Key Takeaways<\/h2>\n\n\n- Sovereignty becomes a verifiable level:<\/strong> CADA defines four assurance levels for cloud services to the public sector, from Level 1 as a minimum requirement to Level 4 with full control over the supply chain without third-country influence.<\/li>\n
- From Level 3, origin matters:<\/strong> Providers must be owned and controlled from the EU, including criteria on the nationality of personnel. This practically excludes US-controlled hyperscalers.<\/li>\n
- This is still a proposal:<\/strong> The draft dates back to June 3, 2026; adoption is still pending. However, those planning public procurement will benefit from integrating the level logic into their architecture early on.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>The Germany Stack Goes Operational<\/a> \/<\/span> Separating NIS2 and DORA Cleanly<\/a><\/p>\nWhat the Cloud and AI Development Act Aims to Regulate<\/h2>\n
What is CADA?<\/strong> The Cloud and AI Development Act is a proposed regulation by the EU Commission from June 3, 2026, aimed at strengthening cloud and AI sovereignty in Europe. It is not yet in force but is at the beginning of the legislative process. Its core consists of two key elements.<\/p>\nThe first is infrastructure. The Commission sees a structural deficit in data center capacity in the EU and aims to triple it within five to seven years. This goal is primarily to be achieved through private investments, which the Commission estimates at around \u20ac200 billion. It is essential to distinguish: tripling is the capacity goal, and \u20ac200 billion is the investment sum to be mobilized, not a funding budget.<\/p>\n
The second key element is dependency. A large part of European cloud usage runs through a small number of providers outside the EU. CADA aims to counter this concentration with a verifiable framework, and this is where the assurance levels come into play.<\/p>\n
Four levels that make sovereignty verifiable<\/h2>\n
The leverage of CADA is that sovereignty is tied to verifiable criteria. What was once a buzzword becomes a classification. The proposal defines four assurance levels that the public sector can demand based on risk assessment. The classification follows criteria such as control over the service, control over the supply chain, data handling, infrastructure location, and cybersecurity.<\/p>\n
\n\n\n\nLevel<\/th>\n Core requirement<\/th>\n Who meets it<\/th>\n<\/tr>\n<\/thead>\n \n\nLevel 1<\/strong><\/td>\nMinimum standard for every cloud service to the public sector<\/td>\n Practically all providers<\/td>\n<\/tr>\n \nLevel 2<\/strong><\/td>\nIndependence from third countries, transparency over the software supply chain<\/td>\n Providers without third-country ties<\/td>\n<\/tr>\n \nLevel 3<\/strong><\/td>\nOwnership and control from the EU, personnel nationality criteria<\/td>\n EU providers, hardly US-controlled<\/td>\n<\/tr>\n \nLevel 4<\/strong><\/td>\nFull control over the supply chain without influence from third countries<\/td>\n Purely European stacks<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\nThe grading does not force anyone to opt for a European solution across the board. It leaves the classification to the risk assessment of the respective authority. For an administration with sensitive data, Level 3 or 4 will be a logical requirement, and this will determine the provider selection before the first architecture sketch is created.<\/p>\n
What the levels mean for procurement<\/h2>\n
Here, a regulatory proposal turns into a concrete procurement question. Providers will be recognized by the member states under the framework after an audit. Those that do not meet Level 3 or 4 cannot participate in tenders that require this level, which is not a ban on specific providers but effectively amounts to an exclusion, as a US-controlled hyperscaler can hardly meet the ownership and personnel criteria.<\/p>\n
For architects, this means that the sovereignty level will have to be considered at the beginning of the planning process. If someone designs a system for the public sector and only later realizes that the target authority requires Level 3, they will have to rebuild half of the data storage. The sober consequence is a preliminary question in every procurement project: Which level is required, and which part of the stack already meets it?<\/p>\n
Concretely, this affects more than just the server location. Level 3 requires ownership and control from the EU, which can already fail due to the corporate structure of a provider with a US parent company, regardless of where the servers are located. This also includes key management. Who holds the cryptographic keys and under which jurisdiction they do so determines the classification. And the personnel criteria go as far as who has administrative access to the infrastructure. Pure data residency in a Frankfurt data center only fulfills part of this, and precisely this confusion is common in sovereignty pitches.<\/p>\n![\"Server](\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/06\/cm-47113-datacenter.jpg\")
Sovereignty is decided by the infrastructure, not just the contract. Image: Pexels \/ panumas nikhomkhai<\/em><\/figcaption><\/figure>\nWhy the Architecture Decision Needs to Be Made Now<\/h2>\n
