The EU’s tech sovereignty agenda will continue to target US cloud dominance more than Chinese tech dependency. Procurement rules and cloud regulation will increasingly favour European providers – raising strategic risks for US hyperscalers. Calls for AI sovereignty will grow louder but are unlikely to translate into immediate policy changes. In the meantime, Europe’s reliance on US AI chips will increase.
As Europe doubles down on sovereignty, the UK is zooming in on partnerships with US tech – particularly in cloud and AI. This policy divergence will accelerate but is unlikely to jeopardise EU-UK trade relations.
The EU AI Act will hit data-heavy sectors the most, while the UK’s AI Bill – now back on the table – risks ballooning under political pressure. Yet market appetite for AI assurance is emerging as a more powerful force than legislation.
Despite ongoing transatlantic tensions with the US, neither the UK nor the EU are planning to yield on digital services taxes. While we do not expect new digital levies, DSTs will remain a flashpoint in US-Europe tech trade.
Impact of trade disputes with the US
The EU and UK technology policy agendas have been heavily shaped by trade tensions with the US.
The UK has delayed its AI Bill for as long as possible and rebranded the AI Security Institute in a bid to align more closely with Trump’s deregulatory agenda. However, the AI Bill is now back on the table, with a public consultation expected before the end of the year.
Peter Mandelson’s proposal for a strategic technology partnership with the US remains, in our view, largely aspirational – along with the idea of a comprehensive digital trade agreement.
Digital services taxes (DSTs) in both the UK and EU have not been surrendered as part of broader trade talks, contrary to earlier expectations. The US failed to apply sustained pressure, and the UK deemed withdrawal of its DST politically untenable. In the EU, the Commission lacks a negotiating mandate on DSTs, and member states remain firmly opposed to concessions, given their popularity at home – despite the limited revenue generated.
We anticipate this geopolitical dynamic will persist: Trump will continue to pressure Europe to concede the DSTs, but both the UK and EU member states will resist for as long as possible. No new national or EU-wide digital levies will be adopted (e.g. Germany will not introduce a new national tax on US tech firms), nor will existing rates be raised. The only likely deviation from this baseline would be if EU-US trade relations deteriorate and the Commission includes digital taxes in a retaliatory package targeting services.
The UK is technically due to review its DST in by the Autumn Budget but retains enough flexibility to defer the issue.
On digital enforcement, the EU will continue to uphold the DSA, DMA, and AI Act, while the UK remains committed to the Online Safety Act implementation. This remains our baseline view and has proven accurate to date, despite appearing counter-consensus at various points this year.
Enforcement of the UK’s digital markets regime by the CMA, on the contrary, remains patchy. The decision on the cloud market investigation is still pending, and the newly proposed remedies in the mobile market are the least interventionist possible – to the frustration of consumer groups and challenger players.
Technology sovereignty agenda
In December, we predicted that the EU’s regulatory position would become ‘less protectionist against the US and more focused on de-risking from China,’ with a strong emphasis on promoting ‘Europe-made’ technologies in public sector.
We caveated this with a warning about volatility under Trump’s trade agenda. Since then the EU’s technology sovereignty mandate has pivoted sharply towards de-risking from US tech – particularly in cloud infrastructure.
De-risking from China has dropped in priority, largely because the Commission is reluctant to open two simultaneous fronts – against both the US and China. Furthermore, the US has not pressured allies enough to pursue a ‘Huawei 2.0’ strategy.
This trend will likely continue, with the exceptions shaped by trade politics. The EU has committed to purchasing more US AI chips – part of a deal with Washington and a necessity for its AI Gigafactories ambition. This commitment is tied to reducing tech procurement from China. Consequently, Europe’s dependency on US technology will increase.
Public procurement will continue shifting towards European suppliers, consistent with our earlier forecasts.
