EU revises cybersecurity certification scheme, scraps sovereignty requirements

Draft cybersecurity labelling rules within the European Union (EU) have eliminated a provision that previously required cloud computing vendors to be independent of non-EU laws, according to a document obtained by Reuters. This adjustment may facilitate bidding for EU cloud computing contracts by major tech companies such as Amazon, Alphabet Google, and Microsoft.

The EU has encountered challenges in finalising a cybersecurity certification scheme (EUCS) aimed at ensuring the cybersecurity of cloud services. The scheme is intended to assist both governments and businesses in the EU in selecting secure and trustworthy vendors for their operations.

This development coincides with interest from major tech companies in the government cloud market as a means of driving growth. However, concerns persist within the EU regarding potential illegal state surveillance, while some member states express apprehension about the dominance of US cloud providers hindering the development of European competitors.

A previous draft proposal circulated among EU governments had stipulated that US tech giants establish joint ventures with EU-based companies and process customer data within the EU to qualify for the cybersecurity label. However, this requirement faced criticism from various European entities, including banks, insurance groups, and startups, who argued in favour of prioritizing technical provisions over political and sovereignty obligations.

The latest draft, dated March 22, has removed the sovereignty requirements, with cloud vendors now only mandated to disclose information regarding the location of customer data storage and processing, as well as relevant applicable laws.

EU member states are currently reviewing the revised draft, following which the European Commission will finalize the scheme. Requests for comment from the EU executive remain unanswered.

(With Reuters inputs)