The Real Map of Europe's Digital Dependence
How deep does Europe's reliance on US technology actually run? Not as a slogan: as a number you can check.
Part of the pillar series Europe's Digital Dependence, Explained.
When people argue about "digital sovereignty," the conversation usually floats somewhere above the evidence. So let's put it back on the ground. The question this piece answers is narrow and testable: how dependent is Europe on US technology, layer by layer, and where does Europe actually hold leverage?
The short version: dependence is real, it is measurable, and it is measured in euros. Around 80% of European corporate spending on software and cloud (roughly €264 billion a year) flows to US vendors. That is about 1.5% of EU GDP, or one and a half times the entire EU budget, leaving the continent every year. (European Parliament, 2025)
But "dependence" is not uniform. Europe is weakest exactly where the future is being built, and strongest in a few deep chokepoints it cannot lose quickly. This is the map.
What "digital sovereignty" actually means
First, a definition, because the word is abused. The EU's own Joint Research Centre defines digital sovereignty as the EU's capacity to exercise independence in the digital realm while remaining open and connected to global networks (JRC Policy Brief JRC146878, May 2026). It is not self-sufficiency or building everything yourself.
That distinction matters for everything below. The goal is not a European wall. It is the ability to decide, operate, switch, and secure critical infrastructure without unacceptable exposure to foreign legal compulsion, single-vendor lock-in, or coercion.
| Term | What it measures |
|---|---|
| Data residency | Where data physically sits (geography) |
| Data sovereignty | Whose laws govern it, and who can compel access (jurisdiction) |
| Self-sufficiency | Building the whole stack yourself (not the goal, and not realistic) |
The rest of this article is about the gap between the first two. And we go deep on it in the companion piece, Sovereignty by Architecture, Not by Promise.
How dependent is Europe, layer by layer
Here is the dependence stack, with a sourced headline metric for each layer.
| Layer | Headline metric | Source |
|---|---|---|
| Public cloud | US "big three" (AWS ~30%, Azure ~25%, Google ~15%) hold ~70% of the EU market | Synergy Research / EP 2025 |
| EU cloud providers | Combined local share fell from 29% (2017) to ~15% (2024) | Synergy Research |
| Enterprise software | ~80% of EU software/cloud spend goes to US vendors | EP 2025 |
| Office suites | Microsoft 365 holds ~90% of the EU office-suite market | EP 2025 |
| Search | Google holds >89% of European search | EP 2025 |
| Desktop OS | Windows runs ~73% of EU desktops | EP 2025 |
| Frontier AI | In 2024, the US produced 40 notable AI models; Europe produced 3 | Stanford HAI 2025 |
| Semiconductors | EU share of the global chip value chain: 9.8% (2022) → forecast 11.7% (2030), vs a 20% target | European Court of Auditors, 2025 |
The cloud layer is the clearest illustration. Three American firms hold roughly seven-tenths of the market: AWS (~30%), Microsoft Azure (~25%), and Google Cloud (~15%), while Europe's largest provider, SAP, holds about 2% (Synergy Research; European Parliament 2025).
And the trend is the uncomfortable part: Europe's cloud adoption is rising fast. 52.7% of EU enterprises used paid cloud services in 2025, up 7.4 points in two years (Eurostat, 2026). But the most common uses are email, office software, and file storage, precisely the categories where US suites dominate. Europe's adoption curve has also been a dependence curve.
AI is the starkest gap of all, and the one that compounds.
| AI metric | Europe | United States |
|---|---|---|
| Notable foundation models (2024) | 3 | 40 |
| Share of global AI compute | ~5% | ~75% |
| Share of global AI venture funding (2025) | ~6% | ~75% |
Sources: Stanford HAI AI Index 2025/26; OECD, 2026.
Where Europe actually holds leverage
Dependence is only half the map. Europe is not a passenger everywhere. In a few places, the world depends on it.
- Lithography. One Dutch company, ASML, builds close to 100% of the world's EUV lithography machines, the tools required to make every advanced chip on Earth. When the US wanted to restrict China's access to advanced chipmaking, it needed Dutch cooperation. That is not dependence; that is leverage. (Yole Group)
- Semiconductor equipment. EMEA vendors held 29% of the global wafer-fabrication equipment market in 2023 (Yole Group; ASML, ASM and ZEISS alongside Israeli suppliers), a genuine value-chain stronghold even though Europe makes few leading-edge chips itself.
