On 3 June 2026, the European Commission proposed the Cloud and AI Development Act (CADA), a legislative piece within the European Technological Sovereignty Package that aims to speed up cloud and AI infrastructure across the EU. The act responds to surging demand and infrastructure shortfalls that threaten Europe's long-term digital competitiveness.
Why Europe needs CADA
Data centre and cloud capacity in Europe falls far short of the growing needs of businesses and public administrations. Lengthy approval procedures stall new construction. Access to electricity, suitable sites, water, and tailored financing remains tightly constrained. Heavy reliance on cloud services from providers outside the EU also raises security-of-supply risks that the current market cannot resolve on its own.
Three pillars of the Act
CADA rests on three strategic areas:
- Research, development and innovation: The act funds next-generation cloud and AI technologies, including frontier AI, industrial AI, and physical AI. Grand Challenges create incentives for ambitious R&D, while national strategies and new Experience and Acceleration Centres push rapid adoption in strategic industries and public administration.
- Capacity: The proposal targets at least a tripling of European data centre capacity within five to seven years. Authorisation processes will be drastically simplified, and access to power, land, and water will be optimised to deliver environmentally sustainable, high-performance infrastructure for data-intensive workloads.
- Autonomy: A uniform, EU-wide sovereignty framework introduces enhanced requirements for critical use cases, without shutting out international partners. A common procurement framework for public administrations harnesses collective buying power, while the promotion of open-source solutions reinforces supply chain resilience.
The four-stage sovereignty model
Public authorities and operators of critical infrastructure must conduct a sovereignty risk assessment before choosing a cloud or AI service. The more sensitive the data, the higher the legally mandated security level. After a successful audit, providers can be classified into one of four tiers:
- Level 1: Data is processed and stored exclusively on infrastructure within the European Union.
- Level 2: Providers must meet stricter transparency requirements and demonstrate independence from third-country influence.
- Level 3: Ownership, control, and organisational independence inside the EU become mandatory; limited exceptions for third-country providers may be granted case by case.
- Level 4: The most stringent controls on transparency and protection against third-country influence. Non-European providers are unlikely to reach this tier regularly unless they create legally and organisationally independent EU structures.
The act also allows justified exceptions when public contracting authorities procure cloud computing services, to keep day-to-day government operations running.
Why this matters for IT and development professionals
CADA will rewrite procurement rules for public-sector and critical-infrastructure IT projects. Teams must assess sovereignty levels, adapt architectures to meet data-residency constraints, and plan for a mix of open-source and EU-sovereign cloud services. Staying current with these regulatory shifts is part of broader AI upskilling, covered in resources like AI for IT & Development.
Your membership also unlocks:
