The Imported Constitution

European treaties subordinate cultural and social principles to single-market rules.

The Treaty Layer

The Buy American Act, in force since 1933, requires federal agencies to purchase domestic products with price preferences of twenty to fifty per cent and a domestic content threshold of sixty-five per cent, rising to seventy-five by 2029.[3]

The Act is a structural guarantee of domestic demand, enforced by law, and the companies it protects then compete in foreign markets with the scale that guaranteed demand created.

SpaceX enters the European satellite market backed by twenty-two billion dollars in government contracts. Its European competitors enter backed by grants.

IRIS², the European Union’s answer to Starlink, has slipped repeatedly, with full operational capability projected for 2031, a budget of ten point six billion euros, and not a single satellite in orbit.[4] Starlink has more than ten thousand.

In Ukraine, approximately forty thousand Starlink terminals form the backbone of military communications.[5]

Europe’s strategic connectivity depends on infrastructure built by American government procurement and owned by a company whose founder has called for the European Union to be abolished.[6]

How did Europe arrive at this position? The postwar settlement embedded a specific economic logic into European treaty architecture (Paper 6).[7]

What matters here is what that architecture now prevents.

The EU Charter of Fundamental Rights, binding since 2009, says Europe’s digital future must be built on dignity and data protection.[8]

Article 1: human dignity is inviolable. Article 7: respect for private life. Article 8: the right to the protection of personal data.

The Treaty base says something else. TFEU Article 56 guarantees the free movement of services. Articles 107 and 108 declare state aid generally incompatible with the internal market.

These provisions date to 1957 and have decades of enforcement machinery behind them.[9]

When they collide with the Charter in digital policy, the market freedoms prevail.

The institutional asymmetry makes this concrete.

DG Competition: 809 officials, €30 billion in cartel fines, authority to block mergers and impose penalties of up to ten per cent of global turnover.[10] The EU Agency for Fundamental Rights: approximately one hundred staff, an advisory mandate, no enforcement power.[11]

The ratio tells you which principle the architecture prioritises.

The procurement directives are where this architecture meets the buy-side question.

Directive 2014/24/EU requires open, transparent, non-discriminatory tendering for all public contracts above threshold values.[12]

No member state can require that government contracts go to European companies. No equivalent of the Buy American Act exists, has been proposed, or would survive legal challenge under the current treaty framework.

The playing field is level. The players are not.

NATO interoperability requirements compound the problem. Over 1,200 Standardisation Agreements were written around American equipment.[13]

These standards function as procurement channels (Paper 8), routing European defence budgets to American contractors without ever naming a preferred supplier.

The European Chips Act shows how deep the constraint runs. To subsidise semiconductor manufacturing, Europe required a formal carve-out under TFEU Article 107(3)(b), multiple IPCEI decisions, each requiring individual Commission assessment.[14]

America writes a cheque. Europe writes an application.

The Treaty base constitutionalises the constraint. The Free Flow of Non-Personal Data Regulation, passed in 2018, prohibited member states from requiring data to be stored on their own territory.[15]

Europe’s own regulatory framework dismantled the tools member states had to keep data within their borders.

Gaia-X was the test case. France and Germany launched Europe’s most prominent attempt at sovereign digital infrastructure in 2019.

EU competition rules required the initiative to admit all participants regardless of jurisdiction.[16]

Amazon, Google, and Microsoft joined. The sovereignty initiative included the companies from whose jurisdiction Europe needed sovereignty.

By 2024, most major European participants had quietly stepped back.[17]

The project failed because the constitutional order required it to invite in the incumbents it was designed to replace.

Every European aerospace champion from Airbus to Ariane was built through preferential state support. The Treaty base was amended, carved out, or bypassed each time.

For digital infrastructure, no equivalent bypass exists yet.

The Commission can mandate data protection, cybersecurity, and AI governance. It cannot build the sovereign infrastructure required to comply with any of them.

The Asymmetry Layer

The treaty architecture prevents Europe from building. The next question is why the asymmetry runs in one direction.

CFIUS, the Committee on Foreign Investment in the United States, is the instrument. It holds no public hearings and publishes no decisions.[18]

In 2018, it blocked the Broadcom-Qualcomm merger at $117 billion. It forced the sale of TikTok’s American operations. It blocked Ant Group’s acquisition of MoneyGram for $1.2 billion.[19]

The Aixtron case reveals the jurisdictional reach. Aixtron is a German semiconductor equipment company, headquartered in Herzogenrath.

