Executive Summary The International Center for Law & Economics (ICLE) identifies multiple European Union regulatory frameworks that function as significant barriers to U.S. exports of goods and services, and to...
Executive Summary
The International Center for Law & Economics (ICLE) identifies multiple European Union regulatory frameworks that function as significant barriers to U.S. exports of goods and services, and to U.S. foreign direct investment. These measures include the Digital Markets Act, General Data Protection Regulation, Artificial Intelligence Act, the FDI Regulation, and draft regulations on cybersecurity certification and space activities. Each imposes or is likely to impose direct compliance costs on major U.S. technology firms that exceed $100 million annually, with additional indirect costs from foregone innovation, delayed market entry, and reduced investment substantially exceeding this figure.
These regulatory frameworks share common structural features. They impose fixed compliance costs that foreclose market entry for smaller U.S. firms, while raising operational expenses for larger enterprises. They embed vague legal standards that grant enforcement authorities broad discretion, creating uncertainty that deters investment. They also extend regulatory jurisdiction extraterritorially to capture transactions occurring outside EU borders.
Despite formal technological neutrality, these measures disproportionately burden U.S. firms. The Digital Markets Act designates five U.S. companies among seven total “gatekeepers.” The General Data Protection Regulation’s largest enforcement actions target U.S. firms, including a record €1.2 billion fine against Meta. The Artificial Intelligence Act’s penalty structure is based on worldwide turnover, creating disproportionate liability for global U.S. enterprises. The draft Cybersecurity Certification Scheme imposes sovereignty requirements—EU headquarters, EU ownership, immunity from non-EU laws—that U.S. firms cannot meet without divesting ownership or violating U.S. law.
These regulations embed industrial-policy objectives within ostensibly neutral technical standards. EU officials explicitly link the Digital Markets Act to the “digital sovereignty” goals of reducing dependence on non-European technology providers. The FDI Regulation uses security rationales to advance strategic-autonomy objectives. The Cybersecurity Certification Scheme incorporates requirements designed to create protected market segments from which foreign providers are excluded. This approach substitutes political discretion for market-based competition.
Several provisions also constitute forced technology transfer. The Digital Markets Act’s interoperability and data-access obligations compel designated firms to disclose proprietary algorithms and datasets to competitors without meaningful safeguards. Unlike traditional competition remedies that balance access against innovation incentives, these requirements are categorical and unconditional. The asymmetry is deliberate: designated firms must share intellectual property, while they are simultaneously prohibited from using data generated by third parties on their platforms.
The draft Cybersecurity Certification Scheme likely violates EU commitments under World Trade Organization agreements. Sovereignty requirements imposing local-presence mandates and effectively establishing zero quotas for foreign suppliers contravene GATS Articles XVI and XVII on market access and national treatment.
These comments recommend that the Office of the U.S. Trade Representative (USTR) formally designate these measures as significant foreign trade barriers in the 2026 National Trade Estimate Report. Following designation, the USTR should initiate bilateral engagement through the U.S.-EU Trade and Technology Council, with specific negotiating objectives to address the discriminatory provisions. The USTR should raise these barriers in multilateral forums, including the WTO Technical Barriers to Trade and Services Committees.
The United States should not respond through retaliatory tariffs or reciprocal regulatory restrictions. Such measures impose costs on U.S. consumers, harm U.S. firms, and undermine U.S. credibility when advocating for rules-based trade. The appropriate response combines formal trade-barrier designation, sustained diplomatic engagement, and readiness to pursue dispute settlement where violations of international commitments are clear.
I. Introduction
The International Center for Law & Economics (ICLE) thanks the Office of the United States Trade Representative (USTR) for the opportunity to comment on this public consultation on foreign barriers to U.S. exports of goods and services and U.S. foreign direct investment.
ICLE is a nonprofit, nonpartisan research organization whose core mission is to promote the application of law & economics methodologies to inform public-policy discussion. Our scholars have identified multiple foreign policies and practices that deviate from free-trade and free-market principles and that impose measurable costs on U.S. firms seeking to export goods and services, or to make foreign direct investments.
This submission focuses primarily on European Union (“EU”) regulatory measures that function as substantial barriers to U.S. commerce. The Digital Markets Act (DMA), General Data Protection Regulation (GDPR), and Artificial Intelligence Act (AI Act) each impose direct compliance costs on major U.S. technology firms that exceed $100 million annually. In addition to these mandatory expenditures, the measures also subject U.S. firms to indirect costs that substantially exceed this figure from foregone innovation, delayed market entry, and reduced investment.
Beyond digital regulations, our comments examine the EU’s FDI Regulation, which has encouraged the proliferation of national investment-screening mechanisms across EU member states under various security rationales, while serving the industrial-policy objectives of strategic autonomy. We further analyze draft regulations on cybersecurity certification and space activities that impose nationality-based criteria and sovereignty requirements that U.S. firms cannot meet without divesting ownership or violating U.S. law. We also address digital services taxes that multiple jurisdictions have implemented with revenue thresholds designed to capture predominantly U.S. firms. And we examine foreign pharmaceutical-pricing practices that refuse to internalize meaningful portions of innovation costs, while free riding on the benefits of American-funded medical breakthroughs.
These measures share certain common structural features that create non-tariff barriers. They impose fixed compliance costs disproportionate to firm size, effectively foreclosing market entry for U.S. small and medium enterprises. They embed vague legal standards that grant enforcement authorities broad discretion, raising risk premiums that deter investment. They extend regulatory jurisdiction extraterritorially to transactions occurring outside EU borders. They deviate from established international standards through processes that exclude meaningful U.S. participation. They incorporate forced technology-transfer requirements that compel the disclosure of proprietary information to competitors without safeguards against misappropriation.
Despite formal technological neutrality, these frameworks disproportionately burden U.S. firms. The DMA designates five U.S. companies among seven total “gatekeepers” subject to its obligations. The GDPR’s largest enforcement actions target U.S. firms, including a record €1.2 billion fine against Meta for transatlantic data transfers. The AI Act’s penalty structure is based on worldwide turnover, thereby creating disproportionate liability for global U.S. enterprises as compared to EU-focused competitors. The draft Cybersecurity Certification Scheme imposes requirements for EU headquarters, EU ownership, and immunity from non-EU laws that only EU-domiciled firms can satisfy. The draft Space Act establishes size-based constellation thresholds that exempt existing European systems while capturing U.S. large-constellation operators.
The regulations embed industrial-policy objectives within ostensibly neutral technical standards. EU officials have explicitly linked the DMA to the “digital sovereignty” goals of reducing dependence on non-European technology providers. The European Commission has encouraged other jurisdictions, including Brazil, to adopt similar frameworks, extending the reach of EU regulatory protectionism beyond its borders. Multiple countries have implemented or are considering DMA-style asymmetric regulations that target the same U.S. technology firms.
This submission documents these barriers through analysis grounded in economic principles and empirical evidence. Section II examines the DMA’s technical barriers to trade, intellectual-property erosion, services restrictions, investment deterrence, and industrial-policy orientation. Section III analyzes the GDPR’s compliance-cost structure, market distortions, systemic legal uncertainty in transatlantic data transfers, and discriminatory enforcement patterns. Section IV addresses the AI Act’s fixed compliance costs, including market-entry barriers; extraterritorial jurisdiction; technical barriers, which include conformity assessment and prescriptive data requirements; investment deterrence, and regulatory fragmentation. Section V examines the FDI Regulation’s expansion of screening mechanisms, its effects on investment, and its use for industrial-policy objectives. Section VI addresses digital-services taxes. Section VII analyzes foreign pharmaceutical-pricing practices. Section VIII evaluates the draft Cybersecurity Certification Scheme’s evolution toward protectionism, economic inefficiency, specific trade-barrier provisions, and inconsistency with WTO commitments. Section IX addresses the proposed Space Act.
Each section concludes with specific recommendations for USTR action. We recommend formal designation of these measures as significant foreign trade barriers in the 2026 National Trade Estimate Report under the appropriate categories, including Technical Barriers to Trade, Services, Investment, Anticompetitive Practices, and Other Non-Market Policies and Practices. We recommend bilateral engagement through the U.S.-EU Trade and Technology Council with specific negotiating objectives to address discriminatory provisions. We also recommend raising these barriers in multilateral forums, including WTO Technical Barriers to Trade and Services Committees.
The appropriate U.S. response should not involve retaliatory tariffs or similar measures. Such actions would impose costs on American consumers through higher prices and restricted choice, while undermining the global competitiveness of U.S. industries. Instead, we advocate vigorous enforcement of international trade principles, promotion of evidence-based regulation aligned with international standards, and engagement through diplomatic and legal channels to dismantle foreign protectionism. By systematically identifying and challenging these barriers through proper trade policy channels, the USTR can advance the interests of American businesses and workers, while promoting open markets and robust competition in the global economy.
II. Digital Markets Act
The EU’s DMA[1] establishes an expansive regulatory framework governing large online platforms, which it designates as “gatekeepers.” Although formally neutral, the DMA in practice applies almost exclusively to U.S.-headquartered firms that export digital services and invest heavily in Europe’s digital ecosystem. Indeed, five out of the seven firms targeted by the regulation are U.S.-based.[2] By altering the terms of competition and imposing disproportionate compliance costs on a handful of foreign companies, the DMA effectively functions as a non-tariff barrier to trade.[3] It raises the cost of market access, redistributes economic rents toward certain competitors and business users, and restricts the ability (and incentives) of U.S. firms to innovate and invest.[4] In sum, the law’s cumulative effect is likely to disadvantage U.S. exports of digital services and intellectual property, while also deterring U.S. foreign direct investment, in ways inconsistent with the principles of open and nondiscriminatory trade.
A. Technical Barriers to Trade
The DMA introduces an elaborate system of operational and technical obligations that resemble a conformity-assessment regime, which are applied selectively to foreign providers of digital services. Its prescriptive interoperability, data-sharing, and self-preferencing mandates require designated firms to redesign key aspects of their products, interfaces, and internal processes to conform to EU-specific requirements. In practice, designated companies must cooperate and consult the Commission when launching products or making design decisions to ensure that their offerings conform to the Commission’s evolving interpretation of what constitutes “fair” conduct.[5] Indeed, some gatekeepers have observed that “when no two people agree on what the DMA’s substantive obligations mean, the resulting ambiguity undermines the rule of law itself.”[6]
Further, the measures required by the DMA are neither aligned with existing international standards nor with the outcome of transparent, multi-stakeholder processes. By prescribing far-reaching “antitrust-like” obligations and prohibitions absent a finding of market power and without the need to prove harm, the DMA deviates from established antitrust principles, which typically require in-depth case-by-case economic analysis and a clear theory of harm.[7] Instead of adhering to antitrust law’s long-established procedural safeguards and reliance on rigorous economic analysis, the EU has opted to bypass them, using its political and regulatory power to export its policy preferences globally and compel U.S. firms to tailor their products and services “for Brussels.”
The law also embeds an extensive auditing and reporting apparatus that requires firms to produce detailed and costly compliance documentation, appoint an internal compliance officer, submit to technical assessments, and engage in continuous dialogue with the European Commission.[8] These procedures mirror conformity-assessment mechanisms in goods markets and impose compliance costs that fall almost exclusively on U.S. service exporters. Furthermore, U.S. stakeholders and standards organizations have extremely limited influence over the criteria and benchmarks by which “fairness” and “contestability” are assessed, resulting in a process that lacks transparency and inclusivity. As many scholars have pointed out, the terms “fair” and “contestable” are themselves vague and abstract.[9] This ambiguity leaves significant scope for discretion on the Commission’s part, further eroding legal certainty and companies’ freedom to do business however and with whomever they choose.
Collectively, the DMA’s rigid ex-ante requirements function as technical barriers to trade, erecting regulatory hurdles that selectively disadvantage U.S. firms.
B. Intellectual-Property Protection
The DMA’s interoperability and data-access obligations compel designated firms to disclose proprietary information—including technical documentation, algorithms, and datasets—to competitors and third parties. This forced sharing of commercially sensitive materials erodes trade-secret protection and effectively appropriates intellectual property developed by U.S. companies. Unlike traditional competition law, which balances access remedies against innovation incentives,[10] the DMA’s obligations are categorical and unconditional, offering no meaningful safeguards against misuse or loss of proprietary value.
The practical result is a regime of de facto compulsory licensing that weakens incentives to invest in research and development. The DMA thereby undermines the foundational principle that secure intellectual-property rights are essential to innovation. It replaces market discipline with regulatory discretion, transforming proprietary technologies into shared resources, subject to administrative redistribution. Yet the flow of benefits under this regime is entirely one-sided: while the DMA compels designated companies to share data and intellectual property with rivals, it simultaneously prohibits them from using data generated by third parties on their own platforms when competing with those same parties. This asymmetry further weakens their competitive positions and devalues the significant investments that gatekeepers have made in collecting that data and sustaining the platforms on which it is created. Such an approach is inconsistent with international commitments to protect intellectual property, and risks eroding the global value of U.S. innovation.