- Telecom. Ericsson and Nokia together account for around 43% of the global 5G radio-access market. Two of the top three vendors on Earth are European. (Dell'Oro / Fierce Network)
- Rules. GDPR, the AI Act, and the DMA show the "Brussels effect": Europe sets standards the rest of the world has to follow, even where it doesn't build the technology.
The shape of the asymmetry is the real insight:
Europe is strong in chokepoints and standards, and weak in full-stack platforms and scale. That is why "just build a European Google" misunderstands the problem, and why the realistic goal is selective autonomy, not autarky.
Does an "EU region" fix it?
Here is the trap most organizations fall into. They move to a US hyperscaler's "EU region," check the data-residency box, and assume the sovereignty problem is solved. It is not.
Jurisdiction follows the provider's nationality, not the data's location. Under the US CLOUD Act, a US-headquartered company can be compelled to produce data regardless of where it physically sits. Asked under oath at the French Senate in June 2025 whether he could guarantee French citizens' data would never be handed to US authorities, Microsoft France's director of public and legal affairs answered plainly: "No, I cannot guarantee it." (The Register, 2025)
An EU postcode is residency. It is not sovereignty. We unpack exactly why (and what does close the gap) in Sovereignty by Architecture, Not by Promise.
Why we built Soveryne the way we did
We did not start Soveryne to wave a flag. We started it because the map above describes a practical risk for any European organization that takes security and continuity seriously, and because the pragmatic middle path between "use a US hyperscaler and hope" and "build everything yourself" barely existed.
So we built the Soveryne Cloud Foundation: the EU-sovereign cloud our own security products run on. Data and encryption keys stay inside EU jurisdiction by architecture, not by a foreign provider's promise. Compute and storage stay in the EU regions you choose. AI and LLM inference run on EU-sovereign infrastructure, so you get the intelligence without sending your data to a foreign cloud. Zero US exposure, with an open-source core you can inspect.
On top of it run Counsel, a sovereign AI assistant that answers from your own frameworks and documents and cites every source, and Command, which operates your whole security program. The point of the foundation is simple: your data, your questions, and your controls all stay in jurisdiction by default.
That is what selective autonomy looks like in practice: not isolation, but control where it actually matters.
FAQ
What percentage of the EU cloud market do US companies control? Roughly 70%, split across AWS (~30%), Microsoft Azure (~25%), and Google Cloud (~15%). Europe's largest provider, SAP, holds about 2%. (Synergy Research)
Why is Europe so dependent on US technology? Because the highest-value digital layers (cloud, foundation models, operating systems, productivity) are winner-take-all markets with strong network effects, where the US built scale first. Europe's strengths sit in slower-moving hardware and standards.
Does storing data in an EU data centre protect it from US law? Not by itself. Under the CLOUD Act, a US-headquartered provider can be compelled to produce data regardless of where it is stored. Location is residency; jurisdiction is sovereignty. See our companion piece.
What's the difference between digital sovereignty and data sovereignty? Digital sovereignty is the broad capacity to control your digital infrastructure; data sovereignty specifically concerns whose laws govern your data and who can compel access to it.
Europe's dependence is real and measurable, but so is the path out of it. The next post in this series shows how everyday tools quietly become critical infrastructure. If you'd rather see what sovereign-by-default looks like in practice, explore the Soveryne Cloud Foundation or see our pricing.
Sources
- European Parliament, European Software and Cyber Dependencies (2025): https://www.europarl.europa.eu/RegData/etudes/STUD/2025/778576/ECTI_STU(2025)778576_EN.pdf
- Synergy Research, European cloud provider share (2025): https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15
- European Court of Auditors, The EU's strategy for microchips (SR 12/2025): https://www.eca.europa.eu/ECAPublications/SR-2025-12/SR-2025-12_EN.pdf
- Eurostat, cloud computing use by enterprises (2026): https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20260203-1
- Stanford HAI, AI Index 2025: https://hai.stanford.edu/ai-index/2025-ai-index-report
- OECD, AI venture capital (2026): https://www.oecd.org/en/about/news/announcements/2026/02/ai-firms-capture-61-percent-of-global-venture-capital-in-2025.html
- The Register, Microsoft "cannot guarantee" data sovereignty (2025): https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/458553
- Yole Group, EU semiconductor equipment suppliers: https://www.yolegroup.com/strategy-insights/underappreciated-eu-suppliers-lead-the-semiconductor-equipment-market/
Nobody decides to make a SaaS tool load-bearing for the economy. It just happens, one convenient choice at a time.
Read the next part
An EU data-center region is a postcode. It is not sovereignty. Here's the difference, and the architecture that actually closes the gap.
Read the companion piece