It’s tempting to delay the issue as long as CADA is just a proposal. However, this calculation rarely pays off. A sovereign stack cannot be retrofitted in the quarter when the tender appears. Data storage, key management, and supply chain are decisions with a long half-life.<\/p>\n
\nStatus and Outlook<\/div>\n\n\nJune 3, 2026<\/div>\nThe EU Commission presents the CADA proposal, including the four assurance levels.<\/div>\n<\/div>\n\nProcedure<\/div>\nParliament and Council negotiate; the text may still change.<\/div>\n<\/div>\n\nAfterwards<\/div>\nSupplier audits and recognition by member states; tripling capacity with the goal of meeting demand by 2035.<\/div>\n<\/div>\n<\/div>\n<\/div>\nAnyone building or selling cloud solutions for the public sector should conduct an honest self-assessment today: What level does their own stack achieve, and where is the next third-country influence that prevents Level 3? This question costs little and saves expensive rework under time pressure later on.<\/p>\n
Frequently Asked Questions<\/h2>\n\nIs CADA already in effect?<\/strong><\/summary>\nNo. CADA has been a proposal of the EU Commission since 3 June 2026 and is undergoing the legislative process. The text may still change during negotiations with the Parliament and the Council.<\/p>\n<\/details>\n\nWhat are the four Assurance Levels?<\/strong><\/summary>\nFour tiered sovereignty levels for cloud services for the public sector. Level 1 is the minimum standard, Level 2 requires third\u2011country independence and supply\u2011chain transparency, Level 3 mandates EU ownership together with personnel criteria, and Level 4 provides full control over the supply chain.<\/p>\n<\/details>\n\nDoes CADA exclude US providers?<\/strong><\/summary>\nNot through an outright ban, but in effect. For tenders that require Level 3 or 4, a US\u2011controlled hyperscaler can hardly meet the ownership and personnel criteria and therefore cannot participate.<\/p>\n<\/details>\n\nWhat does the tripling of datacenter capacity mean?<\/strong><\/summary>\nThe Commission aims to triple EU datacenter capacity within five to seven years. The effort is expected to be driven mainly by private investments of roughly 200\u202fbillion Euro, which should not be confused with a subsidy budget.<\/p>\n<\/details>\n\nWhat should cloud architects do now?<\/strong><\/summary>\nConduct an honest self\u2011assessment of your own stack and determine which Assurance level it reaches. Data storage, key management and the supply chain have long lead times and cannot be upgraded to Level\u202f3 on short notice.<\/p>\n<\/details>\n
\nEditorial Reading Tips<\/p>\n
- \n
- Sovereignty becomes a verifiable level:<\/strong> CADA defines four assurance levels for cloud services to the public sector, from Level 1 as a minimum requirement to Level 4 with full control over the supply chain without third-country influence.<\/li>\n
- From Level 3, origin matters:<\/strong> Providers must be owned and controlled from the EU, including criteria on the nationality of personnel. This practically excludes US-controlled hyperscalers.<\/li>\n
- This is still a proposal:<\/strong> The draft dates back to June 3, 2026; adoption is still pending. However, those planning public procurement will benefit from integrating the level logic into their architecture early on.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>The Germany Stack Goes Operational<\/a> \/<\/span> Separating NIS2 and DORA Cleanly<\/a><\/p>\n
What the Cloud and AI Development Act Aims to Regulate<\/h2>\n
What is CADA?<\/strong> The Cloud and AI Development Act is a proposed regulation by the EU Commission from June 3, 2026, aimed at strengthening cloud and AI sovereignty in Europe. It is not yet in force but is at the beginning of the legislative process. Its core consists of two key elements.<\/p>\n
The first is infrastructure. The Commission sees a structural deficit in data center capacity in the EU and aims to triple it within five to seven years. This goal is primarily to be achieved through private investments, which the Commission estimates at around \u20ac200 billion. It is essential to distinguish: tripling is the capacity goal, and \u20ac200 billion is the investment sum to be mobilized, not a funding budget.<\/p>\n
The second key element is dependency. A large part of European cloud usage runs through a small number of providers outside the EU. CADA aims to counter this concentration with a verifiable framework, and this is where the assurance levels come into play.<\/p>\n
Four levels that make sovereignty verifiable<\/h2>\n
The leverage of CADA is that sovereignty is tied to verifiable criteria. What was once a buzzword becomes a classification. The proposal defines four assurance levels that the public sector can demand based on risk assessment. The classification follows criteria such as control over the service, control over the supply chain, data handling, infrastructure location, and cybersecurity.<\/p>\n
\n\n\n
