EU drops sovereignty requirements in cybersecurity certification scheme, document shows

Reuters

Published Apr 03, 2024 02:25PM ET

Updated Apr 03, 2024 05:16PM ET

By Foo Yun Chee

BRUSSELS (Reuters) - Amazon (NASDAQ:AMZN), Alphabet (NASDAQ:GOOGL)'s Google and Microsoft (NASDAQ:MSFT) may find it easier to bid for EU cloud computing contracts after draft cybersecurity labelling rules scrapped a requirement that vendors should be independent from non-EU laws, according to the document seen by Reuters.

The European Union has struggled to agree to a cybersecurity certification scheme (EUCS) to vouch for the cybersecurity of cloud services and help governments and companies in the bloc to select a secure and trusted vendor for their business.

The move comes as Big Tech looks to the lucrative government cloud market to spur growth. The EU on the other hand fears illegal state surveillance while some governments worry that the dominance of U.S. cloud providers may inhibit nascent EU rivals.

One draft circulated to EU governments last year required U.S. tech giants to set up a joint venture with an EU-based company and store and process customer data in the bloc to qualify for the EU cybersecurity label.

Such so-called sovereignty requirements sparked criticism from European banks, clearing houses, insurance groups and some startups which said technical provisions rather than political and sovereignty obligations should prevail.