In 2016, a Chinese investment fund sought to acquire it. CFIUS blocked the deal.[20]

The basis: Aixtron had a subsidiary in the United States.

The American government asserted jurisdiction over the acquisition of a German company by a Chinese buyer because the target had American corporate presence.

President Obama personally signed the executive order. The principle mirrors ITAR: corporate presence establishes jurisdiction.[21] A European company with an American subsidiary is, for the purposes of acquisition, transfer, and control, partly American.

The one-way door opens inward.

American companies freely acquire European technology, infrastructure, and security capabilities. European firms cannot reciprocate.

Thoma Bravo acquired Sophos, a UK cybersecurity firm, for $3.9 billion. Broadcom acquired VMware for $61 billion. VMware runs in European government data centres.

Palantir operates across European military and intelligence services.[22]

In each case, no European institution blocked the acquisition. No European government invoked a foreign investment screening mechanism.

Europe adopted the EU FDI Screening Regulation, fully applicable from 2020. It is advisory. Member states can ignore the Commission’s recommendations.[23]

Germany’s Federal Ministry for Economic Affairs approved the sale of Mynaric, one of Europe’s two world-class laser communications companies, to an American-listed company on 30 March 2026, nine days after ESA awarded it a new contract.[24]

The screening mechanism existed, screened, and approved. CFIUS is unilateral and binding.

The European regime screens for risk. The American regime makes decisions.

The satellite sector shows the asymmetry in real time.

America protects SpaceX from foreign acquisition, funds it through government contracts, and shields its domestic market through the Buy American Act.

SpaceX then competes in European markets where procurement rules require open tendering. The American company enters with government-backed scale.

The European company enters with structural disadvantages its own constitutional order created.

The rules say: Europe must be open. America may be selective.

Buy American feels normal in Washington. Buy European feels transgressive in Brussels.

Why It Feels Natural

A European small business owner opens a laptop. The operating system, the browser, and the email all run on American servers, under American jurisdiction, subject to American disclosure law.

The cloud storage, the video calls, the advertising platform, the payment processor: all American.

The business depends entirely on infrastructure designed under a different constitutional order. None of this feels foreign.

A doctor in a public hospital logs into an electronic health record system hosted on American cloud infrastructure. A civil servant drafts a classified policy document in an American productivity suite, synced to an American cloud.

The dependency is total. It feels like modernity.

The platforms Europeans depend on were designed under American legal assumptions that European law cannot fully reach. Those assumptions are compiled into architecture, running as code every time the software runs.

In 1996, twenty-six words in American law created the liability model for the global internet:

“No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”

Section 230 of the Communications Decency Act. What it produced was a business model: host anything, curate everything, answer for nothing.

Every platform of global significance was built on this premise.[25]

The deepest legal import operates beneath the platforms.

In 1979, the US Supreme Court established the third-party doctrine: persons have no legitimate expectation of privacy in information voluntarily disclosed to third parties.[26]

Every email in Gmail, every document in OneDrive, every database in AWS is, in the American legal imagination, data the user has voluntarily surrendered.

This doctrine created the constitutional environment in which the CLOUD Act was unremarkable.

European law says your data is protected regardless of where it sits. American law says your data is accessible because of where it sits.

Both apply simultaneously to every byte of European data stored with a US-jurisdiction provider.

In June 2025, Microsoft France’s legal director testified before the French Senate’s commission d’enquête. Asked whether he could guarantee that French citizen data hosted by Microsoft would not be transmitted to the United States government without the explicit agreement of French authorities, he answered:

“No, I cannot guarantee that.”[27]

The full Health Data Hub case is treated in Paper 4: sixty-seven million medical records, six years on Microsoft Azure, France’s migration to a European provider.

The Senate exchange is the public admission: no contractual commitment by a subsidiary can override the statute its parent answers to.

The same jurisdictional problem ran all the way down.

In January 2022, Austria’s data protection authority declared that any European website using Google Analytics was in breach of GDPR.[28] France, Italy, and Denmark reached the same conclusion within weeks.[29]

By mid-2022, four European data protection authorities had independently determined that the most widely used web analytics tool in the world could not be lawfully deployed on a European website.

