European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI

2026-06-05 · Source: The Data Advisor · Field: Legal & Regulatory — Compliance & Risk Management, Regulatory Affairs & Government Relations, Corporate Law & Business Legal Services · Depth: Intermediate, medium

Summary

On June 3, 2026, the European Commission (EC) released its first draft of the Cloud and AI Development Act (CADA) proposal, aiming to bolster the EU's digital infrastructure and decrease reliance on non-EU cloud providers. This initiative seeks to strengthen EU cloud, AI, and computing capabilities by tripling the EU's data center capacity within five to seven years and supporting EU-developed technology. CADA introduces a cloud sovereignty framework requiring public-sector bodies to conduct risk assessments and adhere to four levels of selection criteria for cloud services, ranging from basic safeguards to protection against foreign control and legal risks. While primarily impacting the public sector, the proposal also encourages similar practices for critical private entities and incentivizes EU-based cloud and AI investment.

Key takeaway

For legal professionals and consultants advising companies operating in the EU, CADA signals a significant shift in digital service procurement and risk assessment. You should monitor CADA's legislative development closely, as its criteria for "sovereignty" will likely influence vendor due diligence, contracting, and strategic cloud architecture decisions beyond public procurement. Prepare to assess your cloud and AI infrastructure for data localization, foreign legal risks, and supply chain security to ensure future compliance and market access.

Key insights

The EU's CADA proposal aims to reduce foreign cloud reliance and boost domestic digital sovereignty through new public-sector procurement rules.

Principles

• Digital infrastructure is critical.
• Public sector needs foreign control protection.
• EU-based investment is encouraged.

Method

Public bodies must conduct risk assessments, then select cloud services based on four assurance levels, with higher sensitivity requiring independent third-party audits and EU-based staff/data.

In practice

• Assess cloud services against CADA's four assurance levels.
• Implement multi-cloud or multi-vendor strategies.
• Prioritize EU-designed software/hardware.

Topics

• Cloud and AI Development Act
• EU Digital Sovereignty
• Public Sector Procurement
• Data Center Capacity
• Cybersecurity Act
• Digital Operational Resilience Act

Best for: CTO, Executive, VP of Engineering/Data, Legal Professional, Policy Maker, Consultant

Related on AIssential

• EU Unveils Sweeping Tech Sovereignty Push, Balancing Autonomy with Openness — Europe's tech sovereignty strategy balances reducing foreign dependency with fostering domestic capacity and open markets.
• EU moves to curb reliance on US tech companies — The EU seeks technological independence from US tech giants through legislative action and strategic investment in cloud, AI, and semiconductors.
• TCS Launches SovereignSecure Cloud in Europe — Sovereign cloud platforms balance AI innovation with strict data residency and compliance needs.
• The EU Wants Its Own Tech Supply Chain — Europe seeks technological autonomy through legislative and strategic initiatives to reduce foreign tech dependency.
• ‘Europe is a digital colony’: Startups wrestle with tech sovereignty demands — European startups face a dilemma between leveraging global cloud infrastructure and upholding digital sovereignty.
• Digital Sovereignty as a Quality Attribute for Software Architectures — Digital sovereignty can be formalized as a measurable quality attribute for software architectures in cloud computing.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Data Advisor.