Source: PYMNTS (citing Reuters)
Speaking in Lisbon on 9 November 2026, European Commission Executive Vice President Teresa Ribera said the European Union needs to review and deepen its concept of security, including cybersecurity, to account for the risks created by the growing concentration of power in large technology companies. Her point, as reported by Reuters: testing and monitoring devices connected to critical infrastructure is no longer enough, and security now also means ensuring that the biggest technology providers are governed by democratic and transparent patterns.
A year that changed the definition
Ribera framed the argument with concrete European examples. Cyberattacks on the continent have caused supermarket refrigerators to overheat, disrupted transit services and interfered with elections, she said. Those references will sound familiar to anyone following this news feed: recent months brought coordinated refrigeration attacks on European supermarkets, hoax threats against commercial flights and repeated warnings from national cyber agencies. What Ribera is adding to the picture is the concentration angle, the idea that when a small number of non-European companies supply the software, cloud and AI layers under European society, that dependency itself becomes a security question, not just a competition one.
Why it matters for infrastructure owners
For the teams actually running European infrastructure, this speech is another signal that procurement and architecture decisions will increasingly be read through a security and sovereignty lens. The direction of travel is visible across the EU: the expected cloud gatekeeper designations under the Digital Markets Act, the Cloud and AI Development Act, sovereign cloud offerings from the major hyperscalers, and a leaders’ summit on AI in Dublin later this week. Ribera also stressed urgency, saying the EU needs to be quick in deploying new approaches because the topic is critical for security, democracy and European values. She declined to comment on specific ongoing cases.
Practical steps
Whatever regulation follows, the engineering reality does not change: know which of your critical services depend on a single external provider, document where your data lives, and have a tested exit path. Dependency mapping, contractual transparency and multi-provider resilience are cheaper to build now than to retrofit under regulatory pressure. Ribera’s message effectively turns vendor concentration into a board-level risk item, and infrastructure teams that can already answer “what happens if provider X is unavailable or restricted” will be ahead of both the regulators and the incident.
If you want help mapping your dependencies on large technology providers, stress-testing your exit plans or aligning your platform choices with the emerging EU sovereignty rules, contact Excello Digital for advice grounded in real infrastructure work.