Cloud and AI have long since ceased to be merely “IT topics.” They form the foundation of digital services, customer engagement, healthcare, government, financial processes, security, logistics, and, increasingly, business operations. But behind every AI application and every cloud service lies a practical question: where is it hosted, who manages it, what laws apply to it, and who ultimately has access to it?
That is precisely what the proposed Cloud and AI Development Act — CADA for short—is all about. With this law, the European Commission aims to strengthen the European cloud and AI ecosystem—not only by enabling greater computing power and data center capacity, but above all by clarifying which cloud services are suitable for which types of data and processes.
So the essence of CADA is not that “everything must be European.” The essence is this: the more sensitive the data or the more critical the process, the more clearly it must be demonstrated who has control over the service, the data, the infrastructure, the software chain, and the subcontractors.
Why is CADA necessary?
Europe relies heavily on cloud and AI services from a limited number of large non-European providers. These providers offer a great deal of innovation, scale, and reliability. At the same time, a strategic dependency is emerging. For ordinary applications, this may be acceptable. For sensitive public processes, critical infrastructure, or data with significant societal impact, however, the situation is different.
Consider government data, healthcare information, police and judicial applications, defense, crisis management, critical infrastructure, or AI systems that support decision-making in public services. In such cases, it’s not enough to simply know that the servers are located in Europe. You also want to know who has legal control, who has technical access, who provides support, which software components are used, and which foreign laws might have an impact.
CADA is working to organize this through a European framework for cloud sovereignty.
Data sensitivity determines the required level
A key principle of CADA is the risk-based approach. Not every application needs to meet the most stringent requirements. A simple public website has different requirements than a system used for defense, the judiciary, or healthcare records.
That is why the assessment begins with the question: How sensitive is the data, and how critical is the process?
Based on that, the required level of cloud sovereignty is determined. The sensitivity of the application is therefore the determining factor. But after that, the focus shifts to the provider and the service: can the provider demonstrate that it meets the requirements associated with that level?
That is what makes CADA practically relevant. It is not just an abstract label, but a set of verifiable checkpoints.
Four Levels of Cloud Sovereignty
CADA introduces four so-called Union assurance levels. These levels indicate the degree of control, autonomy, and protection offered by a cloud service.
At the lower levels, the focus is primarily on basic safeguards, such as having a physical presence in the EU, processing data within the EU, transparency regarding subcontractors, and adequate cybersecurity. At higher levels, the requirements become stricter. These include, for example, the location of personnel, legal control, ownership structure, operational support, control over the software chain, and protection against unauthorized access by third countries.
This makes the difference between “data is stored in Europe” and “the service is sufficiently sovereign for a critical application” much clearer. A provider cannot, therefore, simply claim that it uses European data centers. The question becomes: Who has actual, legal, and technical control over the entire chain?
From a promising vision to tangible evidence
One important effect of CADA is that cloud sovereignty is becoming less of a vague concept. Currently, providers do not always use terms such as “sovereign cloud,” “trusted cloud,” or “EU cloud” in the same way. This makes it difficult for buyers to properly compare offers.
CADA aims to put an end to this by having services assessed based on harmonized criteria. Independent audits are planned for higher assurance levels. The result must be recognizable and usable across Europe, so that a service that has been recognized at the appropriate level does not have to be re-evaluated against a different set of standards in every member state.
This is important for both providers and customers. Providers will have a clearer understanding of the requirements they must meet. Governments and other public organizations will have a more concrete framework for determining which cloud solution is appropriate for the risk associated with their application.
The audit trail will be decisive
Perhaps the biggest shift lies in how we think about the supply chain. CADA looks not only at the main supplier, but also at the parties surrounding it.
Who are the subcontractors? Where are the infrastructure, personnel, and support located? Which software components are part of the service? Is there an up-to-date overview of dependencies? Can a third country influence maintenance, updates, security patches, or continuity? And are there technical or organizational measures in place to prevent unauthorized access or disruption?
This means that cloud sovereignty is not just a legal issue. It is also an operational and technical issue. A cloud service can only be reliably assessed if the entire chain is transparent enough.
What does this mean for public procurement?
For government agencies and public organizations, CADA is particularly relevant in the context of procurement. They will need to better determine which assurance level is appropriate for the application they wish to procure.
For less sensitive applications, a lower level may be sufficient. For critical processes, a higher level may be required. The bidding process thus becomes not only a comparison of price, functionality, and availability, but also of demonstrable control, autonomy, and supply chain management.
This could change the market. European and Dutch cloud providers will have opportunities if they can demonstrate that they meet stricter sovereignty requirements. Major international providers will remain relevant, but for sensitive applications, they will need to demonstrate more clearly how they mitigate legal, technical, and operational risks.
The upcoming points system
In addition to assurance levels, European added-value procurement criteria are also used. This means that bidders in public tenders can earn extra points if they can demonstrate that they contribute to the European cloud and AI ecosystem.
Consider the use of European technology, development, or innovation within the EU; strengthening the European digital supply chain; transparency regarding software and hardware; or the use of components that contribute to European supply security.
It is important to note that this is not an automatic “Europe wins” rule. Price, quality, and technical suitability remain important. The points system is intended as a supplementary quality criterion. But in tenders, such a criterion can indeed make a difference—especially for contracts in which cloud sovereignty, continuity, and control over the supply chain are major considerations.
For providers, this means they must be able to substantiate their European value in concrete terms—not just with marketing claims, but with evidence: where is development taking place, who manages the service, what technology is used, what does the software chain look like, and how is dependence on third countries limited?
What about the data centers?
CADA also includes measures to increase European data center capacity. This makes sense: without sufficient computing power, Europe cannot build a strong cloud and AI market. Sustainability plays an important role in this, for example through energy efficiency, better utilization of servers, and faster procedures for innovative and sustainable data center projects.
But for many organizations, this is not the core of CADA. Data center capacity is primarily a supply-side prerequisite. The strategic impact for cloud users, public institutions, and providers lies primarily in the question of which services will eventually be deemed suitable for sensitive or critical applications.
What should organizations be doing right now?
Organizations don’t have to wait until CADA is finalized to start preparing. The direction is clear: cloud choices are increasingly being evaluated based on risk, control, and dependency.
A good first step is to map out the current cloud landscape. Where is the data located? Which processes are critical? Which vendors and subcontractors are involved? What contractual exit options are available? Which support and management processes are routed through third countries? And is it clear which laws may apply to the provider?
For public organizations, there is an additional question: Which assurance level will be appropriate for which application in the future? Not everything needs to meet the highest level, but the rationale must be better substantiated for sensitive or critical processes.
For cloud providers, the message is just as clear. Anyone who wants to compete in the sovereign cloud segment in the future will have to be able to demonstrate how the chain of control works. Transparency, auditability, legal structure, software chain, support model, and operational autonomy will become key commercial differentiators.
CADA in one sentence
The Cloud and AI Development Act is not just about increasing European cloud capacity, but above all about trust: Europe wants to be able to determine which cloud services are appropriate for which risks, and wants providers to demonstrate their control over data, infrastructure, software, and the supply chain.
This shifts cloud sovereignty from a marketing term to a verifiable framework. And that could have major implications for public procurement, cloud strategy, and the position of Dutch and European cloud providers.
