Your Cloud Dependency Is Now a Regulated Risk. Most Companies Cannot Even See Theirs.

What actually changed?

For years the cloud question was practical: which provider, at what price. The 2026 European Technological Sovereignty Package, and the Cloud and AI Development Act within it, changes the question. It introduces a four-tier sovereignty framework that grades how independent your infrastructure is from any single foreign provider. Where your systems run, and who ultimately controls them, is now a regulated matter, not just an architecture choice.

It does not arrive alone. It lands on top of DORA, NIS2, the Data Act, and the AI Act, each with its own obligations around continuity, security, and accountability. For a company operating in Europe, the result is a compliance environment where concentration on one hyperscaler is no longer just convenient. It is a documented exposure.

Why can most companies not see their own exposure?

Because the dependency is buried. Few organizations depend on a single cloud in a way they can see on one page. The real dependence runs through managed services, compliance tooling, the AI systems they have adopted, analytics platforms, identity infrastructure, and development pipelines, many of which quietly resolve back to the same one or two providers.

So when a board asks whether the company could keep running if its main provider failed or was ruled non-compliant, the honest answer is usually that no one has mapped it. That is the gap the new rules are about to expose, and the one DORA already requires regulated firms to close.

What should a serious company do now?

Map the dependency chain before a regulator or an outage maps it for you. Identify which critical functions resolve to a single provider, where you have no tested failover, and where a sovereignty tier would put you offside. This is not a call to abandon the hyperscalers. It is a call to know exactly what you would do without them, and to be able to show it.

Resilience has always been about the dependency you cannot replace. The new rules simply make that dependency something you now have to see, document, and defend. The companies that map it early will treat the deadlines as routine. The ones that wait will discover the shape of their dependence at the worst possible moment.

Read next: Why Is AI Raising the Price of Hardware You Never Bought?  ·  Why Is AI's Biggest Cost Now a Monthly Rent Bill?