Europe is spending €300 billion to free itself from undemocratic control of its digital infrastructure. It has not yet considered what happens when the authoritarian is European.
by Chris Kremidas-Courtney, Senior Advisor to Defend Democracy
Europe’s digital dependency is no longer just an annoyance; it’s a strategic vulnerability. In May 2025, following a White House executive order, Microsoft locked the ICC’s chief prosecutor out of his institutional Office 365 account, cutting off an international legal official from his own court’s digital infrastructure. An American company, complying with American political directives, disabled the working systems of an international institution. When European governments rely on American cloud providers, they are subject to American laws that can compel them to hand over data stored anywhere in the world. In 2026, we know those laws have teeth.
The answer is the EuroStack initiative, a €300 billion programme to build a common European digital stack in AI, cloud computing, semiconductors, and data infrastructure. It’s the right response to a real problem, and Europe is right to pursue it with urgency. But it rests on an assumption that few are questioning. If that assumption proves wrong, EuroStack will not protect European citizens from authoritarian capture of their digital lives. Instead, it could enable it.
The safety guarantee of European digital infrastructure is not that it’s European but that it’s democratic.
European digital infrastructure is presumed to be safer not because of its location, but because of the democratic governance that controls the legal environment in which it operates. The assumption of stable democratic governance is precisely what an authoritarian wave now moving across Europe is putting in doubt.
In France, far right National Rally (NR) candidate Jordan Bardella is already polling at 38% in the first round. As Paul Taylor argued in the Guardian this April, a hopelessly fragmented opposition with Mélenchon draining the left, Philippe and Attal splitting the centre-right, and no unifying candidate in sight could functionally gift Bardella the presidency regardless of his absolute vote share. Marine Le Pen remains ineligible unless an appeals court overturns her embezzlement conviction this July; if it does, the RN’s path is even clearer.
In Germany, far right extremist party Alternative fuer Deutschland (AFD) has doubled its vote share in 2025. The Brandmauer held this time, but firewalls built from political norms and not law can be dismantled. In the United Kingdom, Reform UK leads in national polling, winning local councils across England. This is the same party whose leader courted $100 million from Elon Musk, whose former Welsh leader was jailed for Russian bribes, and who promises to scrap the Online Safety Act in deference to Silicon Valley.
Now consider what EuroStack is already building. Mistral AI, which is partially funded by French state investment bank Bpifrance, is being positioned as the sovereign AI layer for European public services. SAP, whose software is used by a majority of the world’s largest enterprises, has expanded its partnership with Mistral AI to build sovereign AI infrastructure for Europe. France’s February 2025 AI summit unlocked €110 billion in investment pledges, the largest sovereign AI mobilisation in Europe, with Mistral positioned as the flagship national champion at the centre of that strategy.
SAP has already shown that its values are negotiable when the company abandoned its diversity standards in response to the new political atmosphere created by Donald Trump in the United States. If it can do that in response to a foreign government’s mood swing, the idea that it would resist an authoritarian AFD-led government using procurement leverage is overly optimistic.
The term national champion has always been a euphemism for a politically managed private company; an arrangement that functions well when politics are liberal and democratic and becomes a mechanism for authoritarian pressure when they are not. A Bardella administration’s definition of French national interest in AI, data governance, and content moderation would not be the same as President Emmanuel Macron’s.
Viktor Orbán did not build new tools of control when he returned to power in 2010. Instead, he captured existing ones like public broadcasters, media regulators, state advertising budgets, and the judiciary. That playbook is now openly studied and admired by parties across Europe. A Bardella government would not need to construct a surveillance apparatus since it would inherit one, freshly built and publicly funded by the sovereignty project designed to prevent exactly this kind of outcome.
EuroStack’s architects speak of democratic values, but they have yet to build those values into the governance system. There are no democratic conditionality clauses in sovereign AI procurement contracts nor independent oversight bodies insulated from government removal. There are also no sunset provisions on state investment that trigger when rule-of-law conditions are breached. Democratic values are named as a destination, but they are not yet built into the road to get there.
The American dimension is already operational on European soil. Elon Musk appeared at an AfD rally telling thousands it was “the best hope for Germany,” while his platform’s algorithm demonstrably amplifies right-wing content across Europe. In Italy, Giorgia Meloni’s government has been negotiating a state communications contract with his Starlink precisely because no European alternative exists. Palantir, whose CEO published what critics called a technofascist manifesto, is already a de facto data operating system for European law enforcement and intelligence.
