Presented by the European Commission in June 2026, the Regulation establishing a framework of measures to strengthen Europe’s cloud and AI ecosystem (CADA) aims to accelerate the deployment of data centres and reduce the EU’s dependence on suppliers from third countries. The Commission presents the proposal as essential to EU sovereignty (see EUROPE 13880/2). The Irish Presidency of the Council of the EU has produced its first draft with a view to establishing a common EU Council position. Dated 30 October, its compromise text concerns the Regulation’s third pillar, devoted to autonomy. While retaining the overall structure, it removes several obligations on Member States.
As a reminder, this pillar would establish a four-level cloud sovereignty label, with requirements varying in strictness according to the degree of protection from third countries. Public administrations would have to use a service certified to at least assurance level 1, and to levels 2 to 4 for sensitive activities.
“Associated countries”. On this point, the Irish EU Council Presidency strengthens Member States’ oversight of so-called “associated” third countries. This status, granted by the Commission, allows providers controlled from these countries to obtain assurance level 3. The exception is subject to conditions, including reciprocal access to public procurement markets. Now, three or more Member States “may request the Commission to review the associated status of a third country”. The Commission would have three months to decide. If the status is withdrawn, the affected providers’ services would lose their level 3 recognition.
Sanctions. Beyond associated countries, a new Article sets out the procedure for revoking a service’s recognition by the competent authority of a Member State. That authority must inform its counterparts, providing them with a summary of the facts and its conclusions. They would have 30 days to object. If there is disagreement, the matter may be referred to the Commission. Revocation would take effect only after “a sufficient transition period of at least 12 months”.
On penalties, the compromise introduces a harmonised ceiling for fines of “€1 million or 1% of the total worldwide annual turnover”, whichever is higher.
Public procurement. The Irish text extends the obligation to purchase certified services to “contracting entities” in sectors such as water and electricity, but excludes national security and defence activities from the scope of risk assessments. The period allowed for a public administration to migrate to a certified cloud service is extended from 12 to 18 months.
Commission’s powers curtailed. The Presidency text curtails several of the Commission’s powers. The institution can no longer impose on Member States, through “implementing acts”, the assurance levels it has identified for their public sector activities. The Commission also loses the power to require highly critical private companies in sectors covered by the NIS2 Directive to conduct risk assessments. The text states that there is “no empowerment for the Commission to extend the scope to the private sector through a delegated act”.
Read the compromise: https://aeur.eu/f/o7q (Original version in French by Louis Dubar)