The European Commission just dropped the Cloud and AI Development Act. Or CADA. It’s their latest attempt to wake up the local cloud industry.
They want to reshape infrastructure. Change how the public sector buys tech. Build some real autonomy.
The plan rests on three pillars. Invest in research. Build capacity.
Actually triple the European data center market within five to seven years.
That’s a big ask. The timeline is aggressive. Maybe too aggressive.
The Reception is Mixed, At Best
People aren’t cheering yet.
The CCIA Europe thinks the proposal is discriminatory. Their logic is simple. The new rules would force EU members to check if use cases require sovereignty levels that non-EU companies “would be unable to meet.” By default. That sounds like exclusion to them.
Mikolaj Barcenciewicz, a Polish tech lawyer, disagrees with the categorical approach. He argues for a risk-based system. Keep things specific. Don’t generalize. Let subsidiarity breathe.
Over in Sweden, MEP Jörgen Warborn isn’t happy with the business case.
Sovereignty goals? Fine. But simplify the regulations. Improve conditions.
He points out a harsh economic reality.
“A vast majority of global wealth is heldOutside the EU”
So why push it away? He thinks national security apps need tight controls. Sure. But less sensitive areas should welcome foreign investment. Otherwise, the money stays offshore.
Not everyone wants less regulation. Finnish MEP Aura Salla wants more centralization. Stress-test dependencies harder. Assess risks at the member-state level.
Then there’s Nextcloud, the German software firm. They say it’s not enough. Not even close.
They want the rules extended to the private sector too.
The Twelve-Month Myth
Here is where things get messy.
CADA Title III promises speed. Two mechanisms: Data Centre Acceleration Zones. Strategic Projects.
Member states have six months. Just six.
To designate at least one zone. Integrate it into local plans. Check grid availability. Prefer brownfield sites over green fields.
If a project fits here, or gets special strategic status, it hits a “green corridor.” The permit cap?
Twelve months max.
Sounds efficient. It probably won’t be.
The compliance list is heavy. Standardized sustainability KPIs are mandatory. Local resource allocation will be policed tightly. No speculative hoarding. No blocking competition.
Realistically? You are giving planners half a year to redraw maps. Then you want a permit in one year?
Physical bottlenecks exist. Builders with certifications are scarce. Every phase faces audits. A small facility can take years to rise from dirt.
Pile these new bureaucratic hurdles on top of that supply chain crunch?
The 12-month goalpost becomes meaningless.
Public Procurement Gets a Shakeup
Title IV changes how the government buys clouds.
No more free-for-all on price and quality alone.
Four assurance levels. Mapped to risk.
- Level 1 : Basic security. Foreign ownership okay.
- Level 2 : Substantial sovereignty. Foreign ownership allowed, but everything stays in the EU. Staff, infrastructure, support. Data can’t be used to train AI in other countries.
- Level 3 : High security. No foreign corporate control. Rare exceptions only.
- Level 4 : Critical autonomy. Foreign control banned entirely.
How does this work on the ground?
Appoint competent authorities. Audit suppliers. Grant recognition.
Within a year, members must do a risk assessment. Do it every two years after.
Figure out which cloud services touch sensitive data. Match the security level.
It’s a huge pivot.
Previously? Price mattered most. Tech specs did too. Maybe some sovereign risk management if the state cared.
Now? You must evaluate the provider’s contribution to the European ecosystem.
That’s not just a technical check. That’s political.
Does a cloud provider “help Europe” enough to get your money?
That’s a hard metric to pin down. Even harder to enforce across 27 member states.
