Europe Wants Guarantees, Not Promises, From US Tech Firms

Brussels now scores cloud providers against 48 sovereignty criteria, and American tech companies are discovering that capability alone no longer wins European trust. A commentary by Edelman's Margot Edelman, Global Tech Practice Lead, and Camilo Lascano Tribin, Senior Director of Tech Advisory, published on Fortune.com on October 23, 2026, argues that Europe is converting vague worries about dependence on US technology into measurable requirements — with commercial consequences for American providers.

"We want to be sure nobody has a kill switch." That was European Commission Executive Vice-President Henna Virkkunen's warning in June, when the Commission unveiled its latest technology sovereignty proposals. Behind the quote sits a concrete question for European businesses: what happens if access to American technology running critical operations is disrupted by decisions made outside Europe?

What does the new framework actually require?

The Commission's Cloud Sovereignty Framework assesses providers against 48 criteria covering legal control, data, operations and supply chains. It was built for public procurement, but the Commission encourages private organisations to apply it too.

The proposed Cloud and AI Development Act would extend sovereignty assessments across all public-sector cloud services, with stricter requirements for more sensitive uses. Virkkunen has acknowledged that some of the highest levels would be difficult for American providers to reach because of US legal obligations.

How did US technology qualify anyway?

In April 2026, a European consortium led by Belgian telecommunications company Proximus won one of four contracts worth up to €180 million combined under the Commission's sovereign cloud procurement programme. The consortium uses services from S3NS, a French company controlled by Thales that operates Google Cloud technology.

So American technology qualified for the Commission's own sovereign cloud requirements — through a European operating structure. The three providers built on European technology still received a higher sovereignty rating. The authors read that split as evidence of both the opportunity for US firms and the limits imposed by remaining dependencies.

What happens when commitments get tested?

Microsoft offers the clearest case. In April 2025, Brad Smith announced that Microsoft would challenge any government order to suspend its European cloud operations through available legal avenues, including the courts. The company then made that commitment legally binding in contracts with European national governments and the Commission.

Smith also spelled out the fallback: continuity arrangements with European partners and backup copies of Microsoft's code held in Switzerland. The commitment doesn't eliminate every possible disruption, the authors note, but it gives customers a clearer account of what Microsoft has undertaken to do and where the limits remain.

Does local presence matter?

The Commission's framework measures how much investment, jobs and value creation stay within the EU and European Economic Area. Public trust points the same direction. Edelman's 2026 Trust Barometer found people trusted companies headquartered in their own country more than foreign-headquartered companies in every market examined. In Germany, 63 percent trusted German-headquartered companies versus 34 percent for those headquartered abroad.

Asked how a company from a distrusted country could earn trust locally, respondents globally most frequently named long-term community investment and local hiring. The Barometer calls this a "polynational" approach — long-term commitments to the communities where companies operate.

What is sovereignty-washing?

As sovereignty becomes measurable, claims about European control get easier to challenge. Procurement teams can assess them against published criteria. Journalists and competitors can examine the dependencies behind them. Companies describing their services as sovereign without being clear about those dependencies, the authors warn, risk accusations of sovereignty-washing.

That puts communications inside the business decision, not after it. The credibility of a company's European commitments depends on the operating arrangements and protections behind them, and communications leaders can bring customer concerns and public trust into the discussion before commitments are made.

American technology companies have proven what their products can deliver. Europe's changing expectations mean they now need to demonstrate what they can guarantee when circumstances change — and their reputation will increasingly depend on how well the underlying business decisions support those guarantees.