Europe takes aim at hyperscaler lock-in

The European Commission's Cloud and AI Development Act is a deliberate attempt to rebalance a market dominated by a small number of foreign hyperscalers. Part of a wider technological sovereignty package, it targets the deep dependence that has quietly made a handful of companies the default infrastructure of European digital life, from government services to startups to critical industry.

The underlying concern is concentration and the vulnerability it creates. When the overwhelming majority of a continent's data and computing runs on platforms owned and controlled by a few companies headquartered elsewhere, both healthy competition and genuine strategic autonomy suffer. The Act aims to loosen that grip without dismantling the services that businesses have come to rely on.

Switching providers should be a business decision, not a multi-year engineering ordeal that traps customers.

Portability and competition

Much of the legislation focuses, sensibly, on making it easier to move between providers — the portability of data and workloads, interoperability standards, and limits on the practices that lock customers in and make leaving prohibitively painful. The goal is a market where switching providers is a feasible business decision rather than a costly, multi-year engineering ordeal that effectively traps customers.

Lock-in has long been the hyperscalers' quiet and highly effective moat: proprietary services that have no equivalent elsewhere, and steep data-egress fees that punish any attempt to leave. By directly attacking those frictions, the Act seeks to restore the bargaining power that years of concentration have steadily eroded, giving customers a credible threat to take their business elsewhere.

The architecture consequences

For the engineers and teams who actually build software, the practical effect will be felt most acutely in everyday design choices. Compliance pressures and new portability expectations will push teams toward more provider-agnostic architectures, forcing them to weigh the genuine convenience of deep platform integration against the strategic value of remaining able to move. That trade-off will become a standing consideration rather than an afterthought.

And it is a real trade-off, not a free win. The richest, most productive cloud features often come precisely from the deep platform integration that the Act discourages, so engineers will increasingly have to balance raw capability and speed of development against the flexibility and independence that regulators now favour. There is no architecture that maximises both at once.

An open question

Whether the legislation meaningfully shifts the market in practice, or simply layers on compliance overhead that the incumbents can absorb more easily than challengers, remains genuinely uncertain. Regulation can reshape incentives at the margin, but dislodging deeply entrenched platforms is extraordinarily hard, and the hyperscalers are formidable, well-resourced and adept at adapting to new rules.

What is already clear, regardless of the eventual outcome, is that cloud strategy in Europe now carries an unavoidable political dimension. The choices companies make about where their software runs and whose infrastructure they depend on are no longer purely technical or economic decisions made in isolation from policy.