Can Lower Lock-In Strengthen European Providers?
Most of the Data Act has applied since 12 September 2025 (Bräutigam, 2026; McCann FitzGerald, 2026), and commentary since then has focused on compliance: what companies must do to meet their obligations. Sovereignty has received far less attention, and compliance alone cannot deliver it. Sovereignty cannot be guaranteed while companies from other regions dominate the market. In the cloud market, three US hyperscalers (Amazon, Google and Microsoft) account for roughly 70% of Europe’s market, while European providers hold about 15% (Synergy Research Group, 2025). A common assumption is that reducing the cost of leaving a dominant provider will shift demand toward European alternatives. This article argues that lower switching costs can benefit European providers only when competitive services, effective procurement and enforcement support migration. It reviews the relevant provisions, their market effects and limitations, and proposes two recommendations.
Sovereignty is discussed at two levels. At the company level, it means control over a company’s own data and suppliers, as the Act is primarily framed (Straub, 2025). At the Union level, it means achieving independence in the digital domain while remaining open to global networks, a distinction the Joint Research Centre draws from protectionism (Di Marco et al., 2025). Lower switching costs benefit customers in general, but they do not decide which providers gain. That depends on service range, price, and procurement practices, none of which the Data Act regulates. This article treats European providers as those headquartered in Europe, since the market data does not define the term, while recognising that ownership and legal jurisdiction also shape exposure to non-EU law (see the Safeguards section below).
Legal framework
The Act contains two regimes; the first covers data generated by connected products (Regulation (EU) 2023/2854, 2023, Chap. II). Users may access that data and have it transferred to a third party of their choice (European Commission, 2025; Regulation (EU) 2023/2854, 2023, Arts. 4-5). Since 12 September 2026, Article 3(1) requires products placed on the market after that date to make their data accessible by default. The duty is prospective and does not cover products already on the market (Bräutigam, 2026; McCann FitzGerald, 2026).
The second covers cloud and other data processing services. Customers may switch providers after a notice period of no more than two months and a mandatory transitional period of at most 30 calendar days (Regulation (EU) 2023/2854, 2023, Art. 25). Switching charges are limited to costs until 12 January 2027, after which no charges, including egress fees, may be imposed (European Commission, 2025; Regulation (EU) 2023/2854, 2023, Art. 29). National authorities handle enforcement; Germany’s implementing law (DADG), in force since 30 May 2026, designates the Bundesnetzagentur, the “Federal Network Agency” as the competent authority (Haufe Online Redaktion, 2026). Fine ceilings are tiered (DADG, 2026, § 15): EUR 5 million (or 2% of turnover for large undertakings) for the gatekeeper-related conduct prohibited by Article 5(3); EUR 500,000 for core data access and design duties; and EUR 50,000 to EUR 100,000 for several of the cloud-switching duties.
Mechanisms
Product data and the exclusion of gatekeepers
The provision most directly relevant to sovereignty is Article 5(3). It excludes undertakings designated as gatekeepers under the Digital Markets Act from eligibility as third parties and bars them from receiving data obtained through a user’s request (Regulation (EU) 2023/2854, 2023, Art. 5(3)). Recital 40 justifies the exclusion by gatekeepers’ unrivalled ability to acquire data and the risk of reducing the Regulation’s benefits for smaller firms (Regulation (EU) 2023/2854, 2023, recital 40).
Three limits qualify its effect: First, the design duty applies only to newly marketed products, so benefits accrue as product cycles turn over, which, for vehicles and industrial equipment, can take years (McCann FitzGerald, 2026). Second, manufacturers may rely on exceptions linked to cost, intellectual property, security and trade secrets, although refusing access on trade-secret grounds requires a detailed, case-specific written justification and is likely to be difficult in practice (Straub, 2025). Third, the exclusion removes only designated gatekeepers; data may still flow to any other third party, including firms outside the Union, so the rule does not, by itself, favour European providers.