On the policy front, the EU technology sovereignty objectives would be imprinted in several legislative instruments:
- CAIDA and EU Cloud Procurement Policy: likely to mandate that certain public sector cloud use cases operate on ‘European sovereign cloud’, with effective control mechanisms defined within the EU. This will not be a copy-paste of the EUCS, though the Commission is still working through viable legal drafting
- Cybersecurity Act (CSA): expected to include provisions targeting both US and Chinese technologies – covering software (including in connected vehicles), telecoms, 5G equipment, and potentially AI across ICT supply chains
- EU Procurement Rules: likely to prioritise European vendors or exclude non-EU suppliers on national security or industrial policy grounds (across all sectors and tech stacks)
- Digital Networks Act (DNA): may make elements of the 5G toolbox mandatory
- EUCS: unlikely to be adopted in its current form, and the Commission lacks confidence in its passage without a sovereignty annex. It continues to be stalled.
In contrast, the UK is doubling down on partnerships with the US tech industry, particularly in cloud and AI.
There will be no dedicated legislation to this effect, though the forthcoming UK Cyber Bill – expected any day now – will capture all infrastructure and cloud providers in scope.
The UK will also release a new national Cloud Strategy and revise its ‘Cloud First’ policy, both aimed at increasing US hyperscalers’ access to public sector.
Meanwhile, the UK has quietly shelved its China audit and continues to pursue closer ties with Beijing.
Investment screening
The UK plans to simplify national security investment reviews under the NSIA. Proposed reforms will aim to reduce regulatory burdens by exempting low-risk transactions – such as internal restructures or insolvency appointments – from mandatory notification. While NSIA was originally intended to reduce exposure to China, it has not fulfilled that function in practice. The simplification will likely be welcomed by investors.
The EU aims to complete its FDI screening review by year-end. We expect the regime to retain broad scope, with some efficiency gains from a more centralised process across member states. However, investments involving any level of state ownership – regardless of country of origin – are likely to face extended scrutiny.
AI Sovereignty
Calls for AI sovereignty will grow louder but remain conceptually contained to cloud dependencies.
We do not expect any dedicated legislation on AI sovereignty in the near term with the EU largely accepting that viable alternatives to US LLMs and AI chips are limited. Some elements of AI sovereignty could be nonetheless addressed over the next 6-18 months through CAIDA, public procurement rules, CSA as well as the implementation of the AI Act.
In the UK, AI sovereignty is interpreted mainly as increasing domestic AI data centre capacity. This infrastructure may not be under UK control but will be positioned as critical for training ‘nationally significant’ models – yet to be defined.
AI Regulation
Implementation of the EU AI Act is under way but facing significant friction. It will pose a substantial challenge for data-intensive industries – finance, automotive, manufacturing, and life sciences among others – with practical compliance details largely left to national enforcers. In financial services interpretation by NCAs will be especially patchy.
Industries are lobbying for delayed implementation of high-risk provisions. The AI Office is keen to stick to the current timetable, but timelines may slip if harmonised standards remain delayed or unworkable.
In the UK, the AI Bill risks becoming a bit of a ‘Christmas tree.’ While DSIT seeks to limit its scope to high-risk frontier models testing, and copyright, mounting political and opposition pressure is forcing broader considerations – covering child safety, deepfakes, disinformation, privacy, automated decision-making, political campaigning, and workplace AI at a minimum.
The UK will also aim to align with US policy priorities, though these remain unclear. Trump’s new AI action plan opposes ‘onerous regulation,’ calls for rolling back Biden-era policies, and prioritises rapid AI commercialisation. However, it also targets so-called ‘woke AI,’ which may translate into efforts to curb perceived political bias in model outputs.
Neither the UK nor the EU is expected to introduce sector-specific AI regulation for finance. Instead, enforcement will focus on systemic AI risks under DORA in the EU and the UK’s CTP Regime but not until 2026 at the soonest.
Ultimately, we believe that it is not regulation, but growing investor demand for AI governance and assurance, that will drive real change in AI safety.
