Leveraging the Interplay of AI Act and DMA for Sovereign EU Defence Applications

Executive summary

This policy brief explores how the EU’s current reliance on cloud and Artificial Intelligence (AI) services provided by Digital Markets Act (DMA) designated gatekeepers creates tactical dependencies. In particular, DMA-driven data silos and gatekeeper architectures risk turning defence datasets into sovereignty chokepoints. In addition, it examines how Article 15 of the EU AI Act, which mandates accuracy, robustness, and cybersecurity for high-risk AI, could serve as a blueprint to harden defence-adjacent systems, despite the Act’s exception for military and national security applications.

Through document analysis of EU regulatory frameworks, public reports of the European Institutions, and other references, this brief identifies critical vulnerability gaps of sovereign AI adoption. 

Recommendations include: (1) Developing European Defence Agency (EDA)-led AI Act-inspired sovereign defence AI framework with cross-border data governance; (2) Establishing a DMA interoperability and specification taskforce that could address defence-relevant gatekeeper lock-ins; (3) mandating NIS2-backed horizontal cybersecurity audits that could target cloud and AI private-sector services supporting defence-critical functions; and (4) strengthening targeted EDIP/AGILE funding and sovereign-cloud pilots to support the EU’s strategic autonomy over sensitive defence-related technological infrastructure.

Introduction

Hybrid campaigns combining cyberattacks, foreign information manipulation and interference, and disruption of critical infrastructure challenges have become focal to EU’s security environment (Council of the EU, 2022; EEAS, 2026). Defence operations across land, sea, air, space, and cyber increasingly rely on cloud technologies and data-intensive services for command-and-control, intelligence, and logistics support (RUSI, 2025). 

In this context, ‘defence-critical digital infrastructure’ increasingly encompasses cloud platforms, AI-enabled decision-support tools and data spaces for defence planning, procurement and operations. Many of these functions run on services provided by designated gatekeepers under the DMA. 

In 2022, AWS, Microsoft Azure, and Google Cloud held about 70% of the EU market (Synergy Research Group, 2022). Contrary, while the overall cloud computing market in the EU has grown significantly in the past decade, the combined share of EU providers remains at approximately 15% (Synergy Research Group, 2025). 

While the DMA primarily targets contestability and fairness in digital markets, rather than sovereignty of defence datasets the EU AI Act’s cybersecurity requirements for high-risk AI systems (Article 15) are not applicable as military, defence or national security purposes are fully exempted under Article 2(3).

Therefore, this brief argues that the potential regulatory asymmetry spawns sovereignty chokepoints. It explores how Article 15 can guide defence AI assurance and how aligning DMA enforcement, NIS2 implementation, and EU defence instruments could mitigate emerging hybrid risks.

EU defence cloud sovereignty chokepoints and ‘hidden’ AI transatlantic dependencies

Defence sector reliance on ‘gatekeeper’ cloud services 

Research from the Future of Technology Institute (FOTI) suggests that European security is deeply intertwined with US tech infrastructure. Accordingly, data demonstrate that 15 EU Member States face high risk of exposure to US legal authority over defence cloud infrastructure through direct contracts with US providers. Seven EU Member States face medium risk through European contractors using US cloud services. Those European providers rely on US infrastructure (e.g., air gapped systems) or systems running on a base of US hyperscale technology.

Table 1: Dependency risk levels on US-based cloud providers of EU Member States. Source: FOTI, 2026 & author’s elaboration.

The leading US-based cloud service contractor for European defence agencies is Microsoft, with systems used by 18 countries, while Google and Oracle hold defence contracts as well. While not explicitly mentioned in FOTI’s assessment, in January 2026, AWS launched its European Sovereign Cloud, with the first region in Germany and planned expansion to Belgium, Netherlands, and Portugal, specifically targeting “EU public sector, defence, and regulated industries” (AWS, 2026).

Table 2: Cloud service providers of European defence agencies. Source: FOTI, 2026 & author’s elaboration.

In terms of sovereign cloud solutions, France selected Thales, Germany contracted Arvato, the Netherlands partnered with KPN and Thales to shift away from US providers, and Austria migrated 16,000 defence workstations away from Microsoft (CEPA, 2025; FOTI, 2026). At EU-level, in April 2026, the European Commission awarded a €180 million sovereign cloud contract to Belgium’s Proximus, which relies on S3NS, a joint venture between Thales and Google Cloud with Google-based underlying technology (European Commission, 2026).

AI services and transatlantic dependency reflections

Artificial Intelligence (AI) is not an exception. NATO’s operational reliance illustrates the governance challenge for EU Member States. In March 2025, NATO awarded Palantir the Maven Smart System contract for ‘intelligence fusion, targeting, and accelerated decision-making’ using large language models (NATO, 2025). US military operations in early 2026 used Anthropic’s Claude, embedded in Maven, for processing intelligence and suggesting target coordinates in real time (Heinrich Böll Foundation, 2026). When Anthropic refused Pentagon demands for ‘any lawful use’, OpenAI replaced it (OpenAI, 2026; Reuters, 2026).