Consider what that means in practice. A primary school in Bavaria running a free analytics tool to track how parents find the lunch menu is in violation of European fundamental rights law. A florist in Lyon measuring which page visitors look at most is structurally non-compliant with GDPR.

Ordinary digital life in Europe is, by the standards Europe’s own courts have set, structurally illegal.

The vertical stack-inheritance argument (Paper 2) traces this from firmware up through key management.

Section 230’s liability model, the third-party doctrine, and the cryptographic primitives selected by NIST, all American legal and institutional outputs, are compiled into every layer of the technology Europe runs.

When a European user opens an American application, they are operating within a constitutional order that was compiled into the software before the first line of European regulation was written.

The walls are there whether you see them or not.

Some governments have started to see them. Schleswig-Holstein migrated thirty thousand government devices to Linux.

The Dutch parliament described US technology dependence as a threat to national autonomy.[30] France launched its Health Data Hub migration.

But the states most dependent on American infrastructure are the ones least able to escape it, and no individual migration addresses the architectural problem.

Europe regulates because regulation is the only institutional tool the Commission was given. GDPR, NIS2, DORA, the AI Act, the Digital Markets Act: each mandates obligations that require sovereign infrastructure to fulfil.

None builds it.

The regulations themselves become a moat. Compliance costs are fixed: data protection impact assessments, algorithmic audits, researcher access systems, multilingual legal review.

The fifty billion dollar American company absorbs this as overhead. The ten million euro European startup collapses under it. The regulation meant to constrain incumbents fortifies them instead.

The Data Privacy Framework is the third compliance bandage applied to the same wound (Paper 4).

Three names, one fiction: that a contract can resolve a collision between two constitutional orders.

The Rules Europe Could Write

Every successful European sovereignty project achieved independence by opting out of the imported constitutional order.

Airbus circumvented the state aid rules, EURATOM sat outside competition law, Galileo abandoned its public-private partnership when it constrained sovereignty, and the euro reorganised monetary law from scratch.[31] Each bypassed the imported framework.

The digital domain has not yet produced its equivalent. No one questions whether a European airline should fly on European-built planes.

The equivalent question for cloud infrastructure, satellite communications, and digital payments has not been asked with the same seriousness because constitutional assumptions compiled into software are invisible in a way that aircraft are not.

The rules Europe could write are mechanical. None requires inventing new legal categories. Each has European precedent.

State-aid carve-outs for strategic digital infrastructure.

The TFEU 107/108 prohibition that prevents a European DARPA, In-Q-Tel, or SBIR equivalent is not constitutional bedrock. It is an article of treaty subject to amendment, derogation, and carve-out.

EURATOM was carved out for nuclear in 1957. Airbus was effectively carved out for civil aerospace through inter-governmental agreement and decades of WTO litigation that Europe ultimately survived. Galileo abandoned its PPP and ran on direct public funding.

The same mechanism is available for digital sovereignty if the political will to invoke it exists.

The IPCEI framework already permits derogation; the threshold for use needs lowering.

Procurement directive amendment. Directive 2014/24/EU codifies the open-tendering rule that prevents Buy European.

Treaty-level amendment to allow strategic-sovereignty preferences for digital infrastructure is the same instrument the European Chips Act required. The amendment text is a few sentences.

The political work of authorising the amendment is the actual cost.

Binding FDI screening with veto power. The current EU FDI Screening Regulation 2019 is advisory; member states approved Mynaric’s sale to an American-listed company despite the strategic loss.

A binding regime modelled on CFIUS, with Commission veto power over acquisitions of strategic European assets by non-European entities, closes the asymmetry.

Europe wrote the advisory version; Europe can write the binding version.

Free Flow of Non-Personal Data Regulation reform. Europe’s own 2018 regulation prohibits member states from requiring data to be stored on their territory.

The reform amendment is a single clause permitting strategic-data-localisation requirements for regulated infrastructure.

The original regulation was passed to facilitate single-market data flows; the reform recognises that the single market is a sovereignty container.

Two further inversions belong to dedicated papers. Reciprocity instruments, treating American restrictions symmetrically (Paper 8).

Anchor customer mandates and sovereign tax frameworks (the Sweden ISK, the France PEA, the UK Enterprise Investment Scheme expanded to EU level) (Paper 8).

