Policy & regulation · Jul 20
EU tech sovereignty turns into resilience work for providers
The Commission’s 3 June 2026 package is less useful as autonomy theater than as a checklist for dependency mapping, security evidence, and supplier planning.
- Treat the package as dependency mapping work now, especially for cloud, AI, chips, energy, and IoT exposure.
- Separate proposals from obligations: CADA and Chips Act 2.0 are not the same as enacted compliance deadlines.
- Ask suppliers for resilience evidence before procurement language turns into mandatory contract language.