For the 23 EU NATO members, this creates a regulatory paradox: the EU AI Act’s risk-based approach does not govern military AI and the defence-relevant workloads of US-based companies’ AI services (currently out of the DMA’s ‘Gatekeeper’ scope) or their cybersecurity requirements. Hence, AI governance is driven by commercial contracts negotiated by NATO or the Pentagon, outside EU regulatory oversight intensifying potential chokepoints.

DMA data silos as sovereignty chokepoints

DMA governance gaps and hybrid threat amplification

The DMA’s data-access obligations are designed to promote market contestability. Although it opens up gatekeeper‑held data fostering competition, it does not cover core sovereignty questions about location, governance, and control of defence‑relevant datasets. 

Particularly, Article 6 of regulation (EU) 2022/1925 requires gatekeepers to provide business users with ‘free, high-quality, real-time access’ to platform-generated data. However, it applies primarily to business user data, not to operational datasets, AI training corpora, or inference logs generated by defence-related AI workloads running on gatekeepers’ infrastructure. As a result, persistent data silos and vendor lock-in risks remain. For example, when a Member State seeks to migrate sensitive workloads between cloud services, any data‑access or portability pathway is designed and policed by gatekeepers via its own export formats, API limits, and verification processes (Kirkwood, 2024).

In extend, DMA data silos amplify EU defence’s vulnerability to hybrid threats. Adversaries could exploit gatekeeper-controlled datasets for intelligence inference or targeted disruptions (e.g., data poisoning, Distributed Denial-of-Service (DDoS) attacks, prompt injection, etc.) of critical AI workloads. Without sovereign portability standards, a single provider likely compromises risks of cascading failures across the EU Member States’ defence ecosystems, undermining operational resilience and strategic autonomy. 

AI Act cybersecurity requirements’ legal viability

Article 15 of the EU AI Act mandates AI-system-specific cybersecurity for high-risk AI, requiring resilience against adversarial attacks, data/model poisoning, and confidentiality breaches through lifecycle risk management, adversarial testing, and continuous monitoring (Article 15 of Regulation (EU) 2024/1689). Yet the exemption for military, defence or national security purposes (Article 2(3) of Regulation (EU) 2024/1689) leaves a regulatory gap.

By contrast, NIS2 focuses on network and information systems, not AI-specific threats. It introduces organisational cybersecurity requirements for essential entities, mandating supply-chain risk management, incident reporting within 24 hours, and resilience for digital infrastructure (Directive (EU) 2022/2555). 

Consequently, Article 15 complements NIS2 by addressing AI risks, creating a layered approach that needs to be refined by the defence sector specificities shaped by national security imperatives, geopolitical considerations, and the complexities of modern warfare under a distinct mechanism. A summary of potential mechanisms is shown below.

Table 3: Potential mechanism examples of AI cybersecurity and sovereignty requirements for defence and military applications (non-exhaustive list). Source: Author’s own elaboration.

Policy recommendations 

To mitigate technology sovereignty chokepoints arising from EU defence dependencies on DMA gatekeepers’ the following four measures are proposed. 

Recommendation 1: EDA-Led Sovereign Defence AI Framework

The European Defence Agency (EDA) shall forefront the efforts for a unified AI framework for Defence, leveraging the regulatory imperative of the AI Act Article 15 requirements for high-risk military applications. This framework shall define cross-border data governance protocols, key performance indicators (KPIs) for DMA silo dependencies, and resilience benchmarks. Aligned with EDA’s Trustworthy AI in Defence (TAID) initiatives, it shall facilitate harmonised standards flexibly outside of regulatory processes.

Recommendation 2: DMA Interoperability Taskforce

An EDA-European Commission joint taskforce shall be established to enforce DMA’s Article 6(7) on interoperability obligations of gatekeepers, supporting sovereign data portability standards for defence workloads. Its provisions shall encompass Application Programming Interface (API) constraints, data export protocols, and verification mechanisms for defence-related dataset migrations, promptly countering hybrid threats, including prompt injection and distributed denial-of-service attacks against international threats.

Recommendation 3: NIS2-Backed Cybersecurity Audits

Horizontal audits under the NIS2 Directive could be mandated for gatekeepers of cloud and AI services underpinning defence-critical functions. The audits will complement the AI Act’s Article 15 adversarial testing in favour of a supply-chain risk management framework and a 24-hour incident notification. The measure can also mitigate transatlantic risks, illustrated in NATO’s Palantir Maven integration of the AI chatbot and ensuring EU regulatory application over commercial arrangements.

Recommendation 4: EDIP/AGILE Funding for Sovereign Pilots

The European Defence Industry Programme (EDIP) and AGILE funds shall be directed to expand sovereign edge cloud pilots, including CISERO/Virt8ra, across the EU to deliver vendor-agnostic, interoperable infrastructure for AI in defence. These initiatives can smoothen the balance between US-based Big Tech’s EU market dominance and domestic providers (only 15% share), bolstering data sovereignty in command-and-control architectures. 

