The Cloud and AI Development Act Proposal
Throughout the EU, there is a clear political ambition to use public procurement as a lever to reduce reliance on a small number of non-EU cloud service providers and to open the market to a wider range of providers. The Commission presents its proposal for a Cloud and AI Development Act (CADA) as a way to ‘decrease overreliance on certain providers’. Yet, as the CADA proposal is designed, it is more likely to preserve the status quo than to enable public procurement to be used to scale up an open source and interoperable European digital stack.
In this report, Zuzanna Warso and Kristina Irion, an Associate Professor at the Institute for Information Law, University of Amsterdam, examine Title IV of the CADA proposal entitled ‘Autonomy’, which covers a cloud computing sovereignty framework with its four Union assurance levels, and risk assessments and public procurement of cloud computing services used by public sector bodies in the Member States and Union entities.
In examining these rules, we identified the following key issues:
- Although the CADA proposal frames reliance on third-country cloud providers as a question of sovereignty, it addresses that reliance through the logic and mechanisms of information security risk regulation.
- The CADA proposal’s legal threshold of contributing to ‘the preservation of public order’ effectively excludes public sector activities at Union assurance level 1 (circa 70 percent) from being assessed following the risk assessment criteria in Article 29(2).
- Rather than establishing a minimum standard, the framework risks creating a ceiling on sovereignty requirements.
- Union assurance level 2 would still leave room for ‘sovereign cloud’ arrangements involving US hyperscalers.
- Union assurance level 3 generally excludes third-country control, but the exception for ‘associated third countries’ leaves open the possibility that the Commission recognises a third country after the CADA is adopted.
- Annex II restricts the use of service-generated data for AI training by third-country actors but does not explicitly extend this prohibition to all customer data, nor does it expressly restrict providers’ own use of customer data for AI training within the EU.
- The CADA proposal addresses technological dependencies in software but expressly excludes hardware from the sovereignty assessment, even though software and hardware dependencies are closely interconnected.
- The EU-wide consistency mechanism is entrusted to the Commission rather than a board of independent regulatory authorities, raising questions about the institutional independence of oversight, the concentration of powers in the Commission and its exposure to geopolitical pressure.
Based on these issues, our key recommendations include:
- Remove contributing to the ‘preservation of public order’ as the threshold for higher sovereignty levels or, at a minimum, define it broadly.
- Allow higher assurance levels beyond public order activities.
- Make the designation of associated third countries under Article 18 subject to a public consultation, and require the Commission to publish its assessment of how the third country meets each of the cumulative criteria.
- Prohibit the use of customer data processed, stored or generated through the audited service for training or fine-tuning any AI system without the explicit authorisation of the public sector body.
- Extend the CADA’s assessment of technological dependencies beyond software to include critical hardware components and supply chains.
- Entrust EU-level coordination and consistency functions to an independent board composed of national competent authorities, instead of concentrating these powers in the Commission.
- Make multi-vendor or multi-cloud strategies the default rather than an option to consider.
- Turn the duty to encourage open source in Article 41 into an ‘open source first’ rule.
Taken together, these changes would allow public authorities to use procurement not only to manage their reliance on a small number of non-EU providers, but to reduce it.
This report contributes to and builds on our work on Steering AI Investment, which examines what kind of AI the EU supports and which technological trajectories it enables, and our work on Public Digital Infrastructure. It follows our policy briefs Cloud infrastructure as a foundation for digital sovereignty and Public Procurement as a Strategic Lever for Digital Sovereignty.
