Enterprise AI in Europe: The Hidden Cost of Vendor Lock-In

The European Parliament’s December 2025 study on software and cyber dependencies puts a number on something most enterprise leaders already sense but have not yet formally mapped. Roughly 80% of EU cloud and software spending flows to US companies. Amazon Web Services, Microsoft Azure, and Google Cloud together control approximately 70% of European cloud infrastructure. Microsoft 365 holds around 90% of the enterprise productivity suite market. The three US hyperscalers together hold more European cloud market share than every European provider combined, by a factor of roughly ten to one. This is not a new finding. The study makes one thing visible, and most enterprise risk frameworks have not yet caught up with it: AI adoption is not a separate layer above this concentration. It is the mechanism that accelerates it.

The stack was already compromised before AI arrived

The ITRE study maps the dependency structure layer by layer. At the infrastructure layer, AWS holds 30%, Azure holds 25%, and Google Cloud holds 15% of the European cloud market. European providers — OVHcloud, Deutsche Telekom, SAP — each hold around 1 to 2%. At the global scale, only 4 to 5% of cloud infrastructure is European-owned.

At the enterprise software layer the picture is similar. US vendors hold approximately 65% of the EU enterprise software market. In productivity and collaboration, Microsoft’s approximately 90% share of the office suite market is the most cited figure. The same pattern repeats across ERP (SAP at approximately 55%, Oracle at approximately 10%), CRM (Salesforce dominant, with no major EU player), and cybersecurity (predominantly US and Israeli vendors).

The most direct measure of enterprise exposure comes from Germany, the EU’s largest economy. 67% of German companies say they cannot operate without US cloud providers. This is not a dependency in the theoretical sense. It is operational lock-in at scale, already in place, before a single AI tool enters the procurement conversation.

Around 80–90% of cloud computing services utilised by European customers, encompassing sensitive data, are hosted by US-based companies. The European Commission has formally recognised this as a strategic dependency. — ITRE Study, PE 778.576, December 2025

The top 100 global digital platforms by market capitalization in 2025 break down as follows: US and Americas at 82.8%, Asia-Pacific at 14.9%, Europe at 1.8%. Europe’s share of global digital platform value is 1.8%. The enterprises that operate on top of this infrastructure are not making a technology choice. They operate inside a structural constraint.

AI compounds the problem in a structurally different way

Previous enterprise software dependencies, such as ERP, CRM, and productivity suites, were sticky but bounded. A migration was painful and expensive, but it was technically possible. AI workloads introduce a different type of lock-in.

Generative AI services do not run on neutral infrastructure. They run on provider-specific, cloud-native services: managed databases, AI and ML toolchains, and serverless runtimes. Each of these increases switching costs independently of the model itself. An enterprise that deploys Microsoft Copilot does not add just one dependency. It deepens its Azure dependency, its Microsoft 365 dependency, and adds a new OpenAI model dependency at the same time.

The market concentration in generative AI reflects this vertical integration. The ITRE study estimates that OpenAI holds approximately 30% of EU generative AI revenue share. Microsoft (Azure OpenAI plus Copilot) holds 20 to 25%, AWS holds 15 to 20%, and Google holds 10 to 15%. The same four providers that dominate EU cloud infrastructure also dominate the generative AI layer built on top of it. Concentration is no longer just horizontal across software categories. It is now vertical across the entire stack.

The study notes that OpenAI’s global revenue grew from an estimated USD 1.6 billion in 2023 to USD 12 billion in 2025. That is over 700% growth in two years, and a significant portion comes from enterprise API usage in Europe. This growth rate shows how fast enterprises commit to this layer, and how little friction exists at the point of adoption.

The rapid adoption of AI can further strengthen dependencies on incumbent cloud providers. AI workloads, models, and data pipelines are typically built on provider-specific services, which increase switching costs and lock-in risk. This is the ITRE study’s assessment, not a projection. It describes what already happens in enterprise procurement.

Enterprise governance has not kept pace — the numbers show it

88% of organizations now use AI in at least one business function, up from 78% the previous year. By the end of 2026, forecasts show that 40% of enterprise applications will embed task-specific AI agents, up from less than 5% in 2025.

Against that deployment speed, the governance picture is stark. Only 21% of organizations have a mature governance model for autonomous AI agents. 36% have no formal plan to supervise AI agents at all. 55% of organizations describe internal AI use as a “chaotic free-for-all,” and 79% say teams create AI applications in silos. Nearly 31% of boards do not treat AI as a standing agenda item.

35% of employees entered proprietary information into public AI tools. This is not a shadow IT problem in the traditional sense. It is a data sovereignty problem that occurs at the point of AI adoption, in organizations that already have 80 to 90% of their sensitive cloud data hosted by US providers.

The governance gap here is structural, not incidental. Enterprise risk frameworks were designed for a software procurement model where adoption was slower, vendor relationships were more bounded, and data flows were more contained. AI adoption has broken all three assumptions at the same time. Gartner projects that over 40% of AI-related data breaches by 2027 will stem from improper cross-border use of generative AI, in organizations that, by then, will be subject to mandatory EU compliance requirements. These requirements will treat exactly this kind of exposure as a reportable event.

What the regulatory trajectory is actually signalling

The EU regulatory stack that converges on enterprise AI in 2026 is not primarily about AI. It is about the dependency architecture enterprises have built for a decade, and the exposure that architecture creates under geopolitical or market disruption.

NIS2 is now in force across EU member states. The first administrative penalties began to appear in early-transposing member states in 2026, and enforcement activity will increase through the year. Essential entities face fines up to €10 million or 2% of global annual turnover. In Germany alone, the number of entities in scope under NIS2 expanded from approximately 4,500 under the previous regime to around 29,500, a more than sixfold increase. The compliance audit deadline for in-scope entities is 30 June 2026.

The EU AI Act’s high-risk system requirements become mandatory on 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in already-regulated products. The 2026 Digital Omnibus amendment deferred both dates from the original date of 2 August 2026. Fines for prohibited AI practices reach €35 million or 7% of global annual turnover. High-risk AI violations, which include AI used in recruitment, credit scoring, and critical infrastructure, carry fines of up to €15 million or 3% of global turnover.

These are not independent compliance events. NIS2 governs the security of the network and information systems that enterprise AI runs on. The AI Act governs the AI systems themselves. The Data Act governs data access and portability, which is directly relevant to data pipelines locked inside hyperscaler infrastructure. These regulations converge pressure on the same dependency architecture, and arrive on overlapping timelines.

Enterprises that treat each regulation as a separate workstream will stay perpetually reactive. Each regulation points to the same structural question: what happens to your operational continuity when entities outside your jurisdiction control the infrastructure you depend on, and the regulatory environment changes around you?

In October 2025, a major AWS outage disrupted European business and government services. The ITRE study cites this directly as an illustration of concentration risk at scale. The cost of even a short cloud outage runs to millions of euros. Most enterprise risk models do not yet include the cost of a sustained loss of access, whether from geopolitical disruption, protectionist policy, or unilateral vendor decisions, because most enterprise risk models were not built to account for it.

The enterprises that will navigate this well are not the ones with the most advanced AI deployments. They are the ones that map what they depend on, at every layer, and make deliberate decisions about where that dependency is acceptable and where it is not. That mapping exercise is not a compliance activity. It is a board-level strategic question that most European enterprises have not yet asked in the right terms.

If you are working through this at your organisation — get in touch →

Related reading on The Science Talk

• How Europe’s leading research institutes are integrating AI — and what it means for your organisation — extended context on AI adoption patterns across European institutions, with implementation data.

Browse all Perspectives or get in touch →