While the US scaled digital platforms and China industrialized data, the European Union focused on an alphabet soup of regulations. The General Data Protection Regulation, the Data Governance Act, the Data Act, the Open Data Directive, and the AI Act — together they form the world’s most comprehensive governance framework for data and digital technologies.
Since data is the fuel that powers digital innovation, the rules represent a giant break on the continent’s competitiveness. Europe’s data remains trapped within a fragmented landscape of national regulations and administrative procedures, the European Commission acknowledged in its 2025 State of the Digital Decade report.
A recently announced Data Union Strategy addresses these problems. It wants to accelerate data diffusion, propelling Europe from a posture of protection to one of production, from governing data to generating value from it. Redundant regulations are eliminated. Cookie consent rules are reformed. Pseudonymized data no longer constitutes personal data, easing data sharing.
Europe’s data sensitivity is understandable. If data is abused, citizens’ privacy can be compromised. Large digital platforms, if left unchecked, could take advantage.
Yet many of the constraints on data sharing have little to do with protecting privacy. Europe’s public sector data remains dispersed across institutions, stored in incompatible formats, governed by divergent access regimes, updated unevenly, and with limited cross-border use. More than 55% of public officials cited inconsistent data standards and a lack of APIs as barriers to working with technology providers, according to a recent European Commission study.
Companies face prohibitive costs. Compliance for just three major digital laws — GDPR, NIS2, and the AI Act — amounts to around €53 billion. Small developers pay more than €1,600 per year, consuming profit margins required for innovation.
The EU’s new data strategy addresses real problems with practical solutions. One-click compliance will make regulatory requirements machine-verifiable, leveraging a new European Business Wallet to store verified company credentials. Instead of companies spending time researching whether a potential partner is trustworthy or compliant, verified information would provide instant confirmation.
The Open Data Directive will make legal, judicial, and administrative data freely available through APIs. By improving how these “high-value” datasets are shared, the strategy could eventually provide the transparency and reliability that companies need to verify partners and evaluate competition without paying a premium for public records. The strategy establishes data labs, linking data holders with AI developers, promoting secure environments in which data can be analyzed without leaving the owner’s system, and turning unstructured records into high-quality resources that startups can use.
But execution faces hurdles.
First, the timeline is tight. While the US and China move at a sprint, Europe is held back by a “regulation lag.” By launching data labs and the Digital Omnibus simultaneously, the European Commission has created significant coordination risks.
Second, success depends on the capabilities that many organizations lack. Most of Europe’s government AI projects remain in pilot phases, slowed down by inconsistent records and a shortage of internal talent. Data labs and automated compliance require digital literacy across public administrations. Building this capability takes time.
Third, new governance structures inevitably add complexity. Without strong coordination, common data spaces could reproduce the fragmentation they are meant to overcome. While much attention has been paid to making data available, far less has been given to ensuring that organizations can actually use it. Access alone does not create value. What matters is the ability to integrate data into decision-making and operations.
A 2025 McKinsey analysis on European productivity reveals a profound diffusion gap: while a small group of digital leaders has mastered data integration, the vast majority still lacks operational frameworks to turn information into fast decisions. Closing this gap requires skills, interoperable systems, clear standards, and institutional incentives that reward use.
The stakes extend far beyond data policy. At issue is Europe’s ability to remain economically relevant in a world shaped by AI and digital infrastructure. The US competes through scale. China competes through speed and state coordination. Europe’s advantage lies elsewhere: in trust, institutional reliability, and the ability to produce high-quality, well-governed data. In a world flooded with data but short on reliability, Europe could position itself as the provider of a trusted information infrastructure.
Europe has built scaffolding. But scaffolding is not architecture. The question now is whether it can turn that structure into something that works.
Pedro Tavares is Co-Founder and CEO of GovHorizon, a governance and policy intelligence platform that uses AI for strategic decision-making across public and private sectors. Previously, he served as Portugal’s Secretary of State for Justice.
Gustavo Magalhães is a Director at Beta-i Collaborative Innovation, where he works with public and private organizations on innovation strategies. Before joining Beta-i, he advised government officials on data governance and digital policy.
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
2025 CEPA Forum Tech & Security Conference
Explore the latest from the conference.
