmap addresses cybersecurity, skills and international cooperation in energy digitalization, as well as how implementation will be monitored and reviewed.

The Proposed European Innovation Act

Separately from the Technological Sovereignty Package, the European Commission proposed the European Innovation Act on 9 September 2026 with the objective of strengthening Europe's competitiveness and technological sovereignty. It addresses structural barriers, including regulatory fragmentation, difficulties in valuing intellectual property, and inconsistent public procurement rules that have slowed Europe's ability to turn its scientific excellence into industrial leadership.

The proposed Regulation focuses on two main pillars:

Harmonized R&D Procurement Framework: A common EU procedure for research and development procurement, enabling joint cross-border procurement and expected to generate approximately EUR 1 billion per year in savings for public buyers and EUR 25.92 billion in additional annual profits for companies.
EU-wide IP Valuation Framework: A common framework for the valuation of intellectual property, an EU-wide digital marketplace connecting buyers and sellers of IP assets in deep tech and breakthrough sectors, and support for IP-backed finance, expected to unlock approximately EUR 10.2 billion per year in additional financing.

In parallel, the Commission has proposed a Council Recommendation establishing common principles for regulatory sandboxes across the EU, creating a reference framework for innovators to test new products and services in a controlled setting.

This initiative also has to go through the European legislative procedure.

Key Impact of the Proposed Changes on Global Businesses and Technology Providers

Impact on Global Businesses

Public procurement access: Companies relying on non-EU cloud or AI services to deliver public-sector contracts in Europe may face new compliance requirements, particularly for contracts involving critical infrastructure at Union Assurance Level 3 or above.
Supply chain review: The Chips Act 2.0’s focus on supply chain resilience and monitoring may require global businesses to review and diversify their semiconductor sourcing strategies.
Data localization: Companies handling EU public-sector data may be subject to data localization requirements under CADA depending on the nature of the data and service; private-to-private data arrangements are not intended to be directly affected by CADA.
NIS2 alignment: Companies subject to NIS2, including essential and important entities in sectors such as energy, transport, health, and digital infrastructure, are encouraged to incorporate the CADA sovereignty framework into their cloud and AI risk assessments; other private companies are not required to do so under CADA.
Open-source adoption: This is most relevant to companies bidding for EU public-sector contracts. The EU Open-Source Strategy may accelerate the shift toward open-source-in-procurement processes, potentially requiring businesses to adapt their technology offerings accordingly.
R&D procurement: The harmonized R&D procurement framework may create new opportunities for companies seeking to participate in EU public procurement for innovative solutions, particularly those with cross-border operations.
IP valuation and finance: The EU-wide IP valuation framework may benefit companies with significant patent portfolios or other IP assets by facilitating IP-backed financing and cross-border IP commercialization.

Impact on Technology Providers

Potential market access restrictions: Non-EU cloud/AI providers seeking to serve EU public-sector clients at higher Union Assurance Levels may face significant barriers at Levels 3 and 4 of the CADA framework, where European ownership or control requirements apply.
Audit obligations: Serving EU public-sector clients at Union Assurance Levels 2-4 would be subject to independent third-party audits, creating new compliance costs.
Competitive dynamics: European companies capable of meeting higher sovereignty requirements might gain market opportunities for contracts involving critical infrastructure.
Semiconductor ecosystem: The Chips Act 2.0 creates opportunities for technology providers willing to invest in European chip design and manufacturing, supported by faster permitting procedures and enhanced international cooperation.
Innovation ecosystem: The European Innovation Act may reshape the competitive landscape for technology providers by improving access to IP-backed financing, creating new channels for IP commercialization through the EU digital marketplace, and standardizing R&D procurement processes across Member States.

Recommendations for Private Companies

Assess your public-sector exposure: Map your operations, contracts, and data flows to assess whether your business serves EU public-sector clients or operates in critical infrastructure sectors and, if so, determine which CADA Union Assurance Level is likely to apply and whether open-source procurement preferences may affect your technology offerings.
Review cloud and data arrangements: Evaluate whether your current cloud and AI providers can meet the applicable Union Assurance Level for each use case, particularly at Level 2 and above. This is most relevant for companies with EU public-sector exposure.
Explore structural options: If you are a non-EU provider seeking to serve EU public-sector clients, evaluate what measures may be available to enable you to qualify at higher Union Assurance Levels.
If subject to NIS2, monitor CADA integration guidance: Forthcoming guidance may help inform how the CADA sovereignty framework should be integrated into your cloud and AI risk assessments.
Prepare for supply chain and semiconductor developments: Review your semiconductor sourcing strategy in light of the Chips Act 2.0’s supply-chain monitoring and crisis-response mechanisms.
Prepare for audits: Invest in compliance infrastructure for independent third-party audits at Union Assurance Levels 2-4, including documentation of data protection measures, access controls, and operational resilience.
Assess innovation strategy implications: Evaluate how the European Innovation Act’s R&D procurement framework and IP valuation measures may affect your innovation strategies, public procurement participation, and IP commercialization opportunities.
Monitor and engage in the legislative process: The proposals will now be negotiated by the European Parliament and Council. Early engagement through industry associations and consultations can help shape the final rules.

The authors would like to thank summer interns Stella da Silva Buttkus and Erin Behlic for their valuable assistance with preparing this Legal Update.