The secretary-general of the association of cloud infrastructure service providers in Europe (CISPE), Francisco Mingorance, warned that the sovereignty risk assessment provided for in the European Commission’s draft Cloud and AI Development Act - (CADA) on the development of cloud computing and artificial intelligence services (see EUROPE 13880/2), presented as part of the Tech Sovereignty package (see EUROPE 13880/1), “risks further increasing dependence on US technologies, as European players are not in a position to meet certain criteria required for the highest assurance levels, levels 3 and 4”.
“For European cloud service providers, this text will only strengthen our dependence on US technologies”, Mr Mingorance said at the ‘De-risking European institutions: Sovereignty Cloud' conference, organised by the Renew Europe group at the European Parliament on Wednesday 1 July.
“We are very concerned. So much so that we believe that, without strong intervention from the European Parliament, CADA could become a ‘Continued American Dependency Act’ rather than the instrument it is supposed to be”, he insisted.
Mr Mingorance explained that a cloud service provider could obtain assurance levels 3 and 4 only if its services were “entirely based on open-source software or, where they rely on proprietary technology, if the proprietary provider - which, in practice, is a hyperscaler - (…) gives access to its source code so that it can be subject to an independent audit”.
“Most independent European providers currently meet neither of these two conditions: they are not based entirely on open-source software and do not have access to the source code of proprietary technologies. Only a few European companies that have entered into commercial agreements with Microsoft or Google have such access and are able to carry out the necessary audits, which would enable them to obtain a higher assurance level”, he explained.
He cited the examples of the French group Thales, which has access to Google source code, and the German companies SAP and Delos, which have access to Microsoft source code.
The head of the unit responsible for cloud policy at the European Commission’s Directorate-General for Communications Networks, Content and Technology (DG CNECT), Manuel Mateo Goyet, acknowledged that some criteria were “more or less difficult to meet”. However, he considered that “European providers are now capable of offering competitive services without depending excessively on proprietary technologies”. He recalled that four European providers of cloud services had been awarded a €180 million contract over six years to provide services to the European Union institutions, bodies and agencies (see EUROPE 13851/11).
For her part, Laura Baur, head of public affairs at Schwarz Digits, called for stronger partnerships between the public and private sectors in order to jointly develop ecosystems and technological solutions. “It then becomes easier to put in place the frameworks needed for calls for tender”, she concluded. (Original version in French by Ana Pisonero Hernández)