Cloud switching and market response
The cloud rules directly address lock-in, and Straub (2025) sees them as strengthening sovereignty at the company level, since firms can choose providers based on their needs rather than existing infrastructure. However, switching rights do not create the capacity for customers to move. The Commission’s Cloud and AI Development Act proposal, published in June 2026, is intended to complement the Data Act and reportedly aims to triple the EU’s data-centre capacity within five to seven years (European Commission, 2026a; Marcelin, 2025). Providers have already responded. In January 2024, Google announced that customers leaving Google Cloud could transfer their data free of charge (Zavery, 2024). AWS followed in March 2024, saying its waiver aligned with the direction set by the Data Act (Stormacq, 2024). In September 2025, Google began offering free transfers to EU and UK customers running workloads across providers in parallel (Manfra, 2025), while Microsoft offers transfers at cost under similar circumstances (Microsoft, 2026).
These measures reduce both the cost of using multiple providers at once and the cost of switching providers. Customers may add a European provider as a second cloud to spread risk, benefiting European firms. Or they may combine hyperscalers and remain dependent on them. Which outcome prevails will depend largely on whether European providers can match the advanced services customers rely on, an issue the Data Act does not address. Contributors to a 2026 workshop made a similar point: European alternatives must match the user experience of incumbent platforms and cannot rely on values alone (Jahanbozorgi & Maxhuni, 2026).
Safeguard against third-country government access
Article 32 requires data processing service providers to implement adequate technical, organisational and legal measures to prevent unlawful access by third-country governments to non-personal data held in the Union. It recognises third-country decisions only where they are based on an international agreement or meet specified procedural safeguards (Regulation (EU) 2023/2854, 2023, Art. 32). Article 32 addresses only part of the exposure created by laws such as the US CLOUD Act, which requires US providers to disclose data in their possession or control regardless of where it is stored (Clarifying Lawful Overseas Use of Data Act, 2018, § 2713). Personal data remains subject to the GDPR, and the provision regulates provider conduct without changing ownership of the provider.
Limitations
The Data Act’s impact on European providers is limited by three constraints. The most basic is the limited availability of alternatives for specific workloads: the right to switch matters only if a European provider can deliver the necessary capacity and service quality, and the Data Act addresses neither. For example, EU-based secure cloud and AI computing services are lacking for highly critical use cases (Marcelin, 2025). Enforcement adds a further limit. Under German law, penalties for core duties are capped at EUR 500,000, with lower ceilings for cloud-switching breaches (DADG, 2026, § 15). These sums are modest compared with the largest providers’ turnover. Many provisions also depend on technical judgments: whether direct access is feasible, whether a refusal to disclose trade secrets is justified, and whether switching works in practice.
Finally, the rules themselves may change under the Commission’s November 2025 Digital Omnibus proposal to amend the Act. The proposal would amend provisions on trade-secret refusals and cloud switching, and introduce targeted exemptions for smaller operators (Bräutigam, 2026; McCann FitzGerald, 2026). It remains under negotiation, with the Irish Council Presidency aiming to reach agreement by the end of 2026 (McCann FitzGerald, 2026).
Policy recommendation
The constraints above point to two measures: one that creates demand for European providers, since switching rights alone do not, and one that builds the evidence and enforcement capacity needed to judge whether the rules are working.
- Use public procurement to transform switching rights into demand. Public administrations are significant purchasers of cloud services, and tender requirements for tested exit plans, demonstrated interoperability, and sovereignty criteria can help ensure that switching rights lead to practicable migration paths to European providers and not only between hyperscalers. The Commission’s own sovereign cloud tender, worth up to EUR 180 million over six years and awarded to four European providers, shows that such sovereignty criteria can be built into procurement (European Commission, 2026b). Workshop contributors noted that both origin-based and function-based preferences are subject to limits under EU primary law and international agreements (Jahanbozorgi & Maxhuni, 2026), so criteria should be drafted with those limits in view.
- Monitor outcomes and resource enforcement. The Commission and national authorities should record where customers migrate after switching, including the share moving to European providers and the prevalence of multicloud arrangements, and equip regulators with the technical capacity to audit interoperability and exception claims, for example by funding specialist technical staff and shared testing facilities.