\n \nLevel<\/th>\n Core requirement<\/th>\n Who meets it<\/th>\n<\/tr>\n<\/thead>\n \n Level 1<\/strong><\/td>\n Minimum standard for every cloud service to the public sector<\/td>\n Practically all providers<\/td>\n<\/tr>\n \n Level 2<\/strong><\/td>\n Independence from third countries, transparency over the software supply chain<\/td>\n Providers without third-country ties<\/td>\n<\/tr>\n \n Level 3<\/strong><\/td>\n Ownership and control from the EU, personnel nationality criteria<\/td>\n EU providers, hardly US-controlled<\/td>\n<\/tr>\n \n Level 4<\/strong><\/td>\n Full control over the supply chain without influence from third countries<\/td>\n Purely European stacks<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n The grading does not force anyone to opt for a European solution across the board. It leaves the classification to the risk assessment of the respective authority. For an administration with sensitive data, Level 3 or 4 will be a logical requirement, and this will determine the provider selection before the first architecture sketch is created.<\/p>\n
What the levels mean for procurement<\/h2>\n
Here, a regulatory proposal turns into a concrete procurement question. Providers will be recognized by the member states under the framework after an audit. Those that do not meet Level 3 or 4 cannot participate in tenders that require this level, which is not a ban on specific providers but effectively amounts to an exclusion, as a US-controlled hyperscaler can hardly meet the ownership and personnel criteria.<\/p>\n
For architects, this means that the sovereignty level will have to be considered at the beginning of the planning process. If someone designs a system for the public sector and only later realizes that the target authority requires Level 3, they will have to rebuild half of the data storage. The sober consequence is a preliminary question in every procurement project: Which level is required, and which part of the stack already meets it?<\/p>\n
Concretely, this affects more than just the server location. Level 3 requires ownership and control from the EU, which can already fail due to the corporate structure of a provider with a US parent company, regardless of where the servers are located. This also includes key management. Who holds the cryptographic keys and under which jurisdiction they do so determines the classification. And the personnel criteria go as far as who has administrative access to the infrastructure. Pure data residency in a Frankfurt data center only fulfills part of this, and precisely this confusion is common in sovereignty pitches.<\/p>\n
Sovereignty is decided by the infrastructure, not just the contract. Image: Pexels \/ panumas nikhomkhai<\/em><\/figcaption><\/figure>\n Why the Architecture Decision Needs to Be Made Now<\/h2>\n
It’s tempting to delay the issue as long as CADA is just a proposal. However, this calculation rarely pays off. A sovereign stack cannot be retrofitted in the quarter when the tender appears. Data storage, key management, and supply chain are decisions with a long half-life.<\/p>\n
\nStatus and Outlook<\/div>\n\n\nJune 3, 2026<\/div>\nThe EU Commission presents the CADA proposal, including the four assurance levels.<\/div>\n<\/div>\n\nProcedure<\/div>\nParliament and Council negotiate; the text may still change.<\/div>\n<\/div>\n\nAfterwards<\/div>\nSupplier audits and recognition by member states; tripling capacity with the goal of meeting demand by 2035.<\/div>\n<\/div>\n<\/div>\n<\/div>\nAnyone building or selling cloud solutions for the public sector should conduct an honest self-assessment today: What level does their own stack achieve, and where is the next third-country influence that prevents Level 3? This question costs little and saves expensive rework under time pressure later on.<\/p>\n
Frequently Asked Questions<\/h2>\n
\nIs CADA already in effect?<\/strong><\/summary>\n
No. CADA has been a proposal of the EU Commission since 3 June 2026 and is undergoing the legislative process. The text may still change during negotiations with the Parliament and the Council.<\/p>\n<\/details>\n
\nWhat are the four Assurance Levels?<\/strong><\/summary>\n
Four tiered sovereignty levels for cloud services for the public sector. Level 1 is the minimum standard, Level 2 requires third\u2011country independence and supply\u2011chain transparency, Level 3 mandates EU ownership together with personnel criteria, and Level 4 provides full control over the supply chain.<\/p>\n<\/details>\n
\nDoes CADA exclude US providers?<\/strong><\/summary>\n
Not through an outright ban, but in effect. For tenders that require Level 3 or 4, a US\u2011controlled hyperscaler can hardly meet the ownership and personnel criteria and therefore cannot participate.<\/p>\n<\/details>\n
\nWhat does the tripling of datacenter capacity mean?<\/strong><\/summary>\n
The Commission aims to triple EU datacenter capacity within five to seven years. The effort is expected to be driven mainly by private investments of roughly 200\u202fbillion Euro, which should not be confused with a subsidy budget.<\/p>\n<\/details>\n
\nWhat should cloud architects do now?<\/strong><\/summary>\n
Conduct an honest self\u2011assessment of your own stack and determine which Assurance level it reaches. Data storage, key management and the supply chain have long lead times and cannot be upgraded to Level\u202f3 on short notice.<\/p>\n<\/details>\n
\nEditorial Reading Tips<\/p>\n
- From Level 3, origin matters:<\/strong> Providers must be owned and controlled from the EU, including criteria on the nationality of personnel. This practically excludes US-controlled hyperscalers.<\/li>\n