The EU's proposed CADA: Why cloud sovereignty matters for business strategy

The EU's proposed CADA introduces cloud assurance levels and new requirements aimed at strengthening digital sovereignty.

Contributors:
Natallia Karniyevich
Partner, Cybersecurity
McDermott Will & Schulte
Müge Fazlioglu
CIPP/E, CIPP/US
Principal Researcher, Privacy Law and Policy
IAPP
Cloud computing and artificial intelligence have become core infrastructure for the European economy. Yet the European Union depends heavily on a small number of non-EU providers that deliver both. EU providers' share of the European cloud market fell from about 29% in 2017 to roughly 15% by 2022; it has stayed flat since. The European Commission's proposed Cloud and AI Development Act, adopted 3 June 2026 as the centerpiece of its wider Tech Sovereignty Package, aims to close that gap by making the EU's cloud and AI ecosystem more competitive and resilient. Given its capacity to ensure uniform application and immediate effect across all member states, the Commission suggests a regulation as the optimal legal instrument to accomplish the proposal's objectives. It is only a proposal for now. The CADA still has to pass through the European Parliament and Council before it becomes law, and both its substance and timeline can still change materially.
The cloud computing sovereignty framework has drawn the most attention, but it is only one of the legislation's three pillars. The proposal also establishes the Cloud and AI Leadership Initiatives, which aims to promote the general objective of promoting research and innovation activities and achieving large-scale capacity throughout the EU's cloud and AI ecosystem. In addition, it would create data center acceleration zones with streamlined permitting to speed up capacity build-out.
Council-level scrutiny begins under Ireland's leadership, which took over the rotating EU presidency on 1 July 2026 and will aim to submit to a progress report on the CADA by the end of the year. In its Programme of the Presidency of the Council of the European Union, Ireland underscored the importance of the legislation, calling it "a key pillar of the EU's approach to digital sovereignty."
Contributors:
Natallia Karniyevich
Partner, Cybersecurity
McDermott Will & Schulte
Müge Fazlioglu
CIPP/E, CIPP/US
Principal Researcher, Privacy Law and Policy
IAPP