C. Services
The DMA imposes far-reaching constraints on how U.S. digital-service providers may design, operate, and monetize their offerings within the EU. While the legislation purports to promote “fairness” and “contestability,” its practical effect is to discriminate against foreign suppliers of digital services. The criteria for gatekeeper designation—focusing on global scale and user reach—ensure that almost all targeted firms are American, while “comparable” European companies remain exempt. Indeed, the DMA only applies to one European company, Booking.com.
The obligations themselves restrict the configuration of digital services, including prohibitions on combining data across platforms, limitations on self-preferencing, and mandatory interoperability with third-party software and hardware. These measures directly interfere with platforms’ service design and business models, effectively dictating how U.S. firms may compete and innovate. The DMA also fragments cross-border data flows by compelling firms to maintain separate data-processing structures and by subjecting transatlantic data transfers to heightened compliance risks. This fragmentation functions as a data-localization measure in disguise, impeding the seamless delivery of U.S. cloud, AI, and digital-advertising services across the single market.[11]
Compounding these barriers, the Commission retains broad discretionary authority to interpret and expand DMA obligations through delegated acts and individual enforcement decisions. This open-ended regulatory environment creates substantial uncertainty for U.S. service providers and chills entry and innovation. Together, these features amount to a comprehensive restriction on cross-border trade in digital services, disadvantaging U.S. exporters under the guise of boosting “fairness” and contestability.
D. Investment Deterrence
The DMA deters U.S. foreign direct investment in the European Union. The law likely lowers the expected returns on U.S. capital invested in EU digital markets by constraining profitable business models and imposing unpredictable regulatory costs. For instance, the law’s technology-sharing and data-access obligations constitute a form of forced technology transfer, requiring U.S. investors to surrender valuable intellectual assets as a condition for operating in Europe. Similarly, prohibitions of otherwise standard and often procompetitive business practices, such as favoring a firm’s own products and services,[12] ensure that targeted companies cannot enjoy the full benefits of their investments, including—but not limited to—efficiency-enhancing vertical integration.[13]
At a broader level, the DMA operates as an industrial-policy instrument aimed at advancing the EU’s “digital sovereignty” agenda. Its stated goal of reducing dependence on foreign technology providers translates in practice into the strategic reallocation of rents from globally competitive U.S. firms to European business users and domestic competitors.[14] This policy orientation distorts market incentives and discourages further U.S. investment in the European technology sector. It also risks triggering retaliatory trade measures or reciprocal restrictions on European investment in the United States, further undermining transatlantic economic cooperation.
E. Other Non-Market Policies and Practices: Favoring European Firms and Champions
The DMA exemplifies the EU’s broader shift toward non-market industrial policymaking in the digital sphere. EU officials have openly linked the legislation to Europe’s pursuit of “digital sovereignty”—a policy framework explicitly aimed at reducing reliance on non-European technology providers. The EU has blurred the line between competition policy and protectionism by using regulatory tools to advance industrial and strategic objectives.
This approach distorts global competition by penalizing foreign firms for their success, rather than remedying demonstrable market failures. It undermines commitments to technological neutrality and nondiscrimination under World Trade Organization (WTO) and Organisation for Economic Co-operation and Development (OECD) principles, while signaling to other jurisdictions that digital industrial policy can be pursued through selective regulation, rather than open competition.
Meanwhile, the EU has openly encouraged other countries, such as Brazil, to converge on DMA-style rules.[15] And, sure enough, a number of jurisdictions have already taken note and are following—or considering following—a similar path, targeting the same U.S.-based technology firms with heavy-handed, asymmetric regulations.[16] In this way, the DMA is likely to extend its reach—and the EU’s particular flavor of tech protectionism—well beyond its borders.
F. Recommendations
In substance and effect, the DMA represents a significant foreign trade barrier to U.S. exports of digital services and intellectual property, as well as to U.S. foreign direct investment. While framed as an instrument to foster “fairness” (whatever that may mean), its discriminatory structure, forced technology-transfer obligations, negation of U.S. companies’ legitimate investments efforts, and interference with cross-border data flows reveal a clear industrial policy intent. By selectively burdening U.S. firms under the pretext of promoting “fairness,” the EU has erected a new form of regulatory protectionism in digital markets—and one that is likely to be exported abroad. As such, it imposes restrictions on “Services” (Category 6) and “Investment” (Category 7), and implements “Other Non-Market Policies and Practices” (Category 11) that disadvantage U.S. companies.
The United States should recognize the DMA as a trade measure of concern under the National Trade Estimate process and raise these issues in bilateral and multilateral forums, including the U.S.–EU Trade and Technology Council and the WTO’s Technical Barriers to Trade and Services Committees. Doing so would help to ensure that U.S. firms receive nondiscriminatory treatment and that global digital markets remain open, competitive, and innovation-driven.
III. General Data Protection Regulation
The GDPR is a significant foreign trade barrier that distorts U.S. exports of goods and services and U.S. foreign direct investment. The regulation’s design and enforcement create substantial impediments that fall within several categories enumerated in the USTR’s request for comments.
Under “Services” (Category 6), the GDPR imposes “discriminatory or burdensome barriers to cross-border data flows” and “discriminatory practices affecting trade in digital products.” Its prescriptive rules on data processing and consent create “unreasonable restrictions on what services may be offered,” particularly for U.S. firms whose business models depend on data-driven services. Under “Investments” (Category 7), the GDPR’s high compliance costs, severe financial penalties, and the legal uncertainty surrounding its core provisions deter U.S. foreign direct investment. By increasing operational costs and reducing the expected return on investment, the GDPR discourages U.S. capital from entering the European digital market. In addition, under “Other Barriers” (Category 14), the regulation’s effects are cross-cutting, combining elements of services restrictions, investment deterrence, and anticompetitive market distortions (ACMDs) that justify its inclusion in this category for complex barriers.
The GDPR operates as a formidable non-tariff barrier. The regulation’s real-world economic consequences, the incentive structures it creates, and its effects on market efficiency reveal a system that, regardless of its stated objectives, systematically impedes U.S. commerce. The total economic harm to U.S. interests is estimated to be well in excess of $500 million annually.
A. The GDPR’s Architecture as a Non-Tariff Barrier
A regulation’s compliance costs can function as an implicit tax on economic activity. Notably, Mario Draghi, former president of the European Central Bank and former prime minister of Italy, wrote in the Financial Times:
The IMF estimates that Europe’s internal barriers are equivalent to a tariff of 45 per cent for manufacturing and 110 per cent for services. These effectively shrink the market in which European companies operate: trade across EU countries is less than half the level of trade across US states. And as activity shifts more towards services, their overall drag on growth becomes worse.[17]
When these costs are substantial and disproportionately burdensome on foreign entities, they become a potent non-tariff barrier. The GDPR imposes such a burden on U.S. businesses, creating a financial impediment to operating within the EU market. For example, the Computer & Communications Industry Association estimates the GDPR costs the five largest U.S. providers of online digital services a total of more than $55 million annually.[18]
Beyond these direct outlays, the GDPR imposes indirect costs that reduce productivity and distort resource allocation. A study published by the Centre for Economic Policy Research found that the GDPR caused an average 8.1% drop in profits and a 2.2% decline in sales for affected businesses.[19] The larger effect on profits than on sales indicates that the primary driver of this economic harm is the weight of compliance costs, not a reduction in consumer demand.6
The regulation has also altered the production function for data-driven businesses. A study using seven years of data from a global cloud-computing provider—conducted by researchers that included Mert Demirer of MIT—found that the GDPR effectively increased the cost of data as a production input by approximately 20%.[20] In response, EU-based firms—and U.S. firms serving them—decreased their data storage by 26% and their data processing by 15%. This regulatory friction causes firms to become less data-intensive and, therefore, less efficient. For the United States, whose firms are global leaders in using data for economic value, this functions as a tax on a primary source of competitive advantage.
The GDPR’s “one-size-fits-all” approach, which applies a single set of complex rules regardless of firm size, imposes a regressive burden. The high fixed costs of compliance are disproportionately harmful to smaller U.S. enterprises. Giorgio Presidente and Carl Benedikt Frey found that, behind the 8% average drop in profits, there was a more severe effect for smaller companies. In the IT sector, large firms saw a 4.6% profit drop, while small IT firms suffered a 12.1% drop.[21] This regressive cost structure creates a formidable barrier to entry. U.S. startups and small and medium-sized enterprises (SMEs) must either absorb costs that cripple their profitability or forego the EU market entirely, as noted in Antitrust Source:
Investors, also, may face new uncertainties, information acquisition hurdles, and due diligence costs pertaining to venture deals in the EU due to the introduction of the GDPR. Moreover, those costs may be particularly pronounced for investors who are not based in the EU and are less familiar and less able to monitor ongoing and shifting aspects of compliance and potential enforcement. Investors also face the risks that the value of their investments may diminish if, for instance, an expansion to the EU is put off due to compliance costs, or a funded firm’s assets are less valuable due to limitations on the collection and processing of data.[22]
B. Market Distortions and Disincentives for Innovation
The GDPR’s regulatory design actively distorts the digital economy’s competitive landscape. Its operational requirements create inefficient market outcomes by stifling competition and creating disincentives for innovation. These effects systematically disadvantage the dynamic, data-driven business models in which U.S. firms are global leaders.
The regulation’s rules on data collection—particularly its consent requirements—favor large, established platforms over smaller challengers. Large, vertically integrated platforms with diverse, consumer-facing services are better positioned to obtain broad, bundled user consent across their ecosystems.[23] A user interacting with multiple services from a single provider is more likely to provide sweeping consent than a user interacting with multiple, smaller providers. This dynamic creates a data-collection advantage for incumbents. Empirical research has documented that, in the wake of the GDPR, market concentration increased among web technology vendors, with Google and Meta-owned vendors increasing their relative market share.[24]
Furthermore, large platforms can use the GDPR to justify restricting rivals’ access to data and interoperability, effectively using the regulation as a competitive “weapon.”[25] Such “weaponization” of privacy undermines the contestability of digital markets, harming U.S. firms that often rely on access to platform data to offer complementary services. As John Yun has noted, while the GDPR aims to bolster user privacy, empirical evidence suggests it has also triggered adverse effects, including diminished startup activity and increased market concentration.[26]
The GDPR’s restrictive approach to data processing, combined with its legal ambiguity, acts as a drag on innovation, particularly in data-intensive sectors like artificial intelligence (AI). Economic studies show that venture-capital funding for data-related ventures in the EU fell significantly after the GDPR’s implementation.[27] This lack of investment translates into fewer new companies and less innovation. The regulation’s burdens have also led to market contraction. One study of the Google Play Store found that the GDPR induced the exit of approximately one third of available apps, and that the entry of new apps fell by half following the regulation’s implementation.[28] This signals that the regulatory burden is deterring developers, particularly smaller U.S. software firms, from serving the EU market.
The barriers are particularly acute for the development of AI. Core GDPR principles, such as purpose limitation and data minimization, are in tension with the foundational needs of machine learning, which often requires large, diverse datasets for training.[29] The legal uncertainty surrounding the re-use of data for AI training creates risks for U.S. innovators. Mikołaj Barczentewicz reports that some activists advocate interpreting the GDPR to effectively prohibit some AI research and business applications altogether.[30] Such uncertainty forces firms to either avoid using EU data for training or to adopt overly cautious approaches that limit the effectiveness of their AI models.
C. Systemic Legal Uncertainty in Transatlantic Data Transfers
The GDPR functions as a trade barrier by creating systemic legal uncertainty surrounding the transfer of personal data from the EU to the United States. This chronic instability chills commerce and deters investment.
A series of decisions by the Court of Justice of the European Union (CJEU), stemming from complaints brought by privacy activist Max Schrems, has dismantled the legal architecture for transatlantic data flows. The rulings in Schrems I (2015) and Schrems II (2020) invalidated the “Safe Harbor” and “Privacy Shield” frameworks, respectively.[31] The CJEU’s reasoning in both cases was that U.S. national-security surveillance laws do not provide EU citizens with a level of data protection and judicial redress that is “essentially equivalent” to the rights guaranteed under EU law.
The economic disruption caused by these invalidations was immediate, creating “legal uncertainty for thousands of companies.”[32] U.S. firms were forced to use alternative, more complex transfer mechanisms—primarily Standard Contractual Clauses (SCCs). The Schrems II decision compounded this problem by casting doubt on the validity of SCCs themselves, imposing an obligation on data exporters to conduct a case-by-case assessment of the recipient country’s laws and to implement undefined “supplementary measures.”[33] This created significant operational complexity and regulatory risk for U.S. firms.18
The successor mechanism—the EU-U.S. Data Privacy Framework (DPF), which entered into force in 2023—is built on a precarious legal foundation. Critics argue that the DPF fails to resolve the fundamental conflict between U.S. surveillance law and the CJEU’s “essential equivalence” standard.[34] Legal challenges to the DPF are already underway, and there is a possibility that the framework will be struck down.[35]
This state of perpetual legal jeopardy is a potent economic barrier. The instability of transfer mechanisms raises the risk premium for any U.S. firm doing business with Europe. Companies must invest in continuous legal analysis and contingency planning for the next framework’s collapse, diverting capital from productive activities.[36] The constant threat of a court decision severing data flows makes long-term investment in data-dependent services in the EU an unacceptably risky proposition.