The European dimension is equally alarming. In France, billionaire Vincent Bolloré has built a media empire through Vivendi that now encompasses CNews, Europe 1 radio, Le Journal du Dimanche, and the publishing giant Hachette. His outlets have been credited with pulling National Rally narratives into the mainstream. He also opened his Paris mansion to host the negotiations between the National Rally and Les Républicains that produced their 2024 electoral alliance. In sum, Bolloré appears to be a European information infrastructure owner who has chosen to steer his holdings to favour the far right.
This dynamic crystallised recently at the 2026 Cannes Film Festival, where Canal+ CEO Maxime Saada announced the studio would blacklist over 600 film professionals, including figures like Juliette Binoche, who had signed a petition warning against Bolloré’s growing grip on French cinema. The petition’s signatories feared that controlling the entire chain from financing to distribution would give Bolloré the power to ensure only ideologically acceptable films get made; Saada’s response demonstrates that such power is already being exercised.
Amidst all of this runs Russian money, which has flowed into far-right movements across Europe, from the AfD’s documented Russian connections and payments to the Reform UK Welsh leader to the broader pattern of Russian oligarchs funding European populist movements as part of Putin’s deliberate strategy to weaken European democratic cohesion.
The convergence of American tech billionaires, European media oligarchs, and Russian capital is creating a transnational infrastructure for authoritarian political capture operating across the domains EuroStack is trying to build. If a Bardella government comes to power in France it would not need to build its own digital mechanism, instead it could simply take control of EuroStack and thereby add a fourth layer.
Warnings from EU parliamentarians and rights groups have focused on a real but narrower risk that Europe may be trading its rights-based regulatory legacy for a defence-centric model.
As a sovereignty project, EuroStack has the best answer to external threats. But it has yet to address potential threats from within.
Building democratic conditionality into EuroStack
The good news is the tools for democratic conditionality already exist within the EU legal order. The problem so far is that none of them have been applied to digital infrastructure. Four changes could close the gap:
1. Extend the Rule of Law Conditionality Mechanism to sovereign digital infrastructure funding. The EU already has a Rule of Law Conditionality Regulation which allows it to suspend funds from member states that breach democratic standards. While it has been used against Hungary for general EU cohesion and recovery funding, it has never been applied to digital sovereignty investment. The Commission should explicitly designate sovereign AI and cloud infrastructure funding as within scope of the mechanism. That way a government using procurement leverage to coerce state-funded AI providers could lose access to EU funds underwriting it.
2. Require structural independence for national AI oversight bodies as a condition of EuroStack participation. The AI Act requires member states to designate national authorities to oversee AI systems, but independence standards are weak and unevenly implemented. EuroStack participation agreements should require national AI oversight bodies to meet minimum independence standards such as fixed-term appointments, removal only for cause with judicial review, and ring-fenced funding that cannot be cut by executive action. This mirrors the model used for central bank independence. A government that cannot meet these standards should not receive EuroStack investment.
3. Build sunset clauses into state investment agreements with AI companies. When a state investment bank such as Bpifrance takes an equity stake in a company like Mistral, it gains governance rights that creates risk if the character of the state changes. Investment agreements should include automatic sunset provisions. If the investing government is placed under Article 7 proceedings or the Rule of Law Conditionality Mechanism, its governance rights transfer automatically to an EU-level trustee.
4. Create a cross-border democratic audit function for public AI infrastructure, modelled on the European Court of Auditors. No single member state can audit the democratic integrity of AI infrastructure that spans the entire Union. A standing EU auditing body with a mandate to assess whether sovereign AI infrastructure is being used consistently with the Charter of Fundamental Rights and operating independently of the governments that procure it, would turn rhetoric into real oversight. The European Court of Auditors already provides a model since it’s appointed by member states but operates independently with a mandate that survives changes of governments.
If EuroStack succeeds on its current terms with European ownership, jurisdiction, and companies running European public AI infrastructure – but fails to embed democratic conditionality into its governance, the practical achievement will be limited to a change of address for the entities that control our digital lives. The servers will be in Frankfurt instead of Texas and the company will be answerable to French law instead of American law. Under current conditions, that is a meaningful improvement. Under a Bardella administration, a Meloni government deepening its authoritarian tendencies or an AfD-led coalition in Germany, the new overlords would simply be European.
Addressing this will face resistance from governments that see digital sovereignty as a matter of national influence rather than a collective democratic obligation. But the alternative of building critical infrastructure on the assumption of permanent democratic health without installing critical safeguards is naïve, if not negligent.
Defend Democracy, 19 May 2026
