EU Tech Sovereignty Package: digital sovereignty for chips, cloud and cybersecurity

In June 2026 the European Commission presented the EU Tech Sovereignty Package — a coherent set of measures for digital sovereignty across the technology stack: chips, cloud, open source, cybersecurity and industry. For CIOs, CISOs, executives and procurement it is more than industrial policy: it changes which dependencies are acceptable and which evidence will become standard in tenders, architecture boards and critical-infrastructure programmes.

What the package contains

The Commission bundles four components:

1. Chips Act 2.0 — successor to the European Chips Act; strengthens manufacturing, design and supply-chain resilience in semiconductors, reducing strategic third-country dependencies.
2. Cloud and AI Development Act (CADA) — aims to expand EU datacentre capacity sharply and create an EU-wide framework for sovereignty and risk assessment in cloud and AI.
3. EU Open Source Strategy — treats open source as strategic infrastructure: funding, skills, start-ups and stronger use in authorities and critical domains — including cybersecurity and digital identity.
4. Strategic Roadmap for Digitalisation and AI in Energy — integrates AI into power grids and energy infrastructure for resilience and efficiency.

The package complements competitiveness and economic-security initiatives — not an isolated digital law but a full-stack sovereignty agenda.

Digital sovereignty — a definition for decision-makers

In this context digital sovereignty means Europe’s ability to control development, operation and replacement of critical technologies — without existential reliance on single non-EU vendors or opaque supply chains. Motivation is economic and security-related:

• semiconductor supply for automotive, industrial automation and datacentres,
• cloud and AI infrastructure for government, health, finance and critical infrastructure,
• software-stack transparency for incident response and audit.

The package explicitly links these goals to existing cyber regimes — including the Cyber Resilience Act, NIS2 and the ICT Supply Chain Security Toolbox.

Chips Act 2.0 and industry

Europe today produces only a small share of advanced semiconductors globally. For industrial firms, Chips Act 2.0 long term means:

• more predictable supply for controllers, network ASICs and edge AI,
• stronger R&D and manufacturing initiatives in the Union,
• tighter mesh with cloud/AI investment (CADA).

Short term, supply-chain risk management remains mandatory — see OT security landscape and industrial CRA/NIS2 readiness.

Cloud, AI and CADA

CADA targets much higher EU datacentre capacity and a single market for cloud and AI services. Central is a sovereignty framework with tiered assurance levels — relevant for:

• critical operators with data and workload residency requirements,
• regulated sectors (finance: alongside DORA),
• authorities and research bodies.

Enterprises should design cloud architectures for portability and exit strategies — sovereignty is not a label but substitutability under audit.

Open source as strategy

The EU Open Source Strategy goes beyond “free software.” Core points:

• open source in cybersecurity, digital identity (EUDI) and critical stacks,
• open-source-first in public cloud/AI procurement (CADA link),
• public money, public code for developed or procured authority software,
• skills, start-ups and catalogues (EU OSS Catalogue) for reuse.

Private firms gain opportunities (vendor for sovereign stacks) and duties (integrating open-source components in CRA SBOM logic — CRA guidelines).

Cybersecurity in the sovereignty package

Cybersecurity is cross-cutting — not a fourth pillar, but embedded in all:

• secure chips and supply chains,
• sovereign cloud for incident response and SOC data,
• auditable open-source components,
• resilient energy sector as attack target.

Parallel programmes such as the EU Action Plan on Cybersecurity and AI (July 2026) — see our action plan article. Sovereignty without security operability remains theory.

Recommendations for enterprises

1. Update dependency registers: chips, cloud, AI models, critical SaaS.
2. Procurement: unify sovereignty and CRA/NIS2 clauses — not conflicting spreadsheets.
3. Architecture: multi-provider and open-source options where exit costs today are prohibitive.
4. People: bind cloud security, open-source engineering and compliance engineering early.

Legislative outlook

Legislative proposals (Chips Act 2.0, CADA) pass through Parliament and Council — final adoption is targeted for 2027. Plan on direction of travel, not final wording — as with CRA 2024–2026.

Conclusion

The EU Tech Sovereignty Package makes digital sovereignty the industrial and security-policy default — from chips through cloud and open source to cybersecurity and energy. Meshing procurement, architecture and compliance today prepares for sovereignty tiers, open-source buying and more resilient supply chains — waiting optimises for obsolete dependency logic.

Further reading: EU AI Act overview, Cybersecurity board governance. Hiring: IT recruitment.