The proposed Cloud and AI Development Act puts cloud governance in focus for EU businesses as the Commission proposes new capacity, procurement and sovereignty measures for Europe’s digital infrastructure.
The European Commission’s proposed Cloud and AI Development Act (CADA) aims to expand European computing capacity and introduce a common framework for assessing cloud and AI sovereignty. The initiative is designed to support investment and reduce strategic dependencies as demand for artificial intelligence accelerates. For DPOs and business leaders, its significance reaches beyond infrastructure policy: it will bring questions about provider control, data location, third-country exposure, supply-chain transparency and service resilience more firmly into cloud procurement and digital governance.
The proposal responds to growing demand for cloud and AI computing capacity.
AI deployment requires substantial access to data centres, cloud services and specialised computing infrastructure. The Commission says Europe’s ability to scale this capacity is constrained by lengthy permitting procedures and limited access to energy, land and finance. CADA therefore seeks to create more favourable conditions for sustainable investment while ensuring sufficient computing resources for businesses and public administrations.
One of the proposal’s headline objectives is to at least triple EU data centre capacity within the next five to seven years. It would simplify permitting and improve access to essential resources, while supporting energy-efficient infrastructure and technologies for frontier AI, industrial AI and physical AI. The proposal also seeks to encourage cloud and AI adoption in strategic industrial and public sectors.
A common sovereignty framework would influence how cloud services are assessed.
CADA proposes a single EU-wide framework for assessing cloud and AI sovereignty. Four assurance levels would be available to public sector bodies according to the risks associated with a particular use case, and cloud providers could be recognised under the framework following an audit.
The levels range from processing and storing data on infrastructure located in the EU to progressively stronger requirements concerning independence from third countries, provider ownership and control, personnel, software supply-chain transparency and protection against third-country interference. The Commission says the framework would support highly critical public sector use cases while leaving most of the market open to international providers.
Sovereignty assessments and GDPR compliance address related but distinct risks.
The proposed framework is likely to provide useful evidence for organisations assessing infrastructure risk, but a sovereignty rating would not by itself establish GDPR compliance. Data location is only one consideration. Controllers must still understand which entities can access personal data, which laws apply to providers and subprocessors, how international transfers are safeguarded and whether contractual and technical controls are effective in practice.
DPOs should therefore avoid treating “EU-hosted” or “sovereign cloud” as a complete compliance conclusion. Procurement reviews should examine the provider’s corporate structure, remote support arrangements, encryption and key management, subprocessor chain, government-access exposure, incident response commitments and options for returning or deleting data when a service ends.
Public procurement rules could shape expectations across the wider cloud market.
Although the proposed adoption mechanism is directed principally at public administrations, its influence may extend beyond the public sector. Common assurance levels and audit criteria can affect the evidence providers collect, how services are described and which contractual assurances become standard in the market.
Private organisations operating in regulated or critical sectors may also use the framework as an input into supplier due diligence. Businesses should nevertheless relate any assurance level to their own risk profile rather than relying on it mechanically. The appropriate outcome will depend on the sensitivity of the information, the importance of the service, legal and operational dependencies and the consequences of disruption or unauthorised access.
Cloud concentration and lock-in remain governance concerns for organisations.
The Commission identifies dependence on non-EU providers as a risk to Europe’s digital autonomy and resilience. At organisational level, dependence can also arise when essential workloads, data and business processes become difficult to migrate from a single provider. This can weaken negotiating power and complicate incident response, regulatory change and business continuity.
Cloud governance should therefore include credible exit planning. Organisations should document data formats, interoperability requirements, migration responsibilities, deletion processes and the time and cost involved in changing providers. Open standards, portable architectures and careful management of proprietary services can help reduce avoidable lock-in without sacrificing legitimate operational benefits.
The Digital Decade findings explain why the Commission is prioritising infrastructure.
The 2026 State of the Digital Decade report found that 46.7% of EU enterprises use cloud computing and nearly 20% deploy AI, after AI adoption increased by 48% in 2025. At the same time, the report highlighted continuing dependencies on non-EU cloud providers and pressure on computing capacity as demand from AI grows.
This context helps explain the emphasis on capacity and autonomy in CADA. The policy objective is not simply to create more data centres, but to ensure that European businesses and public authorities have resilient infrastructure choices as cloud and AI become more important to essential operations. For organisations, greater choice will deliver value only if it is supported by effective due diligence and governance.
CADA remains a proposal, but businesses can prepare through better procurement governance.
The Commission adopted the legislative proposal in June 2026, and its final requirements may change during the EU legislative process. Organisations do not need to redesign cloud arrangements solely in anticipation of the proposal. They should, however, use the policy direction as a prompt to strengthen information about their current infrastructure and dependencies.
DPOs can contribute by ensuring cloud and AI inventories identify data locations, providers, subprocessors, transfer mechanisms, critical services and high-risk processing. Procurement procedures should bring privacy, security, resilience and AI governance specialists into decisions early enough to influence architecture and contractual terms. DPIAs and transfer assessments should also remain living documents when services, data flows or suppliers change.
Cloud governance is becoming part of wider digital accountability.
CADA reflects a broader shift in EU digital policy from regulating individual uses of technology towards strengthening the infrastructure on which those uses depend. For businesses, responsible adoption of cloud and AI increasingly requires a joined-up approach to data protection, cybersecurity, operational resilience, procurement and AI governance.
Organisations that can explain where their data and computing dependencies sit, which parties exercise control and how they would respond to legal or operational disruption will be better positioned to adopt AI sustainably. DPOs have an important role in connecting these infrastructure decisions with lawful processing, accountability and the rights of individuals.
Discover how Aphaia helps organisations build accountable cloud and AI governance.
Aphaia helps organisations assess cloud and AI services through practical privacy, security and digital governance programmes. Through DPIAs, international transfer assessments, supplier reviews and AI governance support, Aphaia enables businesses to understand their technology dependencies, document risk-based decisions and prepare for an increasingly interconnected EU regulatory environment.