The pattern across all four owned rules is the same. The rules are amendable, derogable, or carve-outable. Europe wrote each of them. Europe can rewrite each of them.

None requires constitutional revolution. Each requires the political will to override the reflex against using sovereignty mechanisms Europe already possesses.

Every failure to override is read as proof the override would not have worked: Mynaric had no European orders, bankrupt, acquired by an American company; the absence of procurement is read as proof procurement could not have helped.

The imported constitution is unfalsifiable from inside.

Every European sovereignty success required someone to override the reflex and mean it loudly enough to carry the institution.

Each required a crisis sharp enough to make the override politically viable.

Digital has not yet produced its equivalent voice because digital dependency is invisible in a way that aircraft and satellite dependency are not.

You can see a Boeing. You cannot see a cloud server’s jurisdiction.

Conclusion

Europe inherited the rules and enforces them against itself. Europe has the constitutional, regulatory, and democratic capacity to write its own.

The four amendments named above are mechanical. State-aid carve-outs, procurement-directive amendment, binding FDI screening, free-flow-of-data reform.

Each has European precedent and can be enacted by the Commission on the timeline the post-quantum cryptographic transition already imposes (Paper 5).

Buy American feels normal in Washington. Buy European feels transgressive in Brussels.

Inheritance is not destiny. Write your own rules.

[1] NASA Commercial Resupply Services Contract, 23 December 2008. SpaceX received $1.6 billion for twelve cargo resupply missions to the International Space Station. Cumulative US government contracts (NASA, Department of Defense, National Reconnaissance Office) from 2008 to 2026 total significantly more.

[2] SpaceX representatives made repeated public allegations of unfair European subsidies to Arianespace. The thirteen billion euro figure reflects cumulative European Space Agency contributions to the Ariane launcher programme since its inception.

[3] Buy American Act, 41 U.S.C. §§8301-8305, enacted 3 March 1933, strengthened by Executive Order 14005 (25 January 2021). The Federal Acquisition Regulation implements graduated domestic content thresholds reaching 75 per cent by 2029 and price evaluation preferences of 20 per cent for large businesses, 30 per cent for small businesses, and 50 per cent for Department of Defense procurements under FAR 25.105.

[4] Regulation (EU) 2023/588 establishing the Union Secure Connectivity Programme (IRIS²), adopted 15 March 2023. Total programme budget of €10.6 billion combining EU budget contributions, European Space Agency funding, and private sector investment. The programme’s timeline has been revised multiple times; full operational capability is now projected for 2030-2031.

[5] Ukrainian government and military sources reported between 42,000 and 47,000 active Starlink terminals in use across military and civilian networks by 2025. As of April 2026, SpaceX had launched more than 10,000 Starlink satellites into low Earth orbit.

[6] Elon Musk made multiple public statements calling for the dissolution of the European Union via his social media platform X in December 2025, following the European Commission’s €120 million fine under the Digital Services Act.

[7] The European Recovery Program (Marshall Plan), enacted by the United States in 1948, conditioned aid on recipient countries’ commitment to market liberalisation, removal of trade barriers, and fiscal stabilisation. See Milward, Alan S., The Reconstruction of Western Europe 1945-51, Methuen, 1984. The Treaty of Rome (25 March 1957), Article 92 (now TFEU Article 107(1)), codified these principles into the legal architecture of the European project.

[8] Charter of Fundamental Rights of the European Union (2000/C 364/01), became legally binding with the entry into force of the Treaty of Lisbon on 1 December 2009.

[9] Treaty on the Functioning of the European Union, Articles 56, 107, and 108. These provisions trace to the original Treaty of Rome (1957), Articles 59, 92, and 93 respectively.

[10] Council Regulation (EC) No 1/2003, Article 23(2), permits fines of up to 10 per cent of total worldwide turnover. Cumulative European Commission cartel fines run to billions (see European Commission, Cartel Statistics). DG Competition staffing figures from the European Commission Human Resources Report, 2024.

[11] EU Agency for Fundamental Rights, established by Council Regulation (EC) No 168/2007, recast as Regulation (EU) 2022/555. The Agency has approximately 100 staff members, an advisory mandate, and no enforcement powers.

[12] Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement.

[13] NATO Standardisation Office. NATO maintains over 1,200 active Standardisation Agreements (STANAGs) covering equipment, procedures, and interoperability requirements.