Conclusion
Lower lock-in can strengthen European providers, but only under conditions the Data Act does not itself create. The Regulation eases leaving a provider and moving data, yet cheaper switching also makes it easier to combine hyperscalers, and nothing in the Act builds the capacity or services that customers would move to. Whether European providers gain will therefore depend less on the text of the Regulation than on procurement practice, enforcement capacity and their own competitiveness, which is why tracking where customers actually go matters.
References
Bräutigam, T. (2026, March 5). The EU Data Act: Where things stand now. Bird & Bird. https://www.twobirds.com/en/insights/2026/the-eu-data-act-where-things-stand-now
Clarifying Lawful Overseas Use of Data Act, 18 U.S.C. § 2713 (2018). https://www.law.cornell.edu/uscode/text/18/2713
Datenverordnung-Anwendungs- und Durchsetzungsgesetz [Act on the application and enforcement of the Data Regulation] (DADG), 26 May 2026, Bundesgesetzblatt I 2026, Nr. 157. https://www.gesetze-im-internet.de/dadg/BJNR09D0B0026.html
Di Marco, D., Thabit Gonzalez, S., Kotsev, A., Friis-Christensen, A., Minghini, M., & King, M. (2025). Open but not powerless: Towards a common understanding of EU digital sovereignty (JRC144908). European Commission, Joint Research Centre. https://publications.jrc.ec.europa.eu/repository/handle/JRC144908
European Commission. (2025, December 15). Data Act explained. Shaping Europe’s Digital Future. https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained
European Commission. (2026a, April 17). Commission awards €180 million tender for sovereign cloud to four European providers [Press release]. https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833
European Commission. (2026b, June 3). Proposal for a Cloud and AI Development Act (CADA). Shaping Europe’s Digital Future. https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
Haufe Online Redaktion. (2026, June 11). Durchführungsgesetz zum Data Act verabschiedet und verkündet [Implementing act for the Data Act passed and promulgated]. Haufe. https://www.haufe.de/recht/durchfuehrungsgesetz-data-act-verabschiedet-und-verkuendet_226_688644.html
Jahanbozorgi, O., & Maxhuni, A. (2026, April 29). EU law for EU digital sovereignty: Workshop report, University of Antwerp, 20 March 2026. CELIS Institute. https://celis.institute/eu-law-for-eu-digital-sovereignty-workshop-report-university-of-antwerp-20-march-2026/
Manfra, J. (2025, September 10). Introducing no-cost, multicloud Data Transfer Essentials for EU and U.K. customers. Google Cloud Blog. https://cloud.google.com/blog/products/networking/new-for-the-uk-and-eu-no-cost-multicloud-data-transfer-essentials
Marcelin, T. (2025, December). Cloud and AI development act (PE 779.251). European Parliamentary Research Service. https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)779251_EN.pdf
McCann FitzGerald. (2026, September 10). Data Act developments: 2026 and beyond. https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/data-act-developments-2026-and-beyond
Microsoft. (2026, May 5). Data transfer fees. Microsoft Learn. https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/data-transfer-fees
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act), 2023 O.J. (L 2023/2854). https://eur-lex.europa.eu/eli/reg/2023/2854/oj
Stormacq, S. (2024, March 5). Free data transfer out to internet when moving out of AWS. AWS News Blog. https://aws.amazon.com/blogs/aws/free-data-transfer-out-to-internet-when-moving-out-of-aws/
Straub, S. (2025). The European Data Act and its impact on corporate digital sovereignty. In U. Schmuntzsch, A. Shajek, & E. A. Hartmann (Eds.), New digital work II: Digital sovereignty of companies and organizations (pp. 57–73). Springer. https://doi.org/10.1007/978-3-031-69994-8_4
Synergy Research Group. (2025, July 24). European cloud providers’ local market share now holds steady at 15%. https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15
Zavery, A. (2024, January 11). Cloud switching just got easier: Removing data transfer fees when moving off Google Cloud. Google Cloud Blog. https://cloud.google.com/blog/products/networking/eliminating-data-transfer-fees-when-migrating-off-google-cloud
