EU introduces Cloud and AI Development Act (CADA) in major sovereignty push

The European Commission has introduced a sweeping legislative proposal called the Cloud and AI Development Act (CADA), marking the continent’s most aggressive regulatory push yet to dismantle its reliance on foreign technology giants and secure independent digital infrastructure. Unveiled by European Commission President Ursula von der Leyen, CADA marks a major shift in Brussels' digital strategy.

Editorial credit: Henry Franklin / Shutterstock

While previous legislation like the landmark AI Act focused on regulating software usage, this new initiative targets the foundational computing layer, attempting to triple the European Union’s domestic data center capacity over the next five to seven years.

Codifying the four-tier sovereignty framework

The centerpiece of the proposed regulation is a standardized, EU-wide cloud sovereignty framework. The system establishes four strict "Union assurance levels" that cloud computing and AI infrastructure providers must satisfy to win contracts within the European public sector and critical industries:

• Level 1 (Baseline): Requires that all customer data be processed and stored exclusively within physical infrastructure located inside the borders of the European Union.

• Level 2 (Operational Localization): Mandates that all operations, supporting assets, and technical personnel managing the services be located within the EU, complemented by strict software supply chain transparency.

• Level 3 (Full Autonomy): Requires the provider to be entirely owned and corporate-controlled by EU entities. It introduces stringent personnel vetting, including citizenship requirements for engineers, and mandates that providers prove they are insulated from third-country jurisdiction laws.

• Level 4 (Total Control): Demands complete end-to-end transparency and absolute control over the entire software supply chain, ensuring zero vulnerability to foreign interference or extraterritorial judicial orders.

To drive market adoption, public procurement bodies will be required to weave these tiers into their vendor evaluations. For critical public functions - such as law enforcement, defense, and essential public utilities - agencies will be legally obligated to source infrastructure from the highest sovereignty tiers.

Accelerating supply and tackling structural hurdles

European providers currently control less than 13% of their own regional cloud market, leaving public administration and enterprise data flows heavily dependent on three dominant American hyperscalers. To combat this imbalance, the Commission is pairing its strict procurement rules with massive supply-side reforms.

CADA mandates the creation of specialized "Data Center Acceleration Zones" across member states. These zones are designed to bypass the fragmented, slow national permitting processes that historically stall heavy tech infrastructure in Europe.

The Act seeks to streamline access to critical land, funding, and the massive energy grids required to power next-generation AI "gigafactories," while enforcing an "open-source first" mandate for public sector software deployment.

Industry skepticism and the threat of "elegant deadlocks"

Despite the ambitious vision of strategic autonomy, the proposal faces immediate pushback from tech policy experts and industry groups. Analysts warn that the regulation risks creating a dangerous disconnect between political ideals and market realities. If the stringent mandates for upper-level sovereignty go into effect before competitive domestic alternatives exist, public administrations could find themselves legally barred from using the bleeding-edge AI models and compute power necessary to stay competitive.

Skeptics point out that similar ambitious sovereignty pushes, such as the EU Cloud Certification scheme (EUCS), collapsed into years of political deadlock due to irreconcilable disagreements between member states. As CADA enters trilogue negotiations between the European Parliament and the Council, lawmakers face the difficult task of removing Europe’s deep structural infrastructure deficits before imposing a complex compliance framework that could inadvertently isolate the continent's digital economy.