While the EU has not imposed an explicit data-localization mandate, its legal approach creates a powerful de facto incentive for that outcome. For a risk-averse U.S. company, the only safe option is to avoid transferring personal data out of the EU altogether, requiring the construction of duplicative and economically inefficient data infrastructure within the EU’s borders. This outcome is functionally identical to a formal data-localization requirement, a practice recognized by the USTR as a significant barrier to trade in digital services.
D. Discretionary Enforcement and Punitive Sanctions
The final pillar of the GDPR’s architecture as a trade barrier is its enforcement regime. Characterized by vague legal standards, broad regulatory discretion, and punitive sanctions, the regime creates a hostile and uncertain environment for U.S. firms.
The GDPR’s penalty structure has been applied aggressively, with U.S. technology firms the primary targets of the most significant enforcement actions. Since 2018, EU data-protection authorities (DPAs) have issued billions of euros in fines. The record-breaking €1.2 billion fine against Meta in 2023 for its transatlantic data transfers is the largest GDPR fine ever issued.[37] This is part of a pattern that includes a €390 million fine against Meta for its legal basis for advertising and a €310 million fine against LinkedIn. The GDPR empowers authorities to levy fines of up to 4% of a company’s total global annual .[38] This mechanism creates a disproportionate economic threat for large, global U.S. firms, turning any potential compliance issue into a significant financial risk.
Major enforcement actions are frequently based not on clear-cut violations, but on broad, ambiguous principles, granting EU DPAs immense discretion. The €1.2 billion Meta data-transfer fine was based on a violation of Article 46(1) GDPR. The Irish DPA, at the direction of the European Data Protection Board (EDPB), asserted that Meta’s use of SCCs could not overcome the systemic risks posed by U.S. surveillance law. In effect, the decision punished a U.S. company for the perceived shortcomings of the U.S. legal system, a factor outside the company’s control. In the €390 million Meta advertising case, the DPC found that Meta could not rely on “contractual necessity” under Article 6(1)(b) as a legal basis for processing user data for personalized advertising. This decision was contested among EU regulators and overturned the DPC’s own initial view, showing the lack of legal certainty for core business models.[39]
The legal interpretations underlying these actions reflect a regulatory philosophy of “privacy absolutism.” As Mikołaj Barczentewicz has argued, this approach elevates a maximalist interpretation of data protection above other principles, such as economic efficiency and regulatory proportionality.[40] This system, which combines vaguely worded legal principles with the discretionary power to impose massive fines, is ripe for arbitrary enforcement. The evidence shows that this power is disproportionately targeted at high-profile U.S. technology firms, often based on novel interpretations of these vague principles. This transforms the GDPR from a predictable set of rules into a tool that can be wielded to achieve unstated industrial-policy goals, creating a powerful deterrent to U.S. investment and trade.
E. Recommendations
We recommend the USTR formally designate the GDPR as a “Significant Foreign Trade Barrier” in the 2026 National Trade Estimate Report, under the categories of “Services” (Category 6), “Investment” (Category 7), and “Other Non-Market Policies and Practices” (Category 11).
Following this designation, the USTR should initiate high-level engagement with the European Commission to address the specific economic distortions identified. These diplomatic efforts should seek to establish a durable and predictable legal mechanism for EU-U.S. data transfers that can withstand judicial scrutiny and provide the long-term stability needed to support U.S. exports and investment. The USTR should also promote a more risk-based and proportionate approach to GDPR enforcement, advocating for greater legal certainty and nondiscriminatory application of sanctions.
Finally, engagement should address the anticompetitive effects of the GDPR’s design by advocating for interpretations that lower barriers to entry for SMEs and foster a more dynamic and competitive digital single market open to U.S. firms.
IV. Artificial Intelligence Act
The EU’s AI Act constitutes a substantial foreign barrier to U.S. exports of goods and services and U.S. foreign direct investment.[41] This barrier manifests across multiple categories identified in the USTR’s request for comments, including “Technical Barriers to Trade” (Category 2), “Services” (Category 6), Investment (Category 7), and “Anticompetitive Practices” (Category 9).
The AI Act’s regulatory architecture imposes costs on U.S. firms that are substantial in magnitude and poorly calibrated to demonstrated harms. The framework operates through three mechanisms: (1) imposing fixed compliance costs that function as barriers to market entry; (2) creating legal uncertainty that deters investment; and (3) extending EU regulatory jurisdiction extraterritorially to transactions occurring entirely outside EU borders.
A. Fixed Compliance Costs as Market-Entry Barriers
The AI Act requires providers of “high-risk AI systems” to implement extensive compliance infrastructure before placing products on the EU market. Article 9 mandates continuous risk-management systems. Article 10 requires data-governance frameworks that meet specific technical criteria. Article 11 demands detailed technical documentation. Articles 13-15 impose transparency, human-oversight, and technical-performance obligations.
These requirements generate substantial fixed costs that must be incurred regardless of a firm’s EU market scale. The Computer & Communications Industry Association estimates the AI Act will cost large providers of online digital services an average of $15.2 million annually per firm.[42] For small firms, estimates suggest compliance costs of up to €400,000 per high-risk AI system.[43] Other estimates indicate that compliance costs could account for 15-20% of R&D budgets for SMEs.[44]
The European Commission initially projected that 5-15% of AI systems would be classified as high-risk.[45] Recent surveys of AI developers suggest the actual figure is 33-50%.[46] This gap between projected and realized regulatory scope indicates massive underestimation of the act’s economic footprint and trade effects.
Fixed costs create market power by raising minimum efficient scale. For U.S. startups and SMEs, which disproportionately drive AI innovation, these costs would likely exceed expected EU revenue, effectively foreclosing market entry. Large incumbent firms spread compliance costs across larger revenue bases, reducing per-unit costs. While the AI Act includes provisions intended to support SMEs, such as prioritized access to regulatory sandboxes and proportional conformity-assessment fees, these measures are unlikely to offset the immense structural burden of the “high-risk AI systems” (HRAIS) compliance regime. By creating such high hurdles for market entry, the act insulates incumbent EU-based firms from competition from innovative U.S. challengers.
B. Extraterritorial Jurisdiction and Services Trade
Article 2(1)(c) extends the AI Act’s scope to “providers and deployers of AI systems that are located in a third country, where the output produced by the AI system is used in the Union.” This “output-based” jurisdiction represents a significant expansion of regulatory reach that directly restricts U.S. exports of digital services.
A U.S. financial-services firm using a proprietary AI model in New York to generate risk assessments for an EU client becomes subject to EU regulation because the assessment—the “output”—is used in the EU. A U.S. consulting firm using AI tools in Chicago to develop strategy recommendations for an EU company faces identical requirements. A U.S. software company using AI-powered analytics internally to optimize supply chains that serve EU customers likewise must comply with the act.
This jurisdictional approach transforms ordinary cross-border service provision into a regulated activity. U.S. service exporters face costly choices: develop parallel EU-compliant versions of internal processes, accept legal risk of noncompliance, or exit the EU market. Each option imposes costs. Creating parallel systems eliminates economies of scale. Accepting legal risk increases the cost of capital. Market exit represents foregone revenue.
Services represent approximately 35% of total U.S. exports.[47] The European Center for International Political Economy reports that U.S. exports of information and communications technology (ICT) services to the EU have exceeded $220 billion in recent years.[48] The AI Act’s extraterritorial reach subjects significant portions of these services exports to novel compliance requirements and legal risks.
C. Technical Barriers to Trade
The AI Act establishes a significant set of technical barriers that will disproportionately affect U.S. firms. The regulation creates a costly, restrictive framework for U.S. AI exporters through its provisions on conformity assessment, standards development, and data governance.
1. Conformity assessment as gatekeeping
Articles 43 and Annexes VI-VII establish conformity-assessment regimes that AI system providers must complete before placing products on the EU market. For certain high-risk systems, assessment requires the involvement of third-party “notified bodies” designated by EU member states.
This ex-ante requirement delays market entry and imposes costs disproportionate to any feasible risk-reduction benefits. The WTO Technical Barriers to Trade Agreement, Article 5.1.2, requires that conformity-assessment procedures “not be stricter than necessary.”[49] The AI Act’s framework inverts this standard by applying uniform, stringent assessment requirements based on system classification, rather than actual risk.
Delays to market entry translate directly into foregone revenue. In technology markets characterized by rapid obsolescence and network effects, delay often determines market success. A U.S. firm spending six months navigating conformity assessment while competitors launch immediately faces more than lost sales—it may lose the market permanently if competitors establish network effects during that period.
2. Harmonized standards and procedural exclusion
Article 40 directs the European Commission to request European standardization organizations (ESOs)—specifically, the European Committee for Standardization (CEN), the European Committee for Electrotechnical Standardization (CENELEC), and the European Telecommunications Standards Institute (ETSI)—to develop “harmonized standards” for AI systems. Article 41 grants “presumption of conformity” to AI systems that comply with these standards, creating powerful incentives for adherence.
ESOs develop standards through technical committees composed of experts nominated by EU member states’ national standards bodies. While international standards organizations like the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) include U.S. representatives with voting rights, the ESO process provides no such direct participation to non-EU stakeholders. U.S. firms and U.S.-based standards-development organizations (SDOs) may observe or comment but cannot vote on the adoption of standards.
This procedural structure creates the risk of standards-based protectionism. Standards that appear neutral can advantage domestic producers if they codify approaches or technical architectures common in one market but not another. A harmonized standard specifying particular data structures, software architectures, or testing methodologies familiar to EU developers but foreign to U.S. developers imposes differential compliance costs that advantage EU firms without explicit discrimination.
3. Prescriptive data requirements
Article 10 of the AI Act requires that training, validation, and testing datasets be “relevant, sufficiently representative, and to the best extent possible, free of errors and complete.” These requirements are not performance standards, which would allow firms to choose optimal compliance methods. They are, instead, input mandates that specify the characteristics of data that may be used in development.
The requirements are vague, subjective, and unrealistic, restricting access to usable data and slowing product development. The act’s goal of eliminating bias completely has been deemed technologically unattainable, even for leading AI firms.[50] Additionally, extensive logging and traceability mandates increase compliance costs, privacy risks, and operational complexity, particularly given the opaque nature of large language models (LLMs). U.S. firms have pioneered novel approaches to bias mitigation or data efficiency that do not conform to Article 10’s prescriptive requirements and therefore face regulatory barriers, regardless of their technical merit.
D. Investment Deterrence
A U.S. firm considering whether to establish an AI development facility in the EU must compare expected returns to alternative investment locations. The AI Act raises the costs of EU operations through required risk-management systems, data-governance infrastructure, documentation processes, and conformity assessments. All these costs are specific to EU operations. A firm conducting identical AI research in the United States, Japan, or other jurisdictions faces no comparable burden. At a 10% discount rate, the estimated $15.2 million annual compliance cost has a present value of $152 million—potentially three times an initial capital investment. This dramatically reduces investment returns and causes capital to flow elsewhere. That’s because investment decisions under uncertainty create option value for delay. When regulatory uncertainty is high, the option value of waiting increases, causing firms to delay or abandon investments, even when the expected net present value is positive.[51]
The AI Act creates multiple sources of legal uncertainty. The definition of “high-risk” systems depends on Annex III categories that are broad and subject to updating through delegated acts. Whether specific AI systems qualify as “general purpose AI,” thereby triggering additional requirements under Articles 51-56, depends on assessments of “significant impact” that will be refined through not-yet-adopted implementing regulations. The liability regime for AI-caused harm remains unresolved following the European Commission’s withdrawal of its proposed AI Liability Directive in October 2024.
Article 99 establishes administrative fines for noncompliance. Placing prohibited AI systems on the EU market triggers fines of up to €35 million, or 7% of total worldwide annual turnover, whichever is higher. For large U.S. technology firms with annual revenues that exceed $100 billion, the 7% turnover penalty represents potential liability of more than $7 billion per violation.
This penalty structure creates asymmetry between U.S. and EU firms. The “worldwide turnover” basis means large U.S. firms with substantial global operations face far larger absolute penalties than EU firms of comparable size operating primarily within Europe. This differential penalty burden advantages EU-headquartered competitors.
E. Regulatory Fragmentation
The AI Act represents an attempt to exercise what Anu Bradford of Columbia Law School has termed the “Brussels Effect”—the EU’s strategy of leveraging its large internal market to set de facto global regulatory standards.[52] This effect is failing with respect to AI regulation. The United Kingdom, Japan, Singapore, and the United States have explicitly rejected the EU’s prescriptive, rights-based approach in favor of alternative models that emphasize flexibility, sectoral regulation, and voluntary frameworks.
This regulatory divergence creates trade barriers through fragmentation. U.S. firms seeking to operate globally must develop and maintain compliance systems for multiple, inconsistent regulatory regimes. Rather than creating a unified global standard that reduces compliance costs through harmonization, the Act is producing a fragmented regulatory landscape that multiplies compliance costs and creates barriers to international commerce.
