EU plans to exclude non-EU cloud vendors criticised by lobby group

A big tech-backed report has criticised a proposed European Union cloud security label that could exclude non-EU service providers from the bloc.

EU cybersecurity agency ENISA's certification scheme (EUCS) recently introduced a provision that requires service providers to have their registered head office and global headquarters in the EU. Cloud service providers would also be required to store and process customer data from one of the 27 EU member states.

In light of this provision, the European Centre for International Political Economy (ECIPE) has published a critical report commissioned by the Computer and Communications Industry Association (CCIA) – a lobbying group which includes members such as Amazon, Apple, Google, Meta, BT and Red Hat.

The report, titled ‘Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements’ calls on ENISA and the European Commission to abandon immunity requirements in the proposed EU Cloud Certification Scheme (EUCS).

In a summary note, report author Matthias Bauer, a German economist and director at the ECIPE, said: “With immunity requirements in the EUCS, the EU risks opening a Pandora’s box, paving the way for data localisation, foreign ownership restrictions, and local establishment requirements in digital industries globally leading to rising trade tensions.

Bauer also argues that the immunity requirements would increase cloud adopters' exposure to cybersecurity risks, and that "excluding these and other EU and non-EU companies from EU Member States could result in a long-lasting security deficit of EU cloud adopters vis-à-vis organisations that are still able to use reliable and often best-practice cloud services offered by providers from outside EU Member States."

The organisation also warned that the proposal could set a dangerous precedent, and potentially trigger retaliatory measures from EU trading partners.

In comments to Reuters, a spokesperson for ENISA said that it is waiting for an opinion from EU countries and that it "will then finalise the scheme by taking into utmost account this opinion and submit the final candidate scheme to the European Commission".

    Share Story:

Recent Stories


The future-ready CFO: Driving strategic growth and innovation
This National Technology News webinar sponsored by Sage will explore how CFOs can leverage their unique blend of financial acumen, technological savvy, and strategic mindset to foster cross-functional collaboration and shape overall company direction. Attendees will gain insights into breaking down operational silos, aligning goals across departments like IT, operations, HR, and marketing, and utilising technology to enable real-time data sharing and visibility.

The corporate roadmap to payment excellence: Keeping pace with emerging trends to maximise growth opportunities
In today's rapidly evolving finance and accounting landscape, one of the biggest challenges organisations face is attracting and retaining top talent. As automation and AI revolutionise the profession, finance teams require new skillsets centred on analysis, collaboration, and strategic thinking to drive sustainable competitive advantage.