The European Commission is considering new restrictions that could bar U.S. cloud providers from processing sensitive government data, according to sources familiar with the matter who spoke to CNBC. The move targets dominant players Amazon Web Services, Microsoft Azure, and Google Cloud, marking the EU’s most aggressive push yet toward data sovereignty. If implemented, the policy would force member states to shift critical workloads to European cloud infrastructure, reshaping a market where American companies currently hold roughly 70% share.

Brussels is preparing to draw a hard line in the cloud wars. The European Commission is actively exploring restrictions that would prevent U.S. hyperscalers from processing sensitive government data, a dramatic escalation in the region’s years-long battle for digital sovereignty, sources told CNBC on Thursday.

The proposed policy targets the three dominant American cloud providers – Amazon Web Services, Microsoft Azure, and Google Cloud – who collectively control roughly 70% of Europe’s cloud infrastructure market. If enacted, EU member states would be required to migrate critical workloads including citizen data, defense systems, and classified information to European-owned cloud platforms.

The timing couldn’t be more significant. European governments currently rely heavily on U.S. cloud infrastructure for everything from healthcare records to tax systems. Amazon Web Services alone powers dozens of government contracts across the bloc, while Microsoft Azure has become deeply embedded in EU digital transformation initiatives. A forced migration would represent one of the largest enterprise cloud shifts in history.

“There have been increasing calls within Europe for the region’s most critical workloads to diversify away from dominant U.S. cloud providers,” sources close to the discussions confirmed. The sentiment has grown louder following concerns about U.S. data access laws, particularly the CLOUD Act, which can compel American companies to hand over data stored anywhere in the world.

The policy discussions come as Europe attempts to close a widening technology gap. Despite initiatives like Gaia-X – a Franco-German project launched in 2020 to create a federated European cloud infrastructure – the continent has struggled to produce hyperscale competitors. European cloud providers like France’s OVHcloud and Germany’s IONOS combined represent less than 10% market share, lacking the scale and service breadth of their American rivals.

But Brussels appears ready to use regulatory force where market dynamics have failed. The proposed restrictions would effectively create a protected market for European cloud providers to serve government contracts, potentially worth billions annually. Google Cloud, which has invested heavily in European data centers and recently launched dedicated EU-only regions, would see those investments unable to capture the most lucrative public sector workloads.

The cloud giants haven’t commented publicly on the potential restrictions, but the policy represents their worst-case regulatory scenario. Amazon Web Services generated over $90 billion in revenue last year, with Europe accounting for roughly 25% of that total. Government and public sector contracts, while a smaller slice, carry strategic importance and often lead to broader enterprise adoption.

Industry observers expect fierce pushback. U.S. trade representatives have historically opposed digital sovereignty measures as protectionist, arguing they fragment the internet and raise costs for European citizens. The restrictions could also violate World Trade Organization commitments, though EU officials argue national security exemptions apply.

The technical challenges are equally daunting. Many European governments have spent years building infrastructure on Microsoft Azure or AWS, creating deep dependencies on proprietary services. Migrating workloads to smaller European providers with less mature platforms risks service disruptions and security vulnerabilities during the transition period.

European cloud providers are quietly celebrating. OVHcloud shares jumped 8% on the news, while Deutsche Telekom’s cloud division confirmed it’s preparing proposals for government migration services. The companies have long argued they can’t compete on equal footing when procurement decisions favor technical capabilities over data residency requirements.

The policy aligns with broader EU digital strategy. Recent regulations including the Digital Markets Act, AI Act, and Data Act all seek to reduce dependence on American tech platforms while establishing Brussels as the global standard-setter for technology governance. Cloud sovereignty represents the next frontier in that campaign.

Timing remains unclear, but sources indicate the Commission aims to finalize a proposal by Q3 2026, with implementation phased over 18-24 months to allow orderly migrations. Member states would retain some flexibility in defining “sensitive” data, though minimum standards would apply across the bloc.

The restrictions would mark a watershed moment for enterprise cloud computing, potentially inspiring similar policies in other regions concerned about data sovereignty. For the U.S. cloud giants who’ve spent billions building European infrastructure, it’s a stark reminder that technical dominance doesn’t guarantee market access when geopolitics enter the equation.

Brussels is betting that regulatory mandates can accomplish what market forces haven’t – building a viable European cloud ecosystem. For government agencies across the EU, the coming months will bring difficult decisions about balancing data sovereignty ideals against the technical realities of migration. The three U.S. cloud giants face their most serious regulatory threat yet in a region they’ve dominated for over a decade, while European providers get the protected market opportunity they’ve long sought. Whatever emerges from these policy discussions will set the template for cloud sovereignty debates playing out from Canberra to Ottawa, making this far more than a European story.