F. Quantifying the Trade Barrier
The available evidence suggests the AI Act’s impact on U.S. exports likely falls into USTR’s highest category: more than $500 million annually. This estimate derives from multiple components. Direct compliance costs for at least 30 major U.S. technology companies with substantial EU AI business exceed $450 million annually. Foregone revenue from delayed launches of Apple Intelligence, Google Gemini, and Meta AI features represents additional hundreds of millions. Lost sales from market exit by smaller U.S. firms, reduced foreign direct investment, and suppressed innovation all compound these effects.
G. Recommendations
The USTR should formally identify the EU AI Act in the 2026 National Trade Estimate Report as a significant foreign barrier affecting U.S. exports and investment under Categories 2, 6, 7, and 9.
The United States should pursue bilateral engagement through the U.S.-EU Trade and Technology Council with specific objectives: (1) negotiate mutual recognition of conformity assessments conducted according to U.S. standards, particularly the National Institute of Standards and Technology (NIST) AI Risk Management Framework procedures; (2) secure direct voting rights for U.S. stakeholders in ESO technical committees developing harmonized standards; (3) urge modification of Article 2(1)(c) to limit extraterritorial jurisdiction to AI systems specifically targeted at the EU market; and (4) advocate for revising prescriptive requirements like Article 10 to performance-based standards that specify outcomes, rather than processes.
These recommendations aim to reduce trade friction while respecting legitimate regulatory objectives concerning AI safety and security.
V. Foreign Ownership Regulations
Regulation (EU) 2019/452, establishing a framework for screening foreign direct investment into the European Union (FDI Regulation),[53] was adopted under the stated objective of protecting “security and public order.” In practice, however, it institutionalizes a permanent mechanism for political intervention in cross-border capital allocation, embedding the logic of “strategic autonomy” into what had previously been an open and integrated internal market.
To be clear, the FDI Regulation does not create a centralized EU screening authority. Instead, it establishes a cooperation mechanism through which the European Commission and member states exchange information and issue nonbinding opinions on individual transactions. Formally, member states retain full sovereignty over whether to screen investments and how to conduct such reviews. Yet the regulation’s design and subsequent implementation have had profound and unintended consequences: it has encouraged the proliferation and expansion of national screening mechanisms, extended the scope of “security” into broad categories of technology and infrastructure, and thereby raised the transaction costs and uncertainty surrounding U.S. investment in the EU.
Ultimately, the framework functions less as a narrow national-security safeguard than as a structural non-tariff barrier to investment—one that distorts market signals, amplifies bureaucratic discretion, and provides a convenient channel for industrial-policy objectives under the guise of “security.”
A. De Facto Expansion of Screening Mechanisms
The FDI Regulation creates an EU-level process for coordinating member-state screening mechanisms but does not harmonize substantive criteria. Member states “may maintain, amend or adopt mechanisms to screen foreign direct investments,” and the Regulation lists a non-exhaustive set of factors—such as control of critical infrastructure, access to sensitive information, or involvement in projects of EU interest—that may justify intervention.[54]
While the regulation is formally voluntary, its cooperative structure and reporting obligations have functioned as a strong incentive for adoption. Member states that lack screening regimes cannot meaningfully participate in the information-exchange process or respond to Commission inquiries. Once several large member states—notably Germany, France, and Italy—began operating comprehensive systems, others faced reputational and administrative pressure to follow suit, lest they be viewed as weak links in the EU’s economic-security chain.[55] This dynamic illustrates collective-action and path-dependence effects familiar in regulatory economics: once a coordination mechanism exists, the marginal political cost of adopting a regime falls, while the cost of abstention rises.
The result has been a near-complete diffusion of screening mechanisms across the EU. In 2018, only about a dozen member states maintained such regimes; by 2025, 26 of 27 had either adopted or substantially expanded them.[56] A procedural framework thus evolved into a de facto mandatory system, extending to sectors only tangentially related to national security, and imposing new layers of uncertainty and delay on cross-border investment.
B. Effects on Investment
By de facto replacing predictable, rules-based market access with open-ended administrative discretion, the FDI Regulation increases both the fixed and variable costs of foreign investment. Because “security or public order” is undefined, and varies from EU member state to member state, investors must evaluate potential exposure across 27 distinct national systems, each with different triggers, thresholds, and timelines. The expected value of an investment falls as both the probability and variance of regulatory delay rise. In effect, the regulation imposes an implicit entry tax on foreign investment, particularly in capital-intensive and time-sensitive sectors, where delay can destroy value.
Moreover, the extension of screening to technology and data-related sectors could create distortions in research collaboration and access to innovation funding. While evidence remains limited regarding the direct application of FDI screening to joint research ventures, the FDI Regulation’s scope explicitly extends to investments that involve EU projects and programs of “Union interest,” such as Horizon Europe.[57] This raises a credible risk that screening mechanisms could be used to scrutinize or constrain foreign participation in collaborative R&D initiatives. The possibility that foreign partners—particularly U.S. firms—might be subjected to review or additional administrative conditions introduces uncertainty and may discourage engagement in EU-funded research consortia.
The FDI Regulation also allows authorities to reexamine previously approved investments if new “security concerns” arise, creating an option for ex-post intervention that investors must price into their discount rates. This regulatory-risk premium raises the cost of capital, deters reinvestment, and diverts resources toward jurisdictions where the expected value of government noninterference is higher.
C. Non-Market Policies and Practices
The FDI Regulation’s implementation demonstrates how security rationales can be repurposed for industrial policy. EU institutions increasingly describe FDI screening as a tool to reduce “strategic dependencies” and, implicitly, to foster European champions.[58] This represents a shift from a market-based framework for capital allocation to one in which political discretion determines ownership patterns in key sectors. Such policies substitute bureaucratic decision making for market discovery, inviting rent seeking and protectionism and reducing consumer welfare.
Despite formal neutrality, the FDI Regulation has disproportionately affected U.S. investors. The European Commission’s own reporting suggests that most screened transactions in 2023 likely involve U.S. acquirers, given that the United States is the primary foreign investor in the EU and given that the United States accounted for 49% of total investments in semiconductors (an area considered sensitive).[59]
D. Caveats
To be sure, the FDI Regulation also incorporates several constructive elements. Prior to its adoption, member-state regimes were highly fragmented—varying widely in scope, procedure, and transparency. The regulation represents a step toward greater institutional coherence, introducing minimum procedural guarantees—such as transparency obligations, defined timelines, and access to judicial review—that help to reduce some of the transaction costs and legal uncertainty associated with purely national systems.[60] It also provides investors with a baseline degree of predictability by clarifying notification processes and information-exchange requirements across jurisdictions.
Moreover, the European Commission has recognized that excessive divergence among national mechanisms can itself act as a barrier to investment and has therefore announced plans to further harmonize screening rules within the union.[61] While these developments modestly improve legal certainty and procedural fairness, they also underscore the underlying tension of the EU’s current approach: the pursuit of uniformity and “strategic autonomy” simultaneously expands the administrative perimeter of investment control.
Paradoxically, therefore, the FDI Regulation seeks to manage the fallout of regulatory fragmentation that arises, to a significant degree, from its own existence. By effectively nudging member states to adopt FDI-screening mechanisms—while leaving the substance of screening in national hands—it is likely to engender a multiplicity of divergent rules and standards, potentially exacerbating legal uncertainty and discouraging investment by foreign firms, the majority of which are U.S.-based.
E. Recommendations
Though nominally adopted to protect “security and public order,” the FDI Regulation has, in practice, spurred the proliferation and expansion of national-screening mechanisms across nearly all EU member states. This dynamic functions as a structural non-tariff barrier, replacing rules-based market access with administrative discretion, which in turn raises transaction costs and creates significant regulatory uncertainty for U.S. investors. The USTR should therefore regard the framework as a potential non-tariff barrier to investment under “Investment” (Category 7) and “Other Non-Market Policies and Practices” (Category 11), as it uses “security” as a guise for industrial-policy objectives that distort market signals and deter U.S. capital. To mitigate its distortive effects, the USTR should:
- Urge the EU to encourage member states to narrow their definitions of “security and public order” to objectively verifiable and relatively uniform risks to defense, intelligence, or critical infrastructure.
- Advocate for binding procedural disciplines—clear timelines, transparency, and proportionality—to reduce uncertainty and limit rent seeking.
- Encourage differentiation between market-based and state-directed investors so that scrutiny targets genuinely nonmarket acquisitions, rather than U.S. commercial investment.
- Promote dialogue on proportionality and due process in FDI review to ensure that legitimate security objectives are pursued through narrowly tailored, evidence-based measures.
Member states properly retain the sovereign authority to screen foreign direct investment where genuine national-security interests are implicated. To the extent that the FDI Regulation establishes minimum standards of transparency, legal certainty, and procedural safeguards, it moves in the right direction. Nonetheless, the regulation has also catalyzed the proliferation of national screening mechanisms. Because competence over screening remains decentralized, and because member states continue to define “public order” and “security” according to their own policy preferences, the framework risks entrenching a fragmented and unpredictable regulatory landscape that deters efficient cross-border investment.
VI. Digital Services Taxes (DSTs)
Digital services taxes (DSTs) represent another significant and growing non-tariff trade barrier that disproportionately targets U.S. firms operating in the global digital economy. This barrier may be categorized within the “Other Barriers” category (Category 14) on the USTR’s request for comments.
DSTs are typically structured as a percentage of gross revenue derived from specific digital activities, rather than profits, rendering them highly discriminatory and economically distortive. They often fall most heavily on large, profitable U.S.-based technology companies, fostering an uneven playing field and shifting the cost of compliance and operation back to the origin country of innovation.
A core flaw of DSTs is their inherent bias against foreign (particularly U.S.) digital-service providers. Many DSTs are designed with revenue thresholds that effectively exempt domestic (and typically smaller) players, while capturing only the largest multinational corporations, which are predominantly American. This selective application creates an unfair competitive advantage for local firms and disincentivizes foreign investment. For example, a 2019 report highlighted how European DSTs, despite their broad rhetoric, would disproportionately affect U.S. companies due to their global scale and reliance on digital advertising and user data.[62]
Furthermore, DSTs contribute to significant economic inefficiencies and double taxation. By taxing gross revenue, rather than profits, DSTs fail to account for a given firm’s actual profitability or expenses, potentially imposing tax burdens even on firms operating at a loss. As early as 2018, the European Economic and Social Committee (EESC) expressed apprehension regarding the potential for adverse effects on smaller economies and nascent businesses, along with the heightened risk of double taxation.[63]
This departure from long-standing international tax principles creates overlapping tax claims and discourages investment in the digital sector. The lack of a harmonized international approach compels firms to navigate a complex patchwork of varying tax regimes and growing compliance costs and administrative burdens, as detailed by a PricewaterhouseCoopers analysis of the global landscape of DSTs.[64]
The unilateral implementation of DSTs also fundamentally undermines efforts toward a stable and predictable global tax framework. Despite ongoing multilateral efforts at the OECD to establish a consensus-based solution for taxing the digital economy (such as Pillars One and Two), several countries have proceeded with or maintained their own DSTs. This fragmentation risks trade retaliation (exemplified by U.S. Section 301 investigations into various DSTs), which threaten to escalate trade disputes and harm global economic cooperation.[65] As such, DSTs are not merely a revenue-raising tool but a protectionist measure that obstructs the free flow of digital services and capital, ultimately to the detriment of consumers and innovation worldwide.
VII. Pharmaceutical Pricing
ICLE has previously submitted comments to the USTR regarding foreign pharmaceutical-pricing practices that distort trade and erode U.S. firms’ incentives to innovate and shift the financial burden of pharmaceutical innovation disproportionately onto U.S. consumers.[66] This barrier may fit in the “Other Barriers” (Category 14) of the USTR’s request for comments.
Centralized-negotiation systems are a primary mechanism that foreign governments use to distort pharmaceutical pricing.[67] Nations operating national-health-care or single-payer models leverage their substantial buying power to negotiate or impose stringent price limits on medications.[68] Such centralized systems effectively establish monopsony conditions, confronting pharmaceutical companies with a single buyer that possesses overwhelming market power, and thereby eliminating competitive-pricing dynamics.
