The UK and European Union have fundamentally repositioned data centres from passive infrastructure into strategic legal assets, triggering a wave of regulatory change designed to secure domestic control over critical digital systems. In late 2024, the UK formally designated physical data centres and cloud infrastructure as Critical National Infrastructure, a move that signals the beginning of tighter operational oversight. The EU has advanced a complementary approach through its proposed Cloud and AI Development Act, which introduces a harmonised framework measuring cloud and AI sovereignty across four strict assurance levels tied to physical location, operational independence, ownership, and supply-chain control.
The shift reflects shared anxiety about reliance on non-EU and non-UK infrastructure operators for essential digital services, particularly as artificial intelligence and cloud computing deepen their role in public services, economic continuity, and national resilience. Neither jurisdiction treats data centre capacity merely as a technical layer anymore. Both now embed it within broader digital sovereignty agendas that address geopolitical concentration, cybersecurity risk, and the strategic value of domestic compute capacity.
The UK’s Critical Infrastructure Designation And What Follows
The UK’s CNI designation itself does not immediately impose new legal duties on data centre operators, but it serves as a harbinger of forthcoming obligations. The government’s proposed Cyber Security and Resilience Bill (HL Bill 32) is expected to amend the current framework by bringing qualifying data centre services within scope of mandatory resilience standards. Currently, the Network and Information Systems Regulations 2018 do not apply to data centres, leaving the sector without sector-specific cyber-resilience mandates at the national level.
The designation aligns with the UK’s broader digital strategy, which encompasses the AI Opportunities Action Plan, AI Growth Zones, the UK Compute Roadmap, and the AI Hardware Plan. These initiatives treat domestic compute and data centre capacity as a strategic condition for secure AI deployment rather than as a standalone regulatory requirement. The logic is clear: if artificial intelligence infrastructure depends on foreign-controlled data centres, the UK cannot guarantee the security or availability of AI systems that underpin critical services.
Legal experts flag that the timing matters. As the proposed cyber-resilience bill moves through Parliament, operators will need to prepare for stricter incident reporting, resilience testing, and possibly security clearance requirements for key personnel and infrastructure access.
The EU’s Sovereignty Assurance Framework
The proposed Cloud and AI Development Act takes a more prescriptive approach. Rather than leaving sovereignty as an aspirational goal, it codifies four Union assurance levels that measure the degree to which cloud and AI capacity remains under EU control and influence. Physical location of servers, operational independence of the provider, European ownership structure, and supply-chain transparency all feed into these levels. A cloud service provider operating data centres outside the EU or relying on non-EU components would face classification at a lower assurance tier, which could restrict its use for sensitive workloads.
The proposed Act is part of the EU’s wider Tech Sovereignty Package, which includes the Chips Act 2.0, an EU open-source strategy, and a strategic roadmap for digitalisation and AI in the energy sector. Data centre infrastructure occupies the centre of this effort because cloud and AI services depend on it directly. Without domestic data centre capacity, the EU would remain structurally dependent on US and Chinese providers for the digital infrastructure that increasingly underpins European economic and government functions.
The framework also signals a departure from the EU’s earlier, lighter-touch approach to cloud regulation. Instead of relying on data protection rules like the GDPR to manage foreign control, the new framework targets sovereignty explicitly, treating provider location and control structure as regulatory ends in themselves.
Overlapping Objectives, Divergent Methods
Both jurisdictions share the same underlying premise: critical digital infrastructure should not depend primarily on foreign operators or non-domestic physical control. But their regulatory paths differ in rigour and scope. The UK approach treats data centre designation as a precursor to future cyber-resilience standards, leaving the specific obligations to forthcoming legislation. The EU approach is prescriptive from the outset, establishing measurable assurance levels and linking them directly to permitted use cases.
For multinational cloud and data centre operators, this divergence creates compliance complexity. A provider may need to maintain separate operational structures, audit regimes, and service tiers for UK and EU customers depending on how the final legislation is written. Some providers have already begun investing in European data centre capacity and establishing separate European subsidiaries to meet anticipated sovereignty requirements.
What Remains Uncertain
The precise scope of UK cyber-resilience duties for data centre operators depends on how the proposed bill is amended during parliamentary review. The EU’s assurance level framework has not yet been finalised and will likely face pushback from cloud providers and civil liberties advocates concerned about market concentration and innovation chilling effects. Neither jurisdiction has settled how to balance sovereignty objectives with the open internet principle or how to treat hybrid models where a single platform operates across both regions.
The legal and operational implications will become clearer once these frameworks move from proposal to enforcement. For now, data centre operators and cloud providers are preparing for a regime in which their physical location, ownership structure, and supply-chain relationships have become regulatory variables rather than neutral technical choices.
