Schedule a demo
Infrastructure: Online
+31 70 206 00 91
Dutch Spanish Norwegian Bokmål Danish
Contact Us
14 Days That Shook Europe’s Dependence on US Tech

14 Days That Shook Europe's Dependence on US Tech

vBoxx vBoxx
Articles
June 19, 2026

Between 21 May and 4 June 2026, a data disclosure, a new EU cloud law, and a change inside the European Parliament showed how quickly European digital sovereignty is moving from rhetoric to reality. Here’s what happened and what it means if you build or buy technology in Europe.

In two weeks this spring, Europe’s relationship with American technology shifted in public. Microsoft disclosed the names of European regulators to US congress. Days later, the European Commission proposed a law built to keep exactly that kind of data out of foreign reach. The day after that, the European Parliament replaced Google as its default search engine.

Three developments, less than two weeks apart. Each is worth understanding on its own and together they are a useful snapshot of where the European digital sovereignty debate now stands.

The 14 days, at a glance

  • 21 May – Investigation reveals that Microsoft handed the names of Dutch government officials to a US House committee
  • 3 June – The European Commission unveils the CADA cloud law
  • 4 June – The European Parliament makes Qwant, a french privacy-focused search engine, the default search engine for its employees

The Microsoft–Dutch data disclosure (21 May)

On 21 May, Dutch magazine Vrij Nederland reported that Microsoft had shared the names of Dutch government officials with a committee in the US House of Representatives. These officials are responsible for enforcing EU rules that regulate major technology platforms such as Google, Meta and X. The US committee is investigating what it describes as “tech censorship”.

Microsoft did not do this by choice. It did it because of the US CLOUD Act, a 2018 law that compels US-headquartered firms to hand over data in their control wherever that data physically sits. A server in Amsterdam offers no protection.

That is the core issue in one line: data residency is not data sovereignty. The Dutch government grasped the signal at once. It summoned the US ambassador and called the disclosure “extremely worrying”. Its digital-sovereignty minister was blunt, saying the country is “addicted to American programs, apps and equipment” while admitting that walking away from Microsoft quickly is not realistic.

A bigger precedent: the ICC case

This was not an isolated incident. A larger version had already played out at an international court.

In February 2025, the Trump administration sanctioned officials of the International Criminal Court over its arrest warrant for Israeli Prime Minister Benjamin Netanyahu. By May, the Associated Press reported that ICC prosecutor Karim Khan had lost access to his Microsoft email and moved to Switzerland’s Proton Mail.

The facts are partly disputed. Microsoft President Brad Smith said “at no point did Microsoft cease or suspend its services to the ICC,” and suggested the court itself moved the account. The precise mechanics remain contested. Either way, a sanctioned official in the EU ended up off a core US service and on a non-US one. In October 2025, the court replaced Microsoft Office with openDesk, a German open-source suite. When a court keeps a fallback for its own email, the risk is no longer theoretical.

The CADA cloud law (3 June)

On 3 June, the European Commission published the Cloud and AI Development Act, or CADA, the centrepiece of a wider Technological Sovereignty Package that also revives the Chips Act and aims to roughly triple EU data-centre capacity within five to seven years.

CADA does one structural thing. It creates an EU Cloud Sovereignty Framework with four “assurance levels,” and public bodies must meet the level that matches how sensitive a workload is. According to the law firm Jones Day, they run roughly like this:

  • Level 1 — data must be processed and stored on EU infrastructure.
  • Level 2 — the provider must show independence from non-EU countries and transparency over its software supply chain.
  • Level 3 — EU ownership and control, plus citizenship criteria for staff.
  • Level 4 — full supply-chain control, with no interference from any third country.

Only about 1% of public services need the strictest Level 4, which effectively excludes foreign technology. Level 3 is the one to watch, since its ownership rules could touch far more contracts. The EU’s tech chief, Henna Virkkunen, conceded the CLOUD Act makes the higher tiers “difficult to reach” for US providers. The Commission could also extend these assessments to private firms in NIS2 sectors such as banking, energy and healthcare – the provision worth watching most.

Two caveats matter. CADA is a proposal, not law: it now goes to Parliament and Council, with adoption targeted for late 2027. And it is not a ban; private companies can still use any cloud they like. It governs public procurement, not the open market.

The Parliament’s search switch (4 June)

The next day on June 4, the European Parliament officially switched its default search engine from Google to the French provider Qwant.

The move is symbolic but significant. The change is intended to align with the Parliament’s existing commitment to “digital sovereignty and the protection of users’ personal data”.

Google remains the dominant search engine across Europe, yet one of the EU’s most important institutions deliberately chose a European alternative focused on privacy and data protection.

The decision forms part of the broader effort to reduce reliance on non-European digital services and promote European technology providers that align with European values and regulatory frameworks.

While changing a search engine may seem minor, it sends a clear message:

European institutions are increasingly willing to prioritize sovereignty, privacy, and strategic independence over convenience and market dominance.

What it adds up to

Put together, the picture is consistent. The Dutch and ICC cases show the same thing from different angles: keeping data on European soil does not put it beyond the reach of a foreign government if the provider answers to that government’s laws. That is the practical core of the European digital sovereignty debate, the risk is legal and geopolitical, not only technical.

CADA shows the policy response taking shape. The public sector moves first; under the proposed NIS2 extension, regulated industries such as banking, energy and healthcare could follow. The switch in Parliament is a small, visible sign of the same instinct.

And these are not isolated cases. Across Europe, governments and institutions have been reassessing their reliance on a handful of large US providers. The ICC’s move to open-source software is one example, and several national administrations have begun similar shifts. Not everyone agrees with the direction; critics see protectionism as much as sovereignty. But it is clearly underway.

What it means for you – and where European providers come in

For anyone who builds, sells, or buys technology in Europe, the takeaway is practical rather than ideological: know how exposed your stack is to a single foreign jurisdiction, and know what your alternative is.

At vBoxx, we are a Dutch cloud provider built for exactly this question. Our infrastructure is fully European-owned and runs in our own data centre in the Netherlands, not on US hyperscalers, so it isn’t subject to the US CLOUD Act the way US-headquartered platforms are. We offer secure, GDPR-compliant alternatives to the everyday tools: encrypted file storage and sharing, email, collaboration and password management with your data kept in the EU and owned by you.

If you are reviewing where your data and tools sit, that is a conversation we are glad to have. Contact our team of experts today.

Sources

-
Related Posts