Advancing digitalisation and the rapid rise of artificial intelligence are bringing the European Union to a strategic turning point. To ensure it does not fall behind in a globalised digital economy, the European Commission published a proposal for the Cloud and AI Development Act (CADA) on 3 June 2026. As a key component of the overarching European Technological Sovereignty Package, this legislative proposal aims to future-proof the EU’s leading role in the field of cloud and AI technologies. The objective is ambitious: to strengthen the European ecosystem, mobilise investment and massively expand digital infrastructure to secure Europe’s sovereignty and competitiveness in the long term.
Current challenges facing the European digital space
There is an urgent need for action. Whilst demand for AI applications and cloud capacity is rising exponentially in businesses and public administration, there is a shortage of data centre and cloud capacity in Europe. The growth of digital infrastructure is currently being held back by significant hurdles:
- Bureaucratic hurdles: Lengthy and complicated approval procedures are delaying the construction of new infrastructure.
- Resource shortages: Access to energy, suitable sites, water and tailored financing options is severely limited.
- Strategic dependencies: The procurement and use of cloud services from providers outside the EU without sufficient control and security of supply.
This is precisely where CADA comes in. The legislation aims to accelerate the roll-out of sustainable cloud and data centre infrastructure whilst keeping the market open to international partners.
The three pillars of CADA
CADA is based on three core strategic areas to ensure a comprehensive transformation:
1. Research, development and innovation
CADA specifically promotes the next generation of cloud and AI technologies, particularly in the areas of Frontier AI (advanced AI models), Industrial AI (AI in industrial production) and Physical AI (AI in conjunction with robotics and hardware). So-called ‘Grand Challenges’ are designed to provide incentives for ambitious research efforts in the market. In addition, national strategies in the member states, as well as new ‘Experience and Acceleration Centres’, are intended to ensure that these innovations are rapidly adopted in strategic industrial sectors and public administration.
2. Capacity
To meet the immense demand for modern AI applications, CADA plans to at least triple the capacity of European data centres within the next five to seven years. This is to be achieved by drastically simplifying and speeding up the authorisation procedures. At the same time, access to critical resources such as electricity, land and water is to be optimised to ensure an environmentally sustainable yet high-performance infrastructure for data-intensive applications.
3. Autonomy
A key element of CADA is the creation of a uniform, EU-wide sovereignty framework. For critical use cases, the proposal sets out enhanced sovereignty requirements, without seeking to close the market to international partnerships in principle.
A common procurement framework for public administrations is also intended to harness their combined purchasing power to strengthen European innovation and the resilience of supply chains. The promotion of open-source solutions also plays a key role here.
The four-stage model
A new feature of the legislation is the specific regulation of service selection. Public authorities and operators of critical infrastructure must conduct a sovereignty risk assessment before using a cloud or AI service. The more sensitive the data being processed, the higher the legally prescribed security level.
Following a successful audit, providers can be classified into one of four levels:
- Level 1: Data is processed and stored exclusively on infrastructure within the European Union.
- Level 2: Providers must meet more stringent requirements regarding transparency and independence from the influence of third countries.
- Level 3: Higher levels of sovereignty entail particularly stringent requirements regarding ownership, control and organisational independence within the EU; exceptions for providers from third countries may be provided for on a case-by-case basis.
- Level 4: The highest level entails particularly far-reaching requirements regarding control, transparency and protection against potential influence by third countries.
In practice, Level 4 is likely to be difficult for non-European providers to achieve on a regular basis, unless they establish European structures that are sufficiently independent in organisational and legal terms.
Furthermore, the Act provides for justified exceptions when public contracting authorities procure cloud computing services, in order to safeguard the state’s ability to act in day-to-day operations.
Conclusion
In its proposed form, the Cloud and AI Development Act would be more than just a regulatory measure; it is a strategic industrial policy for the digital age. The aim is to prevent strategic dependencies and protect sensitive data through a clear sovereignty model, without cutting off Europe from the global market through isolationism and protectionism.