Collectively, these measures could strengthen EU defence against hybrid threats by aligning DMA enforcement with the AI Act’s cybersecurity assurances, advancing the EU’s strategic autonomy.

References

Amazon Web Services (AWS) (2026) AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe, US Press Center. Available at: https://press.aboutamazon.com/aws/2026/1/aws-launches-aws-european-sovereign-cloud-and-announces-expansion-across-europe (Accessed: 19 April 2026).

CEPA (2025) ‘Defend in the Cloud: Boost NATO Data Resilience’, CEPA, 30 April. Available at: https://cepa.org/comprehensive-reports/defend-in-the-cloud-boost-nato-data-resilience/ (Accessed: 19 April 2026).

Council of the EU (2022) ‘A Strategic Compass for Security and Defence – For a European Union that protects its citizens, values and interests and contributes to international peace and security’. Available at: https://data.consilium.europa.eu/doc/document/ST-7371-2022-INIT/en/pdf.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance) (2022) OJ L. Available at: http://data.europa.eu/eli/dir/2022/2555/oj (Accessed: 19 April 2026).

European Commission (2026) Commission awards €180 million tender for sovereign cloud to four European providers. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833 (Accessed: 19 April 2026).

European Defence Agency (EDA) (2024) ‘Combat cloud’: EDA study shows benefits of cloud computing for EU militaries. Available at: https://eda.europa.eu/news-and-events/news/2024/01/25/combat-cloud-eda-study-shows-benefits-of-cloud-computing-for-eu-militaries (Accessed: 19 April 2026).

European Defence Agency (EDA) (2025) Trustworthiness For AI in Defence: Developing Responsible, Ethical, and Trustworthy AI Systems for European Defence. Available at: https://eda.europa.eu/docs/default-source/brochures/taid-white-paper-final-09052025.pdf     (Accessed: 12 April 2026).

European External Action Service (EEAS) (2026) Countering Hybrid Threats. Available at: https://www.eeas.europa.eu/eeas/eu-action-countering-hybrid-threats_en (Accessed: 19 April 2026).

European Parliament – DG EPRS (2025) Defence and artificial intelligence. Available at: https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2025)769580 (Accessed: 12 April 2026).

Future of Technology Institute (FOTI) (2026) ‘Cloud Defence: An exposed European flank’. Available at: https://futureinstitute.tech/assets/doc/FOTICloudDefenceReport26.pdf (Accessed: 19 April 2026).

Heinrich Böll Foundation (2026) Europe’s AI Blind Spot: What the Anthropic-Pentagon Dispute Reveals. Available at: https://us.boell.org/en/2026/04/09/europes-ai-blind-spot-what-anthropic-pentagon-dispute-reveals (Accessed: 19 April 2026).

Kirkwood, M. (2024) ‘Interoperability and the DMA in Action’: Available at: https://mydata.org/wp-content/uploads/2024/11/Interoperability-and-the-DMA-in-Action-Developers-Experiences-of-Data-Portability-API-Access.pdf (Accessed: 19 April 2026).

National Cyber Security Centre (NCSC) (n.d.) ‘NIS 2 Essential and Important Entities’. Available at: https://www.ncsc.gov.ie/pdfs/NCSC_NIS2_2_ENTITIES.pdf.

NATO (2025) NATO acquires AI-enabled Warfighting System, shape.nato.int. Available at: https://shape.nato.int/news-releases/nato-acquires-aienabled-warfighting-system-.aspx (Accessed: 19 April 2026).

OpenAI (2026) Our agreement with the Department of War, OpenAI. Available at: https://openai.com/index/our-agreement-with-the-department-of-war/ (Accessed: 19 April 2026).

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (Text with EEA relevance) (2022) OJ L. Available at: http://data.europa.eu/eli/reg/2022/1925/oj (Accessed: 19 April 2026).

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations, (2024), OJ L 2024/1689. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng  (Accessed: 12 April 2026).

Reuters (2026) ‘OpenAI looking at contract with NATO, source says’, Reuters, 4 March. Available at: https://www.reuters.com/technology/openai-looking-contract-with-nato-source-says-2026-03-04/ (Accessed: 19 April 2026).

Royal United Services Institute (RUSI) (2026) European Cloud Adoption for National Security. Available at: https://www.rusi.org (Accessed: 19 April 2026).

Synergy Research Group (2022) European Cloud Providers Continue to Grow but Still Lose Market Share. Available at: https://www.srgresearch.com/articles/european-cloud-providers-continue-to-grow-but-still-lose-market-share (Accessed: 19 April 2026).

Synergy Research Group (2025) European Cloud Providers’ Local Market Share Now Holds Steady at 15%. Available at: https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 (Accessed: 19 April 2026).

Annex A: Hypothetical scenarios of hybrid threat amplification

Below there are potential scenarios of hybrid threat amplification inspired by real-world use cases.