Energy
Debates around AI energy efficiency have grown in both the UK and EU but have delivered fewer concrete outcomes than we anticipated. The UK’s AI Energy Council is sitting but has produced no significant policy developments to date.
The European Commission has confirmed – consistent with our outlook – that sustainability and energy efficiency requirements will be key criteria for CAIDA and for the selection of AI Gigafactory projects.
CAIDA rules are likely to align with requirements under the Energy Efficiency Directive and subsequent sustainability schemes, though nothing has yet been formalised.
Automotive industry is gearing up for a particularly busy digital agenda
Under the EU AI Act in-vehicle AI systems that impact safety will likely be considered as ‘high-risk,’ triggering requirements such as CE marking and conformity assessments. Industry players are pushing back, citing overlaps with existing sectoral rules.
Meanwhile, the forthcoming EU Data Strategy and potential review of the Data Act could reopen the debate on mandatory in-vehicle data access regulation.
Cybersecurity rules will also tighten for the industry as the EU is reconsidering risk assessment and incident reporting requirements for connected vehicles under NIS2, and the Cyber Resilience Act – effective from December 2027 – will regulate in-vehicle software and IoT. NIS2, the CRA, and the CSA could all serve as regulatory instruments to restrict Chinese software from vehicles, but a political decision on this has not yet been made.
On autonomous driving, the EU will launch regulatory sandboxes and harmonised testing by 2026. Legislation will begin with parking systems in 2025.
In the UK, the Government is consulting on three pieces of secondary rules under the Automated Vehicles Act including forthcoming legislation for automated passenger services, safety principles and marketing terms.
EU digital simplification is becoming complex
Despite intentions to streamline digital rules, the Commission continues to struggle with the design of the Digital Omnibus and related simplification efforts (e.g. Data Union Strategy, DNA, Digital Fitness Check). Cybersecurity remains a top priority, with the CRA, NIS2, and DORA taking centre stage.
Efforts to align definitions, streamline reporting obligations, and unify processes are under way. The Commission is also discussing a unified reporting mechanism for NIS and GDPR.
The GDPR review will remain contentious. DG JUST favours limiting changes to easing burdens on SMEs and midcaps, while stakeholders demand broader reform to address overlaps with the AI Act, Data Act, and ePrivacy rules. Cross-sectoral interoperability (e.g. between transport or health regulations and digital rules) remains unlikely.
The Data Act will likely be folded into the digital simplification process – either via the Omnibus or Data Union Strategy.
The Digital Fairness Act is at risk of becoming another ‘Christmas tree,’ potentially expanding into general software regulation beyond online platforms.
The Digital Networks Act will seek to review the EECC, level the playing field between telecoms and a subset of cloud services, introduce a high-level arbitration mechanism for network fee-sharing, enforce spectrum reforms, and potentially impose sovereignty restrictions on Chinese 5G equipment.
Finally, the new Innovation Act, the ‘28th Regime,’ and the EU Startup and Scaleup Strategy will aim to streamline regulatory compliance obligations for smaller innovative companies and boost their access to finance, particularly early-stage venture capital.
Key dates in the autumn
UK
- Cyber Bill proposal September (could slip into October)
- AI Bill (including copyright rules revision) consultation Q4
EU
- CSA review proposal September
- Business wallets proposal October/November
- Digital Omnibus November
- Data Union Strategy, Apply AI October
- Revision of the Public Procurement Directive Q3
- DNA November/December
- CAIDA December Q1 2026 (most likely)
- Innovation Act and 28th Regime Q1 2026
Conclusion
H2 is shaping up to be a packed policy agenda for tech and digital.
After the summer break, join us for an online briefing to unpack what’s ahead and dive deeper. Register here.
Our clients receive this type of analysis alongside bespoke insight and advisory services. Find out more about our Emerging Technology service and how it can support your strategy here.
