Who Holds the Keys to Our Defence? Europe’s Challenge in the Face of Foreign Technological Control

It is an undeniable reality that Spain—like Europe as a whole—relies heavily on imports to sustain the development of its industrial base. In certain sectors, such as defence, the situation is critical. This is not merely about the physical scarcity of next-generation semiconductors, but about the invisible architecture underpinning our security: the cloud infrastructures that process strategic and sovereign information.

Amid what might be described as a tariff conflict with the United States—warmer than a trade dispute, yet colder than open confrontation—one of the most significant geopolitical risks lies in our dependence on technologies subject to U.S. International Traffic in Arms Regulations (ITAR). These rules enable Washington to control re-exports, condition technology transfers to third countries (including NATO allies), and exert influence over the technological lifecycle of affected systems, from firmware updates to aspects of their operational integrity. In practical terms, this amounts to an indirect capacity to influence the production and functioning of infrastructure and programmes essential to our defence.

Furthermore, the expansion of Section 702 of the U.S. Foreign Intelligence Surveillance framework reinforces the ability of U.S. authorities to access data stored or processed by service providers under their jurisdiction—even where such data is physically located outside U.S. territory. The implications for digital sovereignty and strategic confidentiality are self-evident.

This reality affects us all. Whenever a technology relies on the servers of a U.S. company (for example, hyperscale cloud providers), there is a significant likelihood that a duplicate set of the “keys” to that sovereignty exists—and that, by operation of law, those providers may be required to grant access to governmental authorities on national security grounds, a category interpreted broadly.

This supply-chain vulnerability is compounded by China’s control over a substantial share of the global processing of critical raw materials, including rare earths, lithium, graphite and other minerals essential to the technology, energy and defence industries. This confers a dominant position at strategic stages of the global value chain.

As a result, industry—not only defence—and national sovereignty itself are exposed to economic, political and diplomatic decisions taken beyond our sphere of control. These are troubling dynamics in times of geopolitical tension.

n my view, the European response has so far been insufficient and overly cautious. The European Defence Industry Programme (EDIP) seeks to limit the presence of non-EU components to 35% in EU-funded projects. While this represents an attempt to reduce ITAR exposure, it simultaneously confirms the extent of our dependence on third countries.

EDIP also proposes, for certain projects, the harmonisation of export rules, certifications and intra-EU transfers—already complex in their current form. It introduces a new legal framework, SEAP, designed to encourage joint procurement through fiscal incentives such as VAT exemptions, alongside the FAST fund, intended to inject liquidity into technology SMEs and prevent their acquisition by non-EU capital due to insufficient local investment.

In addition, the programme incorporates “security of supply” mechanisms allowing the EU, in crisis situations, to prioritise military over civilian orders, thereby ensuring that supply chains continue to function—at least in part—during periods of disruption.

Yet these legislative “remedies” struggle to address what appears to be the defence industry’s central structural problem: fragmentation. Despite the considerable efforts currently under way, the creation of a single European authority capable of regulating and procuring at scale does not appear feasible. Too many national interests are at stake, alongside substantial financial considerations that Member States are reluctant to relinquish.

This lack of coordination is reflected in joint programmes which, in some cases, accumulate years of delay, with delivery horizons stretching towards 2040—by which time the technology risks obsolescence, or may no longer correspond to the nature of future threats.

There are, of course, no simple solutions. But Europe must take a decisive step forward and move beyond outdated notions of fragmented sovereignty. While we debate percentages and add layers of bureaucracy, technological dependence risks turning us into vulnerable actors—perceived as unreliable and falling far below the position of leadership we should occupy.

The uncomfortable question therefore remains: can Europe truly afford for each major Member State to continue backing national champions that are, in reality, unable to guarantee genuine sovereignty? Or should we instead commit to a limited number of continental champions capable of competing globally?

For Spain, the dilemma is particularly acute. We are too small to build a nationally scaled champion capable of competing at European level, yet too large to accept irrelevance.

In times of geopolitical tension, cautious responses are dangerous. European sovereignty requires the courage to unify a defence structure that is currently as costly as it is inefficient. Either we consolidate a genuine and autonomous European industrial pillar, or we will remain spectators on a highly volatile chessboard designed and managed by others.

By Cristina de Santiago

Managing Partner | act legal Spain

Published in EL ESPAÑOL.