Related items

The Dual-Use Regulation gives Europe a common framework for economic security, but divergent national implementation is weakening it. The same transaction can be assessed differently depending on the Member State, with guidance on cloud and software-as-a-service transfers remains unclear. Licensing processes, meanwhile, still assume a physical consignment rather than digital workflows, which sits poorly with how integrated global businesses operate. Companies bear the added cost and legal uncertainty, while the security benefit is limited. A single EU-wide approach to intangible transfers and closer alignment with the US and UK would make controls more predictable and let authorities focus on genuine risks. Read how the revision of the Dual-Use Regulation can deliver a harmonised and future-proof framework for Europe.

The success of the Cloud and AI Development Act (CADA) will depend on whether its sovereignty framework strengthens Europe’s resilience and competitiveness without restricting access to the technologies, providers and operating models needed to support the bloc’s digital transformation. As currently envisaged, several elements of CADA introduce origin-based restrictions that are not necessarily linked to genuine sovereignty, security or resilience risks. These measures could reduce competition, increase costs and slow cloud and AI adoption – ultimately working against CADA’s underlying objectives.

A sovereignty framework built on objective, risk-based criteria will better support Europe’s competitiveness, resilience and digital transformation than one based on origin, ownership or nationality.

The European Commission’s forthcoming guidance on the Corporate Sustainability Due Diligence Directive (CS3D) should:

• allow companies to voluntarily prioritise chains of activities with a meaningful connection, which should be further defined in the guidance, to the EU or based on a global risk-based approach in cases where companies have global integrated supply chains;

• recognise that companies may face conflicting or overlapping legal requirements between EU and third-country legislation, particularly in relation to information gathering, audits, data transfers, supplier disengagement and cooperation with authorities;

• clarify how companies should document and manage circumstances in which third-country law restricts or prevents a due diligence measure;

• recognise interactions with competent local authorities, regulatory inspections, permits, licences and other official approvals as potentially relevant sources of due diligence information; and

• protect companies from liability where they have followed a reasonable, documented and good-faith process, including where another stakeholder might have prioritised risks or selected due diligence measures differently.

• If these measures are included in the guidance, they would help the CS3D deliver meaningful and effective due diligence, rather than an exhaustive mapping of every global business relationship. Flexibility, proportionality and legal certainty can help companies progressively develop credible global systems while directing resources towards the most significant risks and the areas where they have the greatest ability to achieve positive outcomes.

Learn more in our contribution and paper.