View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cloud
June 17, 2024

EU urged not to discriminate against Big Tech through new cybersecurity certification scheme

The industry groups signed a joint letter only a day before EU agencies are set to discuss the latest version of a proposed cybersecurity certification scheme.

By Livia Giannotti

Almost 30 European industry groups warned that the EU should not discriminate against major US tech companies in the upcoming European Cybersecurity Certification Scheme on Cloud Services (EUCS).

EU flags flutter outside the European Commission building, in a photo illustrating an article about the EU cybersecurity certification scheme
The new EU certification scheme for cybersecurity will be reviewed this week by the EU. (Photo: symbiot / Shutterstock)

The certification scheme is an initiative by the European Union Agency for Cybersecurity (ENISA) which aims to improve the cloud services’ market conditions within the EU market and to help European companies and governments select a trusted provider. 

The first draft of the scheme was published in 2020 and included propositions “to harmonise the security of cloud services with EU regulations, international standards, industry best practices, as well as with existing certification in EU Member States,” the document read. However, the first draft has been modified more than once in the past four years, and the latest version of the scheme is set to be discussed and reconsidered this week by EU countries, the ENISA and the European Commission.

Prior to this meeting, 26 industry groups from around Europe signed a letter on Monday emphasising the importance of having access to “a diverse range of resilient cloud technologies tailored to their specific needs to thrive in an increasingly competitive global market,” Reuters reported. Signatories include the European Payment Institutions Federation, the German Bundesverband deutscher Banken and the Irish business lobby group IBEC.

The letter to EU countries and legislators says: “We believe that an inclusive and non-discriminatory EUCS that supports the free movement of cloud services in Europe will help our members prosper at home and abroad, contribute to Europe’s digital ambitions, and strengthen its resilience and security.” The letter also added that “the removal of both ownership controls and Protection against Unlawful Access (PUA) / Immunity to Non-EU Law (INL) requirements ensures that cloud security improvements align with industry best practices and non-discriminatory principles.”

Disagreements over stricter requirements for non-EU companies

This warning comes as one of the main amendments made to the latest version – the most controversial one – is the removal of the sovereignty requirements proposed in the initial draft. Under the newest version of the scheme, US tech giants can qualify for the highest assurance level without having to set up a joint venture or cooperate with an EU-based company.

Big tech companies such as Google, Microsoft and Amazon welcomed the scrapping of sovereignty requirements, as it allows them to bid for major EU cloud computing contracts. 

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

However, EU cloud vendors have expressed concerns about this amendment to the scheme and said they favour stricter requirements for non-EU tech companies to qualify for the certification. 

In a joint letter to relevant authorities signed in April 2024, companies including Airbus, Orange and Capgemini argued for the latest version of the scheme – without the sovereignty clauses – to be rejected. Reuters reportedly viewed the letter, which stated: “Incorporating EU headquarters and European control requirements in the main scheme is necessary to reduce the risk of unlawful data access under foreign laws.” The letter also argued that “removing sovereignty requirements from the scheme would significantly undermine the viability of sovereign cloud solutions in Europe, many of which are either in development or already available on the market.”

Read more: Privacy concerns prompt cancellation of Meta AI European launch

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.