Biased health-technology assessments (HTAs) are another mechanism that suppress value-based prices abroad. In Germany, for instance, the Federal Joint Committee (G-BA) routinely refuses to recognize key surrogate or intermediate endpoints—such as progression-free survival or HbA1c—unless sponsors meet exceptionally strict criteria.[69] The United Kingdom’s National Institute for Health and Clinical Excellence (NICE) has maintained its £20k-£30k per “quality adjusted life year” threshold since 1999, despite cumulative UK inflation of approximately 90%.[70] Similarly, France’s Comité Économique des Produits de Santé routinely links new drugs to five-year volume contracts.[71] Once in-market sales reach the agreed cap, manufacturers face mandatory clawbacks that can range from 50–70% of “excess revenue.”[72] Moreover, these agencies often discount future health gains, thereby underweighting the decades-long cumulative benefits of curative or disease-modifying therapies.[73]
External-reference pricing (ERP) systems compound these distortions by systematically benchmarking pharmaceutical prices to suppress market values. These systems ensure foreign drug prices remain artificially low—significantly below what would naturally emerge under competitive market conditions.[74] For instance, Canada’s 2022 shift to the Patented Medicine Prices Review Board (PMPRB11) basket deliberately excluded the United States and Switzerland—its two highest-price peers—substituting them with six mid-priced OECD countries.[75] The Canadian Parliamentary Budget Officer estimates that adopting this slimmer benchmark would have reduced Canada’s 2018 spending on patented drugs by approximately 19%.[76]
South Korea’s “two-waiver” pathway presents an even more stark example: a drug must first be priced below the lowest figure among the A7 high-income comparators (which includes the United States). The subsequent National Health Insurance Service (NHIS) negotiation then references “OECD countries other than A7,” explicitly omitting U.S. prices and locking Korean ceilings well below other advanced-economy levels.[77] Such ERP creates a “race to the bottom” effect, where artificially suppressed prices in one jurisdiction become the ceiling for pricing in others, further entrenching below-market pricing globally
Though foreign governments may claim legitimate cost-containment objectives, pricing systems that refuse to internalize any meaningful portion of innovation costs, while free riding on the benefits of U.S.-funded medical breakthroughs, constitute a massive scheme of industrial policy and subsidization. Indeed, in effect, the entire financial burden of global pharmaceutical development is shifted to U.S. patients.
The key test for distinguishing legitimate regulation from trade distortion would be to focus on whether pricing policies create barriers to U.S. market access and fair competition that extend beyond legitimate regulatory objectives. Typically, these policies constitute ACMDs that systematically prevent U.S. pharmaceutical companies from competing on equal terms, shift competitive burdens disproportionately to foreign markets, or create artificial advantages for domestic competitors.
Addressing foreign pharmaceutical-pricing distortions requires surgical trade-policy responses that target specific discriminatory practices, while preserving the innovation ecosystem that benefits U.S. and global health outcomes. The path forward requires rejecting not only counterproductive retaliation but also counterproductive domestic policies, and to instead pursue targeted international remedies. Rejecting most-favored nation (MFN) pricing for Medicaid, for instance, represents a critical policy imperative to avoid importing foreign distortions into the U.S. market. Implementing MFN pricing that benchmarks U.S. reimbursement rates to foreign prices would significantly undermine revenue streams critical to funding ongoing innovation. This would risk replication of Europe’s historical experience, where similar policies transformed the continent from the global leader in pharmaceutical innovation in the 1970s to its current marginal role.
Instead, policymakers should target specific distortions through calibrated trade remedies, including ACMD tariffication, bilateral negotiations with binding enforcement mechanisms, and multilateral coordination that addresses documented competitive harms without disrupting beneficial trade relationships.
VIII. Draft Cybersecurity Rules
The European Union’s (EU) proposed Cybersecurity Certification Scheme for Cloud Services (EUCS) is a proposed regulatory instrument currently under development that purports to harmonize technical security standards for cloud computing across the EU’s Digital Single Market. The scheme, in development by the European Union Agency for Cybersecurity (ENISA) under the authority of the 2019 EU Cybersecurity Act,[78] has progressively incorporated non-technical, nationality-based criteria that function as significant barriers to U.S. exports of goods and services and U.S. foreign direct investment.[79] These provisions, often grouped under the political objective of achieving “digital sovereignty,” repurpose a technical certification framework into a tool of industrial policy designed to alter market outcomes in favor of domestic European firms.[80]
ICLE scholars have previously cautioned that this conflation of security with protectionism risks erecting digital barriers between the EU and its democratic allies, including the United States.[81] The requirements for data localization, EU-based corporate headquarters and ownership, and immunity from non-EU laws are overtly discriminatory. They create substantial hurdles for U.S. firms, which currently hold a dominant share of the EU cloud market, and are inconsistent with the EU’s commitments under international trade law.
The EUCS was originally conceived to replace a fragmented landscape of national certification schemes with a unified, EU-wide framework. Early drafts from 2020 and 2021 focused on establishing a baseline of technical security requirements organized around three assurance levels—“basic,” “substantial,” and “high”—which corresponded to the level of risk associated with a cloud service’s intended use.[82] This initial direction was consistent with international standards and industry best practices.
The scheme’s trajectory shifted following a push by the European Commission and a bloc of member states—including France, Italy, and Spain—to embed the political doctrine of “digital sovereignty” into its requirements. This doctrine reflects a stated European objective to reduce technological dependence on non-EU countries and insulate European data from the extraterritorial jurisdiction of foreign laws, such as the U.S. Clarifying Lawful Overseas Use of Data (CLOUD) Act.[83] Consequently, later drafts of the EUCS introduced non-technical criteria modeled on France’s highly restrictive national SecNumCloud regime.[84] These criteria include mandates that, for the highest assurance levels, data must be stored and processed exclusively within the EU; that cloud-service providers must be headquartered and owned by EU entities; and that CSPs must demonstrate immunity from non-EU legal jurisdictions.[85]
This evolution was contentious within the EU. A coalition of more trade-oriented member states—including Denmark, Estonia, Greece, Ireland, the Netherlands, Poland, and Sweden—expressed strong concerns that these requirements were political, did not enhance cybersecurity, and were inserted into a technical standard without proper debate.[86] ENISA itself reportedly did not see the need for such sovereignty requirements, viewing them as insufficiently grounded in genuine cybersecurity needs, but ultimately included them at the European Commission’s request.[87]
While the EUCS is officially designated a “voluntary” scheme,[88] this description is misleading.[89] The EU’s Network and Information Security Directive (NIS2)[90] grants member states and the European Commission authority to mandate the use of certified services for a wide range of “essential” and “important” entities.[91] These entities span critical sectors of the European economy, including finance, health care, and energy—all of which must require cloud services certified at the highest assurance levels.[92] It is at these levels that the most discriminatory sovereignty requirements are concentrated. This regulatory mechanism effectively transforms a nominally voluntary scheme into a tool for market foreclosure, creating a protected submarket from which U.S. providers will be excluded.
A. Economic Inefficiency and Protectionist Consequences
From an economic perspective, the EUCS’ sovereignty requirements would be inefficient and would impose significant costs on the European economy. The policy of data localization, which requires data to be stored and processed within a country’s borders, is fundamentally at odds with the economic model of cloud computing.[93] Cloud services derive their efficiency from economies of scale achieved by pooling computing resources and managing data across a distributed global network. Localization fragments this model, forcing the costly duplication of infrastructure like data centers and specialized personnel in multiple jurisdictions.[94] Studies show that such measures increase costs for businesses, particularly SMEs, which are then passed on to consumers.[95]
By excluding or disadvantaging the world’s leading cloud-service providers, the EUCS will reduce competition and innovation in the European market. The European cloud market is a high-growth sector, valued at $185 billion in 2024 and projected to be nearly $590 billion by 2030.[96] U.S.-based providers such as Amazon Web Services, Microsoft Azure, and Google Cloud collectively hold a market share of approximately 70%.[97] This position was achieved through technological leadership and sustained investment. Indeed, U.S. providers invest more than €10 billion each quarter in European capital expenditure.[98]
In contrast, the market share of European cloud-service provides has fallen from 29% in 2017 to 15% in 2022, where it has remained stagnant.[99] Denying European businesses full access to the most advanced and cost-effective global services limits their choices and forces them to rely on a smaller pool of less competitive domestic providers. This protectionist environment reduces the pressure for local firms to innovate and improve efficiency.
The economic damage of such exclusionary policies is quantifiable. An economic analysis by Matthias Bauer and Philipp Lamprecht calculated that, under a maximalist approach to data localization as promoted by the French government, the EU’s annual GDP could fall by as much as 3.9% within two years of implementation, accounting for lost and forgone cloud capacity and productivity growth.[100] They project annual EU GDP losses ranging from €29 billion to €610 billion, depending on the scope of sectors to which the highest assurance levels are applied.
The EUCS’ sovereignty requirements are also likely to weaken—rather than enhance—cybersecurity. Effective cybersecurity relies on the ability to detect and respond to threats in real time across a global network, sharing threat intelligence across borders and employing a 24/7 operational model. As Peter Swire and his co-authors have detailed, data localization fragments these integrated security systems, creating data silos that are more vulnerable to attack.[101] It prevents European customers from benefiting from the global threat visibility that only hyperscale providers can offer and may force them to use smaller local providers who cannot match the multi-billion-dollar annual security investments of their U.S. counterparts.[102]
B. EUCS Provisions as Specific US Trade Barriers
The sovereignty requirements in the EUCS would function as significant barriers to U.S. trade and investment, aligning with several categories of concern outlined in the USTR’s request for comments.
First, the provisions constitute “Technical Barriers to Trade” (Category 2). As currently drafted, the EUCS would impose “unnecessarily trade restrictive standards” and “technical regulations” that deviate from established international norms, such as the ISO/IEC 27000 series, to impose criteria based on nationality and geography. By mandating data localization, EU corporate headquarters, and EU ownership, the scheme would supplant global, risk-based standards with a bespoke “sovereignty” standard that, by design, only a narrow subset of EU-domiciled firms can meet. This is a misuse of the standards-setting process to achieve industrial-policy goals.
Second, the scheme would erect barriers to “Services” (Category 6). The mandate for a cloud-service provider to have its global headquarters in the EU to qualify for the highest assurance levels is a direct “local-presence requirement.” More restrictive is the requirement for “immunity from non-EU laws,” a standard that is legally impossible for any U.S. company to meet. U.S. firms are subject to U.S. laws, such as the CLOUD Act and the Foreign Intelligence Surveillance Act (FISA),[103] which establish legal processes for government authorities to request data, regardless of where that data is stored globally. A U.S. company cannot certify that it is “immune” to U.S. law without violating that law. This provision creates a legal paradox designed for the express purpose of disqualifying U.S. providers.
Third, the framework creates barriers to “Investment” (Category 7). The sovereignty provisions function as de facto “limitations on foreign equity participation” and can compel “technology transfer requirements.” To comply with the scheme’s highest assurance levels, a U.S. cloud-service provider would likely need to establish legally separate, EU-controlled joint ventures with European partners, thereby limiting foreign equity. Such arrangements often come with the requirement to share sensitive intellectual property and operational knowledge with the local partner, which is a form of forced technology transfer.
C. Inconsistency with WTO Commitments Under GATS
The EUCS’ sovereignty requirements would also place the EU in conflict with its legal commitments under the WTO’s General Agreement on Trade in Services (GATS). The measures violate GATS’ core principles of “National Treatment” and “Market Access.”
GATS Article XVII, the national-treatment obligation, requires each WTO member to accord to the services and service suppliers of any other member “treatment no less favorable than that it accords to its own like services and service suppliers” in sectors where commitments have been made. The EUCS fails this test. Cloud-computing services offered by U.S. and EU providers are “like services.” The EUCS accords “less favorable” treatment to U.S. suppliers by imposing requirements for an EU headquarters or “immunity” from non-EU laws. These criteria modify the conditions of competition to the detriment of U.S. suppliers based on their nationality and legal domicile, not on the quality or security of their service. An EU provider can qualify for the highest assurance levels while a U.S. provider offering an identical or superior service is disqualified, which is a clear violation of the national-treatment obligation.
GATS Article XVI, the market-access obligation, prohibits WTO members from maintaining certain types of market-access limitations, including “limitations on the number of service suppliers.” By making it legally and practically impossible for any non-EU firm to meet the criteria for the highest assurance levels, the EUCS effectively imposes a “zero quota” on foreign participation in that segment of the cloud market. WTO jurisprudence, as established in the U.S.—Gambling case,[104] has found that a complete prohibition on a particular mode of service supply constitutes a zero quota in violation of Article XVI. The EUCS achieves the same result through its discriminatory certification criteria.
The EU would likely be unable to justify these measures under the exceptions available in GATS Article XIV, which permit measures “necessary to protect public morals or to maintain public order.” The term “necessary” in WTO law requires that no less trade-restrictive alternative is reasonably available to achieve the same policy objective. In this case, numerous less restrictive alternatives exist to ensure an elevated level of cloud security, including a focus on robust technical controls, strong encryption standards, and rigorous third-party audits, all of which can be applied on a nondiscriminatory basis. Because these effective, nondiscriminatory alternatives exist, the EUCS’ nationality-based requirements are not “necessary.”
Furthermore, Article XIV requires that such measures not be applied in a manner that constitutes “a disguised restriction on international trade in services.” The protectionist intent and effect of the EUCS’ sovereignty requirements indicate they are a “disguised restriction on trade,” making a defense under Article XIV untenable.
The draft EUCS framework is not a legitimate, risk-based security measure. It is an economically inefficient and legally questionable policy that uses the pretext of cybersecurity to favor domestic firms at the expense of market-leading U.S. service providers. The scheme will raise costs for European consumers, reduce innovation, weaken cybersecurity, and place the EU in violation of its foundational commitments under GATS.