[14] Regulation (EU) 2023/1781 (European Chips Act), adopted 13 September 2023. State aid for semiconductor manufacturing was authorised through the Important Projects of Common European Interest (IPCEI) framework under TFEU Article 107(3)(b).

[15] Regulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European Union, adopted 14 November 2018.

[16] Gaia-X was announced by French Economy Minister Bruno Le Maire and German Economy Minister Peter Altmaier at the Digital Summit in Dortmund, 29 October 2019.

[17] Amazon Web Services, Google Cloud, and Microsoft Azure became Gaia-X Association members. By 2024, several founding European members had reduced participation and the project’s scope had narrowed significantly.

[18] Committee on Foreign Investment in the United States (CFIUS), operating under 50 U.S.C. §4565, as amended by the Foreign Investment Risk Review Modernization Act (FIRRMA) of 2018. CFIUS proceedings are confidential by statute.

[19] CFIUS blocked or forced divestiture in multiple cases: Ant Financial’s $1.2 billion acquisition of MoneyGram (abandoned January 2018); ByteDance’s TikTok US operations (divestiture ordered on national security grounds); and Broadcom’s approximately $117 billion acquisition of Qualcomm (blocked by presidential executive order, 12 March 2018).

[20] In 2016, China’s Fujian Grand Chip Investment Fund sought to acquire Aixtron SE for approximately €670 million. CFIUS intervened on the basis that Aixtron’s US subsidiary gave the United States jurisdictional authority. President Obama signed the executive order blocking the acquisition on 2 December 2016. The principle mirrors ITAR (22 C.F.R. §§120-130): corporate presence establishes jurisdiction.

[21] International Traffic in Arms Regulations (ITAR), 22 C.F.R. §§120-130, administered by the Directorate of Defense Trade Controls, US Department of State.

[22] Broadcom completed its acquisition of VMware for approximately $61 billion on 22 November 2023. Thoma Bravo acquired Sophos Group for approximately $3.9 billion in March 2020. Palantir Technologies holds contracts with defence and intelligence agencies across multiple European member states.

[23] Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments into the Union, adopted 19 March 2019, fully applicable from 11 October 2020. The Regulation establishes a cooperation mechanism but does not grant the Commission binding authority to block transactions.

[24] The German Federal Ministry for Economic Affairs and Climate Action approved the foreign investment clearance for the acquisition of Mynaric AG on 30 March 2026. ESA had awarded Mynaric a contract for laser communication terminals on 21 March 2026.

[25] Communications Decency Act of 1996, 47 U.S.C. §230(c)(1).

[26] Smith v. Maryland, 442 U.S. 735 (1979). The Supreme Court held that individuals have no reasonable expectation of privacy in information voluntarily disclosed to third parties.

[27] Testimony of Microsoft France before the Commission d’enquête du Sénat français on the sovereignty of French data systems, June 2025. The full Health Data Hub case (Plateforme des données de santé, established by French law of 24 July 2019, hosted on Microsoft Azure since 2019, French migration launched after the Senate testimony) is treated at the framework layer of this series.

[28] Datenschutzbehörde (Austrian Data Protection Authority), decision of 22 December 2021, published January 2022, in Case D155.027, finding that Google Analytics constituted an unlawful transfer of personal data to the United States under Chapter V GDPR, in light of the CJEU’s Schrems II judgment (Case C-311/18, 16 July 2020).

[29] CNIL (France), decision of 10 February 2022; Garante per la protezione dei dati personali (Italy), decision of 9 June 2022; Datatilsynet (Denmark), guidance of September 2022. All reached substantially identical conclusions regarding the incompatibility of Google Analytics with GDPR.

[30] The state government of Schleswig-Holstein announced migration of approximately 30,000 government workstations from Microsoft Windows and Office to Linux and LibreOffice in 2024. The Dutch House of Representatives (Tweede Kamer der Staten-Generaal) held parliamentary debate on digital sovereignty and dependence on United States technology providers.

[31] The Galileo programme’s original public-private partnership (the GJU concession) was abandoned in 2007, with the EU assuming full public funding and control. The EURATOM Treaty (1957) created a separate legal order with its own provisions for nuclear industry support. The euro was introduced as accounting currency on 1 January 1999 and as physical currency on 1 January 2002, replacing twelve member-state currencies under the Treaty on European Union.