By Michał Puchała · 2026-05-21 · 3 min read
EU cloud news, week of 2026-05-21
The highlight this week is 27 May, when the Commission's twice-delayed Tech Sovereignty Package lands. Around it: leaked detail on US-cloud restrictions, CISPE pushback on CADA, DORA entering its validation phase, and Schleswig-Holstein at 80 percent off Microsoft.
Tech Sovereignty Package set to land 27 May The package bundles the Cloud and AI Development Act, the Chips Act 2.0, an open-source strategy, and a digitalisation roadmap for the energy sector. The two cloud-relevant components are EU-wide eligibility requirements for cloud providers and a single procurement policy for public administrations. After being moved from March to April and then to May, the 27 May date is being treated in Brussels as firm. Boards in regulated mid-market firms should expect their procurement and compliance teams to start citing the package's text within weeks of publication.
Restrictions on US clouds for sensitive government data being drafted into the package CNBC reported on 7 May that the Commission is preparing rules to prevent member-state governments from using US cloud providers to process sensitive categories - health records, financial information, and legal or judicial data. The framing matters. It is not a contract ban, it is a use-case restriction. What becomes a procurement requirement for ministries tends to become an audit question for their suppliers within twelve to eighteen months, so this is also a preview of where private-sector compliance pressure is heading.
CISPE keeps pressing on "sovereignty washing" ahead of CADA The 38-provider European cloud industry body has spent the weeks since the April sovereign-cloud tender pushing the Commission to write strict-sovereignty criteria into CADA, rather than ratify the precedent set when the Commission recognised Proximus's bid (which uses S3NS, a Thales-Google joint venture) as sovereign. The procurement question is whether sovereignty is defined by who operates the service or by who owns the underlying technology. The version that lands in CADA will determine which providers count as compliant for the next several procurement cycles. This is the most live debate in EU cloud policy right now and worth tracking even for firms with no immediate procurement decision pending.
DORA enforcement enters its validation phase Financial entities filed their first Register of Information returns with the European Supervisory Authorities by the end of March, and supervisors across the EBA, ESMA, and EIOPA have signalled that audits, inspections, and corrective actions are now active rather than theoretical. Fines under DORA reach 10 percent of annual turnover, and the vendor-concentration analysis and Article 30 exit-strategy clauses are about to be tested against real engagements. For finserv CTOs, the practical implication is that "we are working on an exit plan" no longer holds up in a supervisory review. Architecture documents, parallel-run windows, and runbooks are what supervisors are asking to see.
Schleswig-Holstein at 80 percent off Microsoft, reporting €15M annual licence savings The German state has moved roughly 24,000 civil servants to LibreOffice, Thunderbird, Open-Xchange, and Linux, against a reported one-time migration cost of €9M. Copenhagen and Aarhus are mid-migration, and Denmark's Ministry of Digital Affairs has committed to the same path. The detail that matters for CTOs in regulated firms is the documentation - wave structure, parallel-run windows, training cadence, and support-model changes are being published as reference material. A three-year migration with public artefacts is the closest thing to a peer reference that mid-market firms watching the Microsoft 365 question have ever had.
Thinking about migration? Book a free consultation to discuss your situation.