D. Recommendations
The USTR should engage with the European Commission immediately, before the EUCS is finalized, to advocate removing the nationality-based sovereignty requirements from the draft framework. The United States should emphasize that opposition to these provisions does not reflect opposition to rigorous cybersecurity standards but rather concern that geographic and ownership criteria are unrelated to genuine security risk and violate WTO commitments.
The primary objective should be alignment of the scheme with the ISO/IEC 27000 series standards and other established international cybersecurity frameworks that focus on technical security controls—such as encryption, access management, and audit mechanisms—rather than corporate domicile or ownership structure. The United States should propose that, where the EU maintains concerns about foreign government access to data, technical safeguards subject to objective conformity assessments provide superior security outcomes than do nationality-based restrictions. Early engagement offers the opportunity to influence the regulatory design before political commitments harden, and implementation investments are made.
The USTR should make clear that, if the EUCS is adopted with the discriminatory sovereignty requirements intact, the United States will designate the scheme as a significant foreign trade barrier in future National Trade Estimate Reports under “Technical Barriers to Trade” (Category 2), “Services” (Category 6), and “Investment” (Category 7). Such designation would be followed by formally raising concerns in the WTO Technical Barriers to Trade and Services Committees, and potentially by dispute-settlement consultations.
The United States should coordinate with other advanced economies whose cloud-service providers would face similar barriers under the draft scheme. Japan, South Korea, Canada, Australia, and other countries with significant technology sectors share U.S. interests in preventing the adoption of sovereignty-based certification frameworks. Joint representations to EU institutions during the finalization process would carry greater weight than unilateral complaints and may provide political cover for European officials seeking to resist member-state pressure for protectionist provisions.
IX. Draft Space Act
ICLE has submitted comments[105] to the U.S. Departments of State and Commerce in which we conclude that provisions of the proposed EU Space Act[106] would function as non-tariff barriers under WTO principles (Appendix A to these comments):
Our analysis concludes that the EU Space Act functions as a nontariff barrier (NTB) under World Trade Organization principles. In design and effect, it selectively targets U.S. large-constellation operators, imposing compliance burdens that are not proportionate to any demonstrated safety or sustainability benefits. The regulation’s structure and procedural mechanisms—most notably its size-based “giga-constellation” threshold, dual-track registration process, and extraterritorial inspection provisions—create discriminatory market-access barriers. These provisions are likely to harm both U.S. and EU economic welfare, slow the pace of innovation in the sector, and shift market share toward geopolitical competitors whose strategic objectives may run counter to transatlantic security interests.
In light of these findings, we recommend that the U.S. government treat the EU Space Act’s discriminatory provisions as nontariff barriers in trade negotiations with the European Union and, where appropriate, pursue remedies through the WTO Technical Barriers to Trade framework. At a minimum, U.S. policy should press for alignment of the EU Space Act with established international orbital safety standards, including those developed by the International Standards Organization, the Inter-Agency Space Debris Coordination Committee, NASA, and the Federal Communications Commission. Such alignment would reduce the risk of market fragmentation, provide regulatory certainty, and ensure that safety objectives are met without imposing unnecessary and discriminatory costs on foreign operators.
ICLE comments are directly responsive to the USTR’s request, as they specifically identify the proposed EU Space Act as a “significant foreign barrier.” The comments detail how the act creates “discriminatory market-access barriers,” aligning with the USTR’s interest in “Technical Barriers to Trade” (Category 2) and “Services” (Category 6) via “discriminatory licensing requirements or regulatory standards.”
Specific examples provided by ICLE, such as the “size-based ‘giga-constellation’ threshold” designed to exempt EU systems and a “dual-track registration process” that creates conflicts of interest, are precisely the types of distortions the USTR seeks to identify for the 2026 National Trade Estimate Report.
X. Conclusion and Recommendations
Our analysis above demonstrates that a concerning pattern of non-tariff trade barriers is emerging (or worsening, if we consider some longstanding trade barriers) from the European Union’s regulatory landscape, significantly impeding U.S. exports of goods and services and deterring U.S. foreign direct investment. From the DMA’s targeted obligations on U.S. gatekeepers to the GDPR’s restrictive data-processing rules, the EU AI Act’s onerous compliance costs, the EUCS’ protectionist cybersecurity mandates, the EU Space Act’s discriminatory satellite regulations, and EU member states’ pharmaceutical-pricing schemes, these policies collectively create a formidable array of challenges for U.S. firms. The FDI Regulation—officially adopted to protect “security and public order”—has, in practice, spurred highly discretionary and costly screening mechanisms across nearly all EU member states.
Regardless of their stated intent, these measures fundamentally distort market competition, erect regulatory hurdles, weaken intellectual-property protections, and shift the burdens of innovation and compliance disproportionately onto U.S. companies and consumers.
A recurring theme across these barriers is the EU’ embrace of goals like “sovereignty” or “fairness” as justifications for policies that are, in practice, highly protectionist. This approach deliberately blurs the lines between legitimate regulatory objectives and industrial policy, using technical standards, data governance, and investment screening as tools to favor domestic champions and reduce reliance on non-EU (primarily U.S.) technology providers. This institutional bias runs counter to the principles of technological neutrality and nondiscrimination that underpin the multilateral trading system, setting a dangerous precedent that encourages other jurisdictions to adopt similar economically harmful and discriminatory regimes.
The path forward requires a firm commitment to promoting free-trade principles and evidence-based regulation, rather than resorting to retaliatory tariffs that ultimately harm U.S. consumers and the broader U.S. economy. We recommend that the USTR actively engage in bilateral and multilateral fora to challenge these discriminatory practices. This includes advocating for narrowing overly broad definitions of indeterminate legal concepts such as “security” and “public order,” pressing for transparent and predictable regulatory processes, encouraging alignment with established international standards, and promoting policies that genuinely foster innovation and competition, rather than protect incumbents.
By systematically addressing these entrenched non-tariff barriers, the USTR can defend the interests of U.S. businesses and innovators, reinforce the integrity of the global trading system, and ensure that the digital economy and other advanced sectors remain arenas for open competition, innovation, and growth, rather than becoming fragmented by protectionist regulatory empires.
The USTR should formally designate the following measures as significant foreign trade barriers in the 2026 National Trade Estimate Report:
- Digital Markets Act: List under “Services” (Category 6), “Investment” (Category 7), and “Other Non-Market Policies and Practices” (Category 11). The designation should identify specific provisions that function as barriers, including the gatekeeper-designation criteria that disproportionately capture U.S. firms, forced interoperability and data-sharing obligations that appropriate intellectual property, prohibitions on self-preferencing that restrict service design, and data-processing fragmentation that impedes cross-border delivery.
- General Data Protection Regulation: List under “Services” (Category 6), “Investment” (Category 7), and “Other Barriers” (Category 14). The designation should emphasize the chronic legal uncertainty surrounding transatlantic data transfers following the Schrems I and Schrems II decisions, the regressive compliance-cost structure that forecloses market entry for U.S. SMEs, discriminatory enforcement patterns targeting U.S. firms for record penalties, and the regulation’s demonstrated effects of raising data costs and reducing business productivity.
- Artificial Intelligence Act: List under “Technical Barriers to Trade” (Category 2), “Services” (Category 6), “Investment” (Category 7), and “Anticompetitive Practices” (Category 9). The designation should highlight the regulation’s extraterritorial jurisdiction extending to outputs used in the EU, conformity-assessment requirements that delay market entry, prescriptive data-governance mandates that deviate from international standards, exclusion of U.S. stakeholders from European standardization processes, and penalty structure based on worldwide turnover that creates disproportionate liability for global U.S. firms.
- FDI Regulation: List under “Investment” (Category 7) and “Other Non-Market Policies and Practices” (Category 11). The designation should note the framework’s role in encouraging the proliferation of national screening mechanisms, expansion of “security” definitions to encompass broad technology and infrastructure categories and use as a tool to advance “strategic autonomy” industrial-policy objectives under a national-security pretext.
- Proposed Cybersecurity Certification Scheme: List under “Technical Barriers to Trade” (Category 2), “Services” (Category 6), and “Investment” (Category 7). The designation should identify the sovereignty requirements that mandate EU headquarters and ownership, immunity from non-EU-law provisions that create legally impossible conditions for U.S. firms, data-localization requirements that fragment cloud-computing efficiency, and mandatory certification for critical sectors that transforms a nominally voluntary framework into a market-foreclosure mechanism.
- Proposed Space Act: List under “Technical Barriers to Trade” (Category 2) and “Services” (Category 6). The designation should reference size-based constellation thresholds designed to exempt EU operators while capturing U.S. firms, dual-track registration processes creating conflicts of interest, and extraterritorial inspection provisions.
The USTR should pursue bilateral engagement through the U.S.-EU Trade and Technology Council with specific negotiating objectives for each designated barrier.
For the DMA, seek commitments that gatekeeper obligations will be applied only following case-specific findings of market power and demonstrable consumer harm, consistent with established antitrust principles. Negotiate the removal of asymmetric restrictions that compel data sharing, while prohibiting designated firms from using third-party data.
For the GDPR, establish durable transatlantic data-transfer mechanisms incorporating binding commitments that successor frameworks will not be subject to unilateral invalidation. Advocate for enforcement guidelines that establish objective criteria to limit discretion and ensure the nondiscriminatory application of penalties.
For the AI Act, negotiate mutual recognition of conformity assessments conducted according to NIST AI Risk Management Framework procedures. Secure direct voting rights for U.S. stakeholders in European standards organizations’ technical committees. Urge modification of Article 2(1)(c)’s extraterritorial jurisdiction provisions to limit application to AI systems specifically targeted at EU markets. Advocate for converting prescriptive input requirements into performance-based outcome standards.
For the EUCS, demand alignment with ISO/IEC 27000 series international standards and removal of nationality-based sovereignty criteria.
For the Space Act, press for alignment with International Standards Organization, Inter-Agency Space Debris Coordination Committee, NASA, and Federal Communications Commission (FCC) orbital-safety standards.
The USTR should raise these barriers in multilateral forums. File concerns with the Technical Barriers to Trade Committee regarding the AI Act’s conformity-assessment regime, the EUCS’ deviation from international cybersecurity standards, and the Space Act’s discriminatory constellation thresholds. Bring concerns to the Services Committee regarding GDPR data-transfer restrictions, DMA limitations on service design, and EUCS local-presence requirements. Consider requesting WTO dispute-settlement consultations on EUCS provisions that appear to violate GATS Articles XVI and XVII market-access and national-treatment obligations.
The United States should coordinate with like-minded trading partners facing similar barriers. Japan, South Korea, Singapore, Canada, and other advanced economies with significant technology sectors share U.S. interests in preventing proliferation of EU regulatory protectionism. Joint representations carry greater weight than unilateral complaints and reduce the risk that EU regulatory approaches will be adopted as de facto global standards.
The United States should not respond to these barriers through retaliatory tariffs or reciprocal regulatory restrictions. Such measures impose costs on U.S. consumers through higher prices and reduced choice, harm U.S. firms through supply-chain disruption, and undermine U.S. credibility when advocating for open markets and rules-based trade. The appropriate response combines formal trade-barrier designation, sustained bilateral and multilateral diplomatic engagement, and readiness to pursue dispute settlement where violations of international commitments are clear.
These recommendations aim to reduce trade friction and restore competitive neutrality, while respecting legitimate regulatory objectives. Where foreign governments pursue genuine public-interest goals through nondiscriminatory, proportionate, and evidence-based measures aligned with international standards, U.S. trade policy should acknowledge those objectives. Where regulatory frameworks systematically disadvantage U.S. firms through discriminatory design, vague standards that enable arbitrary enforcement, or explicit nationality-based criteria, trade policy should identify those practices as barriers and seek their removal through the appropriate channels.
[1] Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act), 2022 O.J. (L 265) 1.
[2] Gatekeepers—Digital Markets Act (DMA), Eur. Comm. (last visited Oct. 29, 2025), https://digital-markets-act.ec.europa.eu/gatekeepers_en.
[3] This has also been recognized by the USTR. See, e.g., 2025 National Trade Estimate Report on Foreign Trade Barriers, Off. U.S. Trade Rep. (Mar. 2025), at 154, available at https://ustr.gov/sites/default/files/files/Press/Reports/2025NTE.pdf. (“The ‘gatekeepers’ designated by the DMA disproportionately capture U.S. firms compared to their EU competitors, and therefore undermine U.S. competitiveness in the European market by increasing the compliance costs on certain U.S. firms while not placing a similar burden on EU competitors. The Commission is currently investigating U.S. firms and has imposed excessive fines for violating the DMA”).
[4] For a more thorough critique of the DMA, see, e.g., Lazar Radic, Geoffrey A. Manne, & Dirk Auer, Regulate for What? A Closer Look at the Rationale and Goals of Digital Competition Regulations, 22 Berkeley Bus. L.J. 1 (2025).
[5] The so-called DMA workshops illustrate the opaque and one-sided dynamics of DMA enforcement, in which companies are expected to anticipate when the Commission will deem a product-design decision “fair” and sufficiently conducive to “contestability.” See DMA Stakeholders Workshops, Digital Markets Act (DMA), Eur. Comm., https://digital-markets-act.ec.europa.eu/events/workshops_en (last visited Oct. 29, 2025).
