At this year’s Computers, Privacy and Data Protection (CPDP) conference in Brussels, ARTICLE 19 hosted a panel (Clouded and Concentrated: Examining the Digital Foundations of Freedom of Expression) to ask what happens to media freedom and democratic accountability when the infrastructure underneath them is concentrated in the hands of a small number of companies.
Freedom of expression is usually understood in terms of content: which voices are heard, which posts are promoted, which are taken down. But it depends on far more than what happens on a screen. It depends on a functioning ecosystem for producing and sharing information, an ecosystem that rests on physical infrastructure. The most important piece of that infrastructure today is cloud computing: the vast network of data centres and services that store, process, and deliver almost everything people read, watch, and publish.
A pluralistic media environment that protects free expression has to protect it at the infrastructure layer, not just at the layer l of content. And right now, the infrastructure layer is insufficiently protected.
Cloud infrastructure is now the foundation for almost everything democratic communication runs on: platforms, research institutions, civil society tools, newsrooms and public services. Independent media and journalism, which are a precondition for freedom of expression in democratic societies, run on the same stack. Currently, this technology is controlled by a handful of American ‘hyperscalers’, chiefly Amazon, Microsoft, and Google.
The policy response so far has focused mostly on investment and industrial strategy. In Europe, the Cloud and AI Development Act (CADA) is aimed at expanding EU data centre capacity and backing European cloud alternatives. In Brazil, the push has taken the form of public investment in data centres. The underlying assumption is that building more capacity reduces dependency.
But does investment alone answer the questions of accountability, resilience, and democratic control that cloud concentration creates? What are the impacts on media pluralism when the infrastructure sustaining journalism is concentrated in a few cloud providers?
To discuss these questions, ARTICLE 19 organised a panel at the Computers, Privacy and Data Protection (CPDP) this year. We explored how the concentration of cloud infrastructure and generative Artificial Intelligence creates structural dependencies that threaten freedom of expression and media independence, and whether the regulatory answers on the table are fit for purpose to address those challenges.
The panel brought together four experts looking at the same problem from different angles:
- Agustín Ferrari Braun, PhD researcher at the AlgoSoc Consortium and the University of Amsterdam’s Media Studies Department, whose doctoral work traces the politics of digital infrastructure in European news media
- Willem Vermost, who leads the European Broadcasting Union’s (EBU) work on IP-based studio infrastructure and chairs the Requirements Council for the EBU’s Media Exchange Layer project
- Sandrine Elmi Hersi, Head of the Open Internet Unit at Arcep, the French telecoms regulator, where she has led recent work on generative AI’s impact on the open internet
- Dr. Corinne Cath, Interim Director of Global Team Digital at ARTICLE 19, an anthropologist of technology whose background spans cloud computing, AI, and internet governance
How dependency became structural
Agustín Ferrari Braun opened by describing how European news media arrived at cloud dependency. The shift was a response to a long-standing financial and ‘conceptual’ crisis in the media sector, driven by a process of platformisation that transformed the sector’s traditional role as a knowledge gatekeeper and impacted traditional business models. Cloud infrastructure offered perceived reliability and cost savings that looked, on the surface, uncomplicated. By outsourcing the servers (and the risk), media companies would focus resources on content production or data-driven advertising rather than backend engineering.
The bargain comes with costs that only become visible later. Ferrari Braun identified three compounding risks. First, infrastructure can become a lever of political pressure. Second, dependency concentrates pricing and technology decisions in oligopolies, leaving media organisations with little leverage to contest the terms they’re offered, including how generative AI is integrated into their tools. Third, and perhaps most corrosive long-term: outsourcing infrastructure across an entire sector erodes the in-house expertise needed to imagine, let alone build, alternatives.
What broadcasters are already building
Willem Vermost brought the EBU’s response to that erosion. Public broadcasters face the same trust imperative as any newsroom – staying connected to their audience – but the technical means of doing that have shifted entirely. Vermost described the cloud as a place where it is easy to enter but nearly impossible to leave, due to a lack of standards and proprietary ‘lock-ins’ at every layer.
The EBU’s answer is the Media Exchange Layer (MXL) – an open, compute-efficient alternative built to give broadcasters a way to interact with media infrastructure without being permanently bound to one hyperscaler’s proprietary stack. It’s a practical attempt to allow broadcasters to run their production stacks on-premises, on their own clusters, or across various European cloud providers, ensuring they are not tied to a single hyperscaler.
How generative AI services are a new layer of intermediation
Sandrine Elmi Hersi widened the lens to Arcep’s work on economic regulation. From a regulator’s standpoint, both net neutrality and open internet are key for the exercise of freedom of expression and open communication. Generative AI services, she argued, are a new layer of intermediation and gatekeeping sitting on top of an already concentrated cloud and operating-system layer, with vertical integration compounding both.
Elmi Hersi flagged two issues regulators should be focusing on: (i) building robust, reliable technical standards and payment mechanisms for the relationship between generative AI and the media sector, so content providers can set ‘granular conditions’ for how their data is used in both training and inference; (ii) and addressing how AI firms’ bilateral agreements with major publishers risk leaving smaller, independent publishers without visibility or compensation.
On the infrastructure side, she identified concentration dynamics across the AI value chain, specifically naming computing power, data access, and foundation models, and warned that hyperscalers use their ecosystem position to expand into adjacent AI markets. Both of these issues, she argued, should be addressed by economic regulation.
The human rights stakes
Dr. Corinne Cath closed the panel’s opening round by naming what’s actually at stake when cloud stops being treated as a neutral technology. AI is hollowing out journalism by draining content via crawlers. At the same time, the cloud is capturing the inner-workings of the media – in this pattern, she argued, publishers lose expertise to the provider, lose control over their digital environment, and eventually absorb the profit-driven logic of their cloud providers, often large American companies.
This comes with key democratic fragilities: when a handful of providers hold this much of the stack, outages, withdrawals, and quiet infrastructural censorship become a structural risk. As noted in Dr Cath’s closing remarks, ‘a free press built on captured infrastructure is only ever going to be as free as those firms allow it to be’.
Tackling infrastructural power
The discussion pushed the panel to stress-test what regulation can realistically achieve. The participants worked through what an infrastructural vulnerability looks like in practice. They pointed to the reach of extraterritorial laws such as the US CLOUD Act, and the uncomfortable reality that an organisation can have excellent privacy protections and still be a single decision away from being switched off by its cloud provider.
The conversation then turned to the existing EU regulatory toolbox: how far CADA, the Digital Markets Act, or the AI Act actually reach into infrastructures. Participants agreed that each instrument captures a slice of the problem, but none was designed to confront the full extent of Big Tech’s infrastructural power over free expression.
This matters deeply for both media and information resilience. Big Tech companies have captured multiple layers of the media ecosystem simultaneously. As the panel made clear, this has direct consequences for the information ecosystem as a whole. Without adequate regulatory attention, the effects on our democracies could be lasting and difficult to reverse. ARTICLE 19 will continue to push for governance frameworks that treat cloud infrastructure as an essential environment for freedom of expression – where transparency, accountability, consideration of critical dependencies, exit rights, and human rights due diligence are seen as the starting points.
ARTICLE 19’s full submission to the European Commission’s call for evidence on the Cloud and AI Development Act is available here. Our critical reading on the EU’s sovereignty package is available here.