The European Union has revised draft cybersecurity labelling rules to potentially make them simpler for tech giants like Amazon, Google, and Microsoft for bidding for EU cloud computing contracts. 

The scrapped requirement for vendors to be independent from non-EU laws could facilitate their participation, according to a document seen by Reuters.

The EU has faced challenges in agreeing on a cybersecurity certification scheme (EUCS) to ensure the cybersecurity of cloud services, aiming to assist governments and businesses in the bloc in selecting secure and trustworthy vendors.

The development comes on the back of major tech companies seeking opportunities in the lucrative government cloud market for growth.

However, the EU has expressed concerns about illegal state surveillance, while some member states fear that the dominance of US cloud providers could hinder the growth of competitors from the EU region.

Earlier drafts had included requirements for US tech giants to establish joint ventures with EU-based companies and process customer data within the bloc to qualify for the EU cybersecurity label.

However, such sovereignty requirements faced criticism from European banks, insurance groups, and startups, arguing that technical provisions should take precedence over political obligations.

The latest draft, dated March 22, has removed these sovereignty requirements. Now, cloud vendors are only obligated to provide information about the location of data storage and processing, as well as details about applicable laws.

EU member states are currently reviewing the revised draft. Following their input, the European Commission will finalise the scheme. 

The EU did not issue a statement or oblige for comment requests to Reuters.

(With Reuters Inputs)