[6] Mikołaj Barczentewicz, EU DMA Workshops: Google, Amazon, Apple, Meta, and Microsoft, EUTechReg (Jul. 8, 2025), https://eutechreg.com/p/eu-dma-workshops-google-amazon-apple.
[7] See Radic et al., supra note 4, at 213-227.
[8] See Barczentewicz, supra note 7.
[9] Giuseppe Colangelo, In Fairness We (Should Not) Trust: The Duplicity of the EU Competition Policy Mantra in Digital Markets, 68 Antitrust Bull. 669 (2023).
[10] See, e.g., Giuseppe Colangelo, Android Auto: The End of the Essential Facility Doctrine as We Know It, Kluwer Compet. Law Blog (Mar. 13, 2025), https://legalblogs.wolterskluwer.com/competition-blog/android-auto-the-end-of-the-essential-facility-doctrine-as-we-know-it.
[11] See Geoffrey A. Manne, Dirk Auer, Lazar Radic, & Selcukhan Ünekbas, Response of the International Center for Law & Economics: Consultation on the First Review of the Digital Markets Act, Int’l Ctr. Law & Econ. (Sep. 24, 2025), at 8-9 available at https://laweconcenter.org/wp-content/uploads/2025/09/ICLE-DMA-Consultation.pdf. (“An example is the interaction between the DMA and the Data Act, both of which contain data sharing rules. Read together, these measures contribute to what might be described as a policy of data immobility. The Data Act explicitly excludes gatekeepers from benefitting as recipients of data sharing… Even where transfers are permitted, the Data Act imposes a requirement that they be made on fair, reasonable, and non-discriminatory terms, including a prohibition on favourable treatment of affiliated enterprises. This reduces the attractiveness of intrafirm data transfers, effectively constraining data flows even within the same corporate group.”)
[12] For the argument that self-preferencing is not presumptively harmful, see Pablo Ibáñez Colomo, Self-Preferencing: Yet Another Epithet in Need of Limiting Principles, 43 World Compet. (4) 417 (2020). (arguing that self-preferencing is, in fact, a reflection of competition on the merits); see also Lazar Radic & Geoffrey A. Manne, Amazon Italy’s Efficiency Offense, Truth on the Mkt. (Jan. 11, 2022), https://truthonthemarket.com/2022/01/11/amazon-italys-efficiency-offense (arguing that there can be multiple procompetitive reasons why Amazon would choose to give preferential treatment to its own products or services).
[13] On the misguided notion—especially popular among regulators in the context of digital markets—that vertical integration should be presumed anticompetitive, see Geoffrey A. Manne, Against the Vertical Discrimination Presumption, Concurrences No. 2-2020, art. No. 94267 (May 2020), (“The problem, however, is that the claims of presumptive harm from vertical discrimination are based neither on sound economics nor evidence.”).
[14] See Radic et al., supra note 4, 243-249; see also Lazar Radic, Gatekeeping, the DMA, and the Future of Competition Regulation, Truth on the Mkt. (Nov. 8, 2023), https://truthonthemarket.com/2023/11/08/gatekeeping-the-dma-and-the-future-of-competition-regulation (“Prior to the DMA’s adoption, many leading European politicians were touting the text as a protectionist industrial-policy tool that would hinder U.S. firms to the benefit of European rivals. This logic dovetails neatly with the EU’s broader push for ‘technology sovereignty,’ a strategy intended to reduce the continent’s dependence on technologies that originate abroad (even if that means stifling the companies from its biggest ally: the United States).”).
[15] CADE and European Commission Discuss Collaboration on Digital Market Agenda, Conselho Administrativo de Defesa Econômica (Mar. 29, 2023), https://www.gov.br/cade/en/matters/news/cade-and-european-commission-discuss-collaboration-on-digital-market-agenda.
[16] These include Japan, Brazil, Turkey, Australia, India, South Africa, Vietnam, and South Korea, among others. Not all these countries, however, have adopted DMA-like rules. See Radic et al., supra note 4; see also Lazar Radic, Your Definitive End-of-Year Global Tech Regulation Wrap-Up: Who’s Doing What, Where, and What to Make of It, Truth on the Mkt. (Dec. 21, 2022), https://truthonthemarket.com/2022/12/21/your-definitive-end-of-year-global-tech-regulation-wrap-up-whos-doing-what-where-and-what-to-make-of-it.
[17] Mario Draghi, Forget the US—Europe Has Successfully Put Tariffs on Itself, Financ. Times (Feb. 14, 2025), https://www.ft.com/content/13a830ce-071a-477f-864c-e499ce9e6065.
[18] Carl J. Schramm, Costs to U.S. Companies from EU Digital Services Regulation, Comp. & Commcn’s Ind. Ass’n (Jul. 2025), available at https://ccianet.org/wp-content/uploads/2025/07/CCIA_Costs-to-US-Companies-from-EU-Digital-Services-Regulation_finalreport.pdf.
[19] Giorgio Presidente & Carl Benedikt Frey, The GDPR Effect: How Data Privacy Regulation Shaped Firm Performance Globally, VoxEU (Mar. 10, 2022), https://cepr.org/voxeu/columns/gdpr-effect-how-data-privacy-regulation-shaped-firm-performance-globally.
[20] Mert Demirer, Diego J. Jiménez Hernández, Dean Li, & Sida Peng, Data, Privacy Laws and Firm Production: Evidence from the GDPR (NBER Working Paper No. 32146, Dec. 2024), available at https://www.nber.org/system/files/working_papers/w32146/w32146.pdf.
[21] Presidente & Frey, supra note 19.
[22] Jian Jia , Ginger Zhe Jin, & Liad Wagman, The Persisting Effects of the EU General Data Protection Regulation on Technology Venture Investment, Antitrust Source (Jun. 2021), available at https://www.americanbar.org/content/dam/aba/publishing/antitrust-magazine-online/2021/june-2021/jun2021-jia.pdf.
[23] See Damien Geradin, Theano Karanikioti, & Dimitrios Katsifis, GDPR Myopia: How a Well-Intended Regulation Ended Up Favouring Large Online Platforms—the Case of Ad Tech, 17 Eur. Competition J. 47 (2020).
[24] Adam Thierer, GDPR & European Innovation Culture: What the Evidence Shows, Medium (Feb. 5, 2023), https://medium.com/@AdamThierer/gdrp-european-innovation-culture-what-the-economic-evidence-shows-b19d2309de07.
[25] Damien Geradin, Theano Karanikioti, & Dimitrios Katsifis, supra note 23, at 51 (2020) (“[L]arge online platforms are increasingly invoking the GDPR—or privacy concerns more generally—as an excuse to engage in controversial and potentially restrictive practices. This could be referred to as the “weaponization” of the GDPR and privacy.”).
[26] See John Yun, A Report Card on the Impact of Europe’s Privacy Regulation (GDPR) on Digital Markets, 31 Geo. Mason L. Rev. F. 104 (2024).
[27] See, e.g., Garrett Johnson, Economic Research on Privacy Regulation: Lessons from the GDPR and Beyond (NBER Working Paper No. 30705, Dec. 2022), available at https://www.nber.org/system/files/working_papers/w30705/w30705.pdf.
[28] Rebecca Janßen, Reinhold Kesler, Michael E. Kummer, & Joel Waldfogel, GDPR and the Lost Generation of Innovative Apps, (NBER Working Paper No. 30028, May 2022), available at https://www.nber.org/system/files/working_papers/w30028/w30028.pdf.
[29] Mikołaj Barczentewicz, Should the GDPR Prohibit AI?, Truth on the Mkt. (Nov. 5, 2024), https://truthonthemarket.com/2024/11/05/should-the-gdpr-prohibit-ai.
[30] Id.
[31] Maximillian Schrems v. Data Prot. Comm’r, Case C-362/14, ECLI:EU:C:2015:650 (Oct. 6, 2015) (“Shrems I”); Data Prot. Comm’r v. Facebook Ireland Ltd., Case C-311/18, ECLI:EU:C:2020:559 (July 16, 2020) (“Shrems II”).
[32] Frances M. Green, Adequacy of the EU–U.S. Data Privacy Framework Survives Challenge, Epstein Becker Green (Sep. 12, 2025), https://www.workforcebulletin.com/adequacy-of-the-eu-u-s-data-privacy-framework-survives-challenge.
[33] Vanessa Zimmer, Winter Is Here: The Impossibility of Schrems II for U.S.-Based Direct-to-Consumer Companies, 42 Nw. J. Int’l L. & Bus. 75 (2021).
[34] See Sergi Batlle & Arnaud van Waeyenberge, EU-US Data Privacy Framework: A First Legal Assessment, 15 Eur. J. Risk Reg. 191 (2024).
[35] See Mikołaj Barczentewicz, Schrems III: Gauging the Validity of the GDPR Adequacy Decision for the United States, Int’l Ctr. Law & Econ. (Sep. 25, 2023), available at https://laweconcenter.org/wp-content/uploads/2023/09/ICLE-Schrems-III_2023.09.21.pdf.
[36] Ross McKean, John Magee, & Rachel de Souza, DLA Piper GDPR Fines and Data Breach Survey: January 2025, DLA Piper (Jan. 2025), https://www.dlapiper.com/en-us/insights/publications/2025/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2025.
[37] CMR, GDPR Enforcement Tracker (retrieved Oct. 29, 2025), https://www.enforcementtracker.com.
[38] Regulation (EU) 2016/679, art. 83(5), 2016 O.J. (L 119) 1, 28.
[39] Rachel De Souza, EU & Ireland: Meta’s Legal Basis for Targeted Ads Found to Breach GDPR, DLA Piper (Jan. 10,2023), https://privacymatters.dlapiper.com/2023/01/eu-ireland-metas-legal-basis-for-targeted-ads-found-to-breach-gdpr.
[40] Mikołaj Barczentewicz, The EU’s GDPR “Fix” Misses the Point Entirely, Truth on the Mkt. (Jun. 24, 2025), https://truthonthemarket.com/2025/06/24/the-eus-gdpr-fix-misses-the-point-entirely.
[41] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 on Artificial Intelligence and amending Regulations (EC) No. 300/2008, (EU) No. 167/2013, (EU) No. 168/2013, (EU) 2018/858, (EU) 2018/1139, and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797, and (EU) 2020/1828, 2024 O.J. (L 206) 1 (EU).
[42] Schramm, supra note 18, at 39.
[43] Benjamin Mueller, How Much Will the Artificial Intelligence Act Cost Europe?, Ctr. for Data Innov. (Jul. 2021), available at https://www2.datainnovation.org/2021-aia-costs.pdf.
[44] Gideon Abako, It’s Too Hard for Small and Medium-Sized Businesses to Comply with the EU AI Act: Here’s What to Do, AI Pol’y Bull. (May 19, 2025), https://www.aipolicybulletin.org/articles/its-too-hard-for-small-and-medium-sized-businesses-to-comply-with-eu-ai-act-heres-what-to-do.
[45] Commission Staff Working Document, Impact Assessment Accompanying the Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts, Eur. Comm., SWD (2021) 84 final, at 68 (Apr. 21, 2021), https://ec.europa.eu/newsroom/dae/redirection/document/75792 (“[G]iven that in this option high-risk applications are based on exceptional circumstances, one could estimate that no more than 5% to 15% of all applications should be concerned by the requirements.”).
[46] Andreas Liebl & Till Klein, AI Act Impact: Survey Exploring the Impact of the AI Act on Startups in Europe, Init. for Applied Int’l Intelligence (Dec. 12, 2022), available at https://aai.frb.io/assets/files/AI-Act-Impact-Survey_Report_Dec12.2022.pdf.
[47] USITC Analyzes Market Conditions and Outlook for Professional Services in Annual Services Report, U.S. Int’l Trade Comm’n (Jul. 2, 2025), https://www.usitc.gov/keywords/services-trade.
[48] Matthias Bauer, Dyuti Pandya & Oscar du Roy, Openness as Strength: The Win-Win in EU-US Digital Services Trade, Eur. Ctr. for Int’l Pol. Econ. (Mar. 2024), https://ecipe.org/wp-content/uploads/2024/03/ECI_24_PolicyBrief_05-2024_LY03.pdf.
[49] Agreement on Technical Barriers to Trade, Apr. 15, 1994, Marrakesh Agreement Establishing the World Trade Organization, 1868 U.N.T.S. 120 (1994).
[50] Oliver Roberts, EU AI Act’s Burdensome Regulations Could Impair AI Innovation, Bloomberg Law (Feb. 21, 2025), https://news.bloomberglaw.com/us-law-week/eu-ai-acts-burdensome-regulations-could-impair-ai-innovation.
[51] See, e.g., Kenneth J. Arrow & Anthony C. Fisher, Environmental Preservation, Uncertainty, and Irreversibility, 88 Q. J. Econ. 312 (1974) (explaining that, when a decision is irreversible and future benefits and costs are uncertain, immediate action eliminates the opportunity to learn more before committing resources; by waiting, society retains an “option value,” i.e., the value of preserving flexibility to act later when uncertainty has been reduced).
