Europe has written the world’s most detailed AI rules. It has also arranged to depend on someone else’s computers to run the thing it regulates. The Commission itself puts the EU’s spending on US proprietary IT products and services at €264 billion a year. Rules without capacity are a statement of intent, and the past year shows how quickly an intent can bend.
Table of contents
The cloud under the rulebook
Synergy Research Group reported in July 2025 that European cloud providers held 15 per cent of the European market. Amazon, Microsoft and Google together held 70 per cent. In 2017 the European providers had 29 per cent. They have stayed at about 15 per cent since 2022, even though their revenues more than tripled between 2017 and 2024. The market grew sixfold, to €61 billion, and the growth went elsewhere.
AI runs on that infrastructure. A regulator that writes the rules in Brussels and leaves the hardware to three American companies has an enforcement problem it will not mention in the press release.
How the high-risk AI rules slipped
The AI Act’s strictest requirements cover uses such as biometric identification, hiring, exams, credit scoring, health services and law enforcement. They were due in August 2026. In November 2025 the Commission proposed postponing them, in a package that one report tied to pushback from Big Tech.
Read also: Brussels Pushed Its Hardest AI Rules Back 16 Months
The Parliament adopted the AI Omnibus on 16 June by 423 votes to 57, with 174 abstentions. Support had been far stronger in March, when the negotiating mandate drew 569 votes in favour. Parliament and Council formally approved the final text in July.
The new dates are 2 December 2027 for standalone high-risk systems and 2 August 2028 for AI built into regulated products. A ban on nudifier apps and on systems that generate child sexual abuse material was added, and watermarking duties start on 2 December 2026. Those are real gains.
The postponement of the rest is also real: employers, police forces and banks get another sixteen months before the strictest duties apply to the systems that decide who gets a job, a loan or a flagged file. Brussels calls this simplification.
The part about your data
The same Commission package proposed changes to the GDPR that, according to reporting at the time, would let companies including Google, Meta and OpenAI use Europeans’ personal data to train AI models. That proposal sits in a separate Omnibus that had not yet reached trilogue negotiations in June, and the Council’s compromise of 10 June deleted some of its provisions on cookie consent. It remains a proposal, and it shows the direction.
Read the sequence as a customer would. The suppliers say the rules are too heavy, and the buyer rewrites the rules.
Why rent means leverage
A regulator with domestic alternatives can say no and mean it. A regulator whose economy runs on foreign platforms hears a different question whenever it drafts a rule: what will the supplier say, and what will its government say after that? A rule that might provoke that response is a rule drafted with one eye on the exit.
Read also: Brussels Fined Big Tech 2.46 Billion. Washington Threatens Tariffs
None of this makes regulation pointless. The ban on nudifier apps matters, and the transparency rules matter. Regulation alone, though, cannot deliver the independence Brussels likes to claim for it.
The cure is on paper, and it is capped
On 3 June the Commission published the Cloud and AI Development Act, which does what a serious policy would, and pairs the rules with a buyer. Public authorities would have to consider “Union added value” in cloud and AI tenders, and a sovereignty framework with four assurance levels would govern cloud services sold to the public sector. The highest level bars third-country control altogether.
Then read the weighting. The added-value criterion must be “ancillary and not decisive”, and the draft’s recitals suggest a maximum of 15 out of 120 points. That is 12.5 per cent of a tender score. A supplier that is cheaper and technically strong can lose the European bonus and still win.
The sovereignty framework is likely to be the central battle in the trilogue. If Parliament and Council keep the four levels and lift the cap, Europe will have given its rulebook a customer. If they trim both, Europe stays the world’s most careful tenant.
Opinion pieces on ExtraFokus.eu reflect the views of their authors.
