Enterprise AI in Europe: The Hidden Cost of Vendor Lock-In

The European Parliament’s December 2025 study on software and cyber dependencies puts a number on something most enterprise leaders already sense but have not formally mapped: roughly 80% of EU cloud and software spending flows to US companies. Amazon Web Services, Microsoft Azure, and Google Cloud together control approximately 70% of European cloud infrastructure. Microsoft 365 holds around 90% of the enterprise productivity suite market. The three US hyperscalers have more European cloud market share combined than every European provider by a factor of roughly ten to one. This is not a new finding. What the study makes visible — and what most enterprise risk frameworks have not yet caught up with — is that AI adoption is not a separate layer sitting above this concentration. It is the mechanism accelerating it.

The stack was already compromised before AI arrived

The ITRE study maps the dependency structure layer by layer. At infrastructure: AWS at 30%, Azure at 25%, Google Cloud at 15% of the European cloud market. European providers — OVHcloud, Deutsche Telekom, SAP — each hold around 1–2%. On the global scale, only 4–5% of cloud infrastructure is European-owned.

At the enterprise software layer the picture is similar. US vendors hold approximately 65% of the EU enterprise software market. In productivity and collaboration, Microsoft’s ~90% share of the office suite market is the most cited figure, but the pattern repeats across ERP (SAP at ~55%, Oracle at ~10%), CRM (Salesforce dominant, no major EU player), and cybersecurity (predominantly US and Israeli vendors).

The most direct measure of enterprise exposure comes from Germany — the EU’s largest economy. 67% of German companies say they cannot operate without US cloud providers. That is not a dependency in the theoretical sense. That is operational lock-in at scale, already in place, before a single AI tool enters the procurement conversation.

Around 80–90% of cloud computing services utilised by European customers, encompassing sensitive data, are hosted by US-based companies. The European Commission has formally recognised this as a strategic dependency. — ITRE Study, PE 778.576, December 2025

The top 100 global digital platforms by market capitalisation in 2025 break down as follows: US and Americas at 82.8%, Asia-Pacific at 14.9%, Europe at 1.8%. Europe’s share of global digital platform value is 1.8%. The enterprises operating on top of this infrastructure are not making a technology choice. They are operating inside a structural constraint.

AI compounds the problem in a structurally different way

Previous enterprise software dependencies — ERP, CRM, productivity suites — were sticky but bounded. A migration was painful and expensive, but technically feasible. AI workloads introduce a qualitatively different form of lock-in.

Generative AI services are not deployed on neutral infrastructure. They run on provider-specific, cloud-native services: managed databases, AI/ML toolchains, serverless runtimes — each of which increases switching costs independently of the model itself. An enterprise deploying Microsoft Copilot is not adding one dependency. It is deepening its Azure dependency, its Microsoft 365 dependency, and adding a new OpenAI model dependency simultaneously.

The market concentration in generative AI reflects this vertical integration. The ITRE study estimates that OpenAI holds approximately 30% of EU generative AI revenue share, Microsoft (Azure OpenAI plus Copilot) 20–25%, AWS 15–20%, and Google 10–15%. The same four providers that dominate EU cloud infrastructure also dominate the generative AI layer being built on top of it. Concentration is not just horizontal across software categories — it is now vertical across the entire stack.

The study notes that OpenAI’s global revenue grew from an estimated USD 1.6 billion in 2023 to USD 12 billion in 2025 — over 700% growth in two years — a significant portion of which comes from enterprise API usage in Europe. That growth rate reflects how fast enterprises are committing to this layer, and how little friction exists at the point of adoption.

The rapid adoption of AI is likely to further strengthen dependencies on incumbent cloud providers, because AI workloads, models, and data pipelines are typically built on provider-specific services which increase switching costs and lock-in risk. This is the ITRE study’s assessment, not a projection. It describes what is already happening in enterprise procurement.

Enterprise governance has not kept pace — the numbers show it

88% of organisations now use AI in at least one business function — up from 78% the previous year. By end of 2026, 40% of enterprise applications are forecast to embed task-specific AI agents, up from less than 5% in 2025.

Against that deployment velocity, the governance picture is stark. Only 21% of organisations have a mature governance model for autonomous AI agents. 36% have no formal plan for supervising AI agents at all. 55% of organisations describe AI use internally as a “chaotic free-for-all,” and 79% say AI applications are being created in silos. Nearly 31% of boards do not treat AI as a standing agenda item.

35% of employees have entered proprietary information into public AI tools. That is not a shadow IT problem in the traditional sense — it is a data sovereignty problem occurring at the point of AI adoption, in organisations that already have 80–90% of their sensitive cloud data hosted by US providers.

The governance gap here is structural, not incidental. Enterprise risk frameworks were designed for a software procurement paradigm where adoption was slower, vendor relationships were more bounded, and data flows were more contained. AI adoption has broken all three assumptions simultaneously. Gartner projects that over 40% of AI-related data breaches by 2027 will stem from improper cross-border use of generative AI — in organisations that, by then, will be subject to mandatory EU compliance requirements that treat exactly this kind of exposure as a reportable event.

What the regulatory trajectory is actually signalling

The EU regulatory stack converging on enterprise AI in 2026 is not primarily about AI. It is about the dependency architecture enterprises have been building for a decade, and the exposure that architecture creates under conditions of geopolitical or market disruption.

NIS2 is now in force across EU member states, with the first administrative penalties beginning to surface in early-transposing member states in 2026 and enforcement activity accelerating through the year. Essential entities face fines up to €10 million or 2% of global annual turnover. In Germany alone, the number of entities in scope under NIS2 has expanded from approximately 4,500 under the previous regime to around 29,500 — a more than sixfold increase. The compliance audit deadline for in-scope entities is 30 June 2026.

The EU AI Act’s high-risk system requirements become mandatory on 2 August 2026, with fines for prohibited AI practices reaching €35 million or 7% of global annual turnover. High-risk AI violations — which include AI used in recruitment, credit scoring, and critical infrastructure — carry fines of up to €15 million or 3% of global turnover.

These are not independent compliance events. NIS2 governs the security of the network and information systems that enterprise AI runs on. The AI Act governs the AI systems themselves. The Data Act governs data access and portability — directly relevant to data pipelines locked inside hyperscaler infrastructure. They are converging pressure on the same dependency architecture, arriving on overlapping timelines.

The enterprises treating each regulation as a separate workstream will find themselves perpetually reactive. The structural question each regulation is pointing at is the same: what happens to your operational continuity when the infrastructure you depend on is controlled by entities outside your jurisdiction, and the regulatory environment changes around you?

In October 2025, a major AWS outage disrupted European business and government services. The ITRE study cites this directly as an illustration of concentration risk at scale. The cost of even a short cloud outage runs to millions of euros. The cost of a sustained loss of access — whether from geopolitical disruption, protectionist policy, or unilateral vendor decisions — is not yet in most enterprise risk models, because most enterprise risk models were not built to account for it.

The enterprises that will navigate this well are not the ones with the most advanced AI deployments. They are the ones that have mapped what they depend on, at every layer, and made deliberate decisions about where that dependency is acceptable and where it is not. That mapping exercise is not a compliance activity. It is a board-level strategic question that most European enterprises have not yet asked in the right terms.

If you are working through this at your organisation — get in touch →

Related reading on The Science Talk

• How Europe’s leading research institutes are integrating AI — and what it means for your organisation — extended context on AI adoption patterns across European institutions, with implementation data.

Browse all Perspectives or get in touch →