[52] Anu Bradford, The Brussels Effect: How the European Union Rules the World (2019).
[53] Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union, 2019 O.J. (L 79) 1.
[54] FDI Regulation, Arts. 3-4.
[55] Luis Alonso Cabezas Villagarcia, Foreign Direct Investment in the European Union: A Critical and Comparative Overview, Mondo Internazionale (Feb. 11, 2025), https://mondointernazionale.org/en/focus-allegati/foreign-direct-investment-in-the-european-union-a-critical-and-comparative-overview.
[56] Commission Staff Working Document, Third Annual Report on the Screening of Foreign Direct Investments into the Union, SWD (2024) 281 final (Sep. 11, 2024).
[57] See Investment Screening in the EU, Eur. Comm., https://policy.trade.ec.europa.eu/enforcement-and-protection/investment-screening_en (last visited Oct. 29, 2025); Framework for Screening of Foreign Direct Investment into the European Union, OECD (2022), available at https://www.oecd.org/content/dam/oecd/en/publications/reports/2022/01/framework-for-screening-foreign-direct-investment-into-the-eu_d966075e/f75ec890-en.pdf.
[58] Joint Communication to the European Parliament, the European Council and the Council, European Economic Security Strategy, JOIN (2023) 20 final (Jun. 20, 2023); see also Jorge Valero, 19 EU Countries Call for New Antitrust Rules to Create ‘European Champions’, Euractiv (Dec. 18, 2018), https://www.euractiv.com/news/19-eu-countries-call-for-new-antitrust-rules-to-create-european-champions.
[59] Commission Staff Working Document, Third Annual Report on the Screening of Foreign Direct Investments into the Union, SWD (2024) 281 final (Sep. 11, 2024).
[60] FDI Regulation, Art. 3(2).
[61] See Proposal for a Regulation of the European Parliament and of the Council Amending Regulation (EU) 2019/452, Eur. Comm. (Jul. 3, 2024), COM (2024) 395 final (recognizing “uneven implementation” among member states and proposing greater harmonization); Third Annual Report on the Screening of Foreign Direct Investments into the Union, Eur. Comm. SWD (2024) 281 final (Sep. 11, 2024).
[62] Matthias Bauer, Digital Services Taxes as Barriers to Trade: Case Study, Eur. Ctr. for Int’l Pol. Econ. (Nov. 2019), available at https://ecipe.org/wp-content/uploads/2019/11/CaseStudy_DigitalService.pdf.
[63] Proposal for a Council Directive Laying Down Rules Relating to the Corporate Taxation of a Significant Digital Presence, COM(2018) 147 final – 2018/0072 (CNS); Proposal for a Council Directive on the Common System of a Digital Services Tax on Revenues Resulting from the Provision of Certain Digital Services, Eur. Econ. & Social Commit., COM(2018) 148 final – 2018/0073 (CNS) (Jul. 30, 2018), available at https://data.consilium.europa.eu/doc/document/ST-11484-2018-INIT/en/pdf.
[64] State of Play of Digital Services Taxes (DSTs) and Other Similar Measures, PricewaterhouseCoopers (Aug. 29, 2025), available at https://www.pwc.com/gx/en/tax/newsletters/tax-policy-bulletin/assets/pwc-state-of-play-of-dsts-and-other-similar-measures.pdf.
[65] Id.
[66] Comments of the International Center for Law & Economics, Re: Request for Comments Regarding Foreign Nations Freeloading on American-Financed Innovation, Int’l Ctr. Law & Econ. (Jun. 26, 2025), https://laweconcenter.org/resources/icle-comments-to-ustr-on-pharmaceutical-pricing.
[67] Funding the Global Benefits to Biopharmaceutical Innovation, Counc. Econ. Advis. (2020), at 5, available at https://trumpwhitehouse.archives.gov/wp-content/uploads/2020/02/Funding-the-Global-Benefits-to-Biopharmaceutical-Innovation.pdf.
[68] Id.
[69] German Benefit Assessment—White Paper: Latest Methodological Requirements in the German Benefit Assessment, Eur. Fed. Stat. Pharm. Ind. (May 2025), at 4, 39, available at https://www.efspi.org/wp-content/uploads/2025/05/GermanHTA_WhitePaper_2025.pdf (“’Key surrogate’ and ‘intermediate endpoints’ refer to measurable indicators used in clinical trials to approximate the effect of a treatment on meaningful patient outcomes. Surrogate endpoints (e.g., tumor shrinkage in cancer trials) function as substitutes for direct clinical outcomes (e.g., survival), while intermediate endpoints (e.g., blood pressure reduction or HbA1c levels in diabetes) reflect early changes that may predict long-term benefits. These markers are often used when direct outcomes take years to observe, but their validity for regulatory or reimbursement decisions depends on evidence linking them to patient-relevant effects.”).
[70] Jacoline Bouvy, Should NICE’s Cost-Effectiveness Thresholds Change?, NICE Blogs (Dec. 13, 2024), https://www.nice.org.uk/news/blogs/should-nice-s-cost-effectiveness-thresholds-change; John Appleby, Nancy Devlin, & David Parkin, NICE’s Cost-Effectiveness Threshold, 335 Br. Med. J. 358 (2007), available at https://pmc.ncbi.nlm.nih.gov/articles/PMC1952475/pdf/bmj-335-7616-edit-00358.pdf; As of June 25, 2025, £1 in 1999 is worth £1.92. Current inflation rates can be calculated on the Bank of England’s site. See Inflation and the 2% Target, Bank Eng., available at https://www.bankofengland.co.uk/monetary-policy/inflation (last visited Jun. 25, 2025).
[71] Marc A. Rodwin, What Can the United States Learn from Pharmaceutical Spending Controls in France? (Commonwealth Fund Issue Brief, Nov. 11, 2019), https://www.commonwealthfund.org/publications/issue-briefs/2019/nov/what-can-united-states-learn-drug-spending-controls-france.
[72] Id.
[73] Rick Chapman et al., Value Assessment Methods and Pricing Recommendations for Potential Cures: A Technical Brief, at 13 (Inst. Clin. Econ. Rev., Aug. 6, 2019), available at https://icer.org/wp-content/uploads/2020/10/Valuing-a-Cure-Technical-Brief.pdf.
[74] CEA, supra note 51 at 5-8.
[75] Teresa A. Reguly & Eileen M. McMahon, PMPRB Regulations: New Basket of Comparator Countries Has Arrived, Absent Guidance, Torys (Jul. 7, 2022), https://www.torys.com/en/our-latest-thinking/publications/2022/07/pmprb-regulations.
[76] Canadian Patented Drug Prices: Gauging the Change in Reference Countries, Parliam. Budg. Off. (Jun. 14, 2022), https://distribution-a617274656661637473.pbo-dpb.ca/1135d8aba4de3c35a1098e80fd5209fddb097920d354f8ac79ec3b1cf8918ff5.
[77] Seung-Rae Yu, Improving the Reimbursement Process for New Drugs: A Case Study of a Two-Waiver System in South Korea, 31 J. Evaluation Clin. Prac. e70074 (2025), https://pmc.ncbi.nlm.nih.gov/articles/PMC11959314.
[78] Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act), 2019 O.J. (L 151) 1.
[79] Mikołaj Barczentewicz & Kristian Stout, EU’s Cybersecurity Draft Shifts Toward Hard Protectionism, Truth on the Mkt. (Nov. 14, 2023), https://truthonthemarket.com/2023/11/14/eus-cybersecurity-draft-shifts-toward-hard-protectionism.
[80] Mikołaj Barczentewicz & Kristian Stout, How Not to Use Industrial Policy to Promote Europe’s Digital Sovereignty, Truth on the Mkt. (Oct. 5, 2022), https://truthonthemarket.com/2022/10/05/how-not-to-use-industrial-policy-to-promote-europes-digital-sovereignty.
[81] Id.
[82] See, e.g., John Salmon, Louise Crawford, Lavan Thasarathakumar, Daniel Lee, & Giulia Mariuz, EUCS: Controversial Sovereignty Issues Continue to Drive Debate for Cloud Services, Hogan Lovells (Jun. 12, 2024), https://www.hoganlovells.com/en/publications/eucs-controversial-data-sovereignty-issues-continue-to-drive-debate-around-the-eu-certification-scheme-for-cloud-services.
[83] Nigel Cory, Europe’s Cloud Security Regime Should Focus on Technology, Not Nationality, Info. Tech. & Innovation Found. (Mar. 27, 2023), https://itif.org/publications/2023/03/27/europes-cloud-security-regime-should-focus-on-technology-not-nationality; see also Clarifying Lawful Overseas Use of Data Act, Pub. L. No. 115-141, div. V, 132 Stat. 1213, 1213–25 (2018).
[84] Meredith Broadbent, The European Cybersecurity Certification Scheme for Cloud Services, Ctr. for Strategic & Int’l Stud. (Sep. 1, 2023), https://www.csis.org/analysis/european-cybersecurity-certification-scheme-cloud-services.
[85] Id.
[86] Barczentewicz & Stout, supra note 79.
[87] Barczentewicz & Stout, supra note 80.
[88] Press Release, ENISA Launches a Public Consultation on a New Draft Candidate Cybersecurity Certification Scheme in a Move to Enhance Trust in Cloud Services Across Europe, Eur. Union Agency for Cybersecurity ENISA (Dec. 22, 2020), https://www.enisa.europa.eu/news/enisa-news/cloud-certification-scheme.
[89] Barczentewicz & Stout, supra note 79.
[90] Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), 2022 O.J. (L 333) 80.
[91] The EU’s Cloud Service Restrictions, Info. Tech. & Innovation Found. (Aug. 26, 2025), https://itif.org/publications/2025/05/25/eu-cloud-service-restrictions.
[92] Broadbent, supra note 84.
[93] See, e.g., Conan French, Brad Carr, & Clay Lowery, Data Localization: Costs, Tradeoffs, and Impacts Across the Economy, Inst. of Int’l Fin. (Dec. 2020), https://www.iif.com/portals/0/Files/content/Innovation/12_22_2020_data_localization.pdf.
[94] The “Real Life Harms” of Data Localization Policies (Ctr. for Info. Pol’y Leadership Discussion Paper 1, Mar. 2023), at 1, available at https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/cipl-tls_discussion_paper_paper_i_-_the_real_life_harms_of_data_localization_policies.pdf.
[95] French et al., supra note 93; see also Kruthi Venkatesh, The Data Localization Debate in International Trade Law, Ikigai Law (Jun. 22, 2020), https://www.ikigailaw.com/article/273/the-data-localization-debate-in-international-trade-law (“According to most studies, such forced localization measures create a huge burden on businesses, particularly for small and medium-sized enterprises (SMEs), increasing costs up to 30–60% for acquiring local computing facilities and data storage infrastructure. In fact, as per a study conducted by the European Centre for International Policy Economy, forced data localization norms lead to a negative impact on the GDP and considerable impact on investments.”).
[96] Europe Cloud Computing Market Size & Outlook, 2024-2030, Grand View Res. (retrieved Oct. 28, 2025), https://www.grandviewresearch.com/horizon/outlook/cloud-computing-market/europe.
[97] European Cloud Providers’ Local Market Share Now Holds Steady at 15%, Synergy Res. Grp. (Jul. 24, 2025), https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15.
[98] Id.
[99] Id.
[100] Matthias Bauer & Philipp Lamprecht, The Economic Impacts of the Proposed EUCS Exclusionary Requirements: Estimates for EU Member States, Eur. Ctr. for Int’l Pol. Econ. (Oct. 2023), https://ecipe.org/publications/eucs-immunity-requirements-economic-impacts.
[101] See, e.g., Peter Swire, DeBrae Kennedy-Mayo, Drew Bagley, Sven Krasser, Avani Modak, &Christoph Bausewein, Risks to Cybersecurity from Data Localization, Organized by Techniques, Tactics and Procedures, 9 J. Cyber Pol’y 20 (2024).
[102] Zach Meyers, Can the EU Afford to Drive Out American Cloud Services?, Ctr. for Eur. Reform (Mar. 2, 2023), https://www.cer.eu/insights/can-eu-afford-drive-out-american-cloud-services.
[103] 50 U.S.C. §§ 1801–1813 (2020).
[104] United States—Measures Affecting the Cross-Border Supply of Gambling and Betting Services, Appellate Body Report, WT/DS285/AB/R (adopted Apr. 20, 2005), summarized at https://www.wto.org/english/tratop_e/dispu_e/cases_e/1pagesum_e/ds285sum_e.pdf.
[105] ICLE Comments to the Department of Commerce and Department of State’s Consultation on the EU Space Act, Int’l Ctr. Law & Econ. (Aug. 13, 2025), https://laweconcenter.org/wp-content/uploads/2025/08/EU-Space-Act-Comments.pdf.
[106] Proposal for a Regulation of the European Parliament and of the Council on the Safety, Resilience and Sustainability of Space Activities in the Union, 2025/0335 (COD) (Jun. 25, 2025).
