Cloud and AI Development Act
EU law setting sovereignty tiers for cloud and AI infrastructure serving sensitive public services.
The Cloud and AI Development Act reached the Official Journal on 15 July 2026, entering force on 4 August; by 23 July a fifth sovereign-cloud provider, Atos, had launched a platform built around its rules.
Last refreshed: 26 July 2026 · Appears in 2 active topics
Can CAIDA survive a trade war it was never designed to fight?
Timeline for Cloud and AI Development Act
Mentioned in: Atos launches EU-engineered sovereign cloud platform
European Tech SovereigntyPoland proposes model-weights test for state contracts
European Tech SovereigntyMistral ships self-hosted OCR 4 to Europe
European Tech SovereigntyMentioned in: Anthropic AI ban enters its second week
AI: Jobs, Power & MoneyBruegel puts the cloud law at 86bn euros
European Tech SovereigntyBackground
The Cloud and AI Development Act (CADA, drafted earlier as CAIDA) is the European Commission's flagship instrument for infrastructure-layer digital sovereignty, setting sovereignty-tier requirements for the cloud and AI infrastructure EU public bodies rely on. It implements a direct recommendation from Mario Draghi's 2024 competitiveness report and reserves its strictest tier, covering national security, defence, law enforcement and border management workloads, for roughly 1% of public services the Commission judges genuinely sensitive.
The Act missed three consecutive College of Commissioners dates before adoption on 3 June 2026 under reference IP/26/1187 / COM(2026) 502, its scope narrowed to public-sector tenders in health, finance, judicial and energy services, leaving private-sector procurement untouched. It was published in the Official Journal on 15 July 2026 and enters into force on 4 August 2026, with obligations phased from February 2028 to a final compliance Deadline of August 2029, giving public bodies and cloud providers roughly two to three years to restructure sensitive-workload contracts.
Providers now build around the law
CADA reached the Official Journal on 15 July 2026 and enters force on 4 August, with the first sovereignty-tier duties applying from February 2028. The compliance Runway is already shaping the market it regulates: on 23 July, Atos launched a sovereign cloud platform built on open-source components for government, defence and healthcare buyers, becoming a fifth named provider in a field the Commission's own €180m framework had already narrowed to four winners in April.
The law only covers public-sector tenders in health, finance, judicial and energy services, roughly 1% of public services by the Commission's own estimate, leaving the much larger private cloud market untouched. That narrow scope is why providers are competing for a small, symbolically important slice of demand rather than the market as a whole.
The law missed its own launch
CAIDA's third missed adoption date, on 27 May 2026, landed two days before France chaired the G7 Digital Ministerial at Bercy, leaving Paris with no sovereignty package to present to its partners. The slip followed a Franco-German split over roughly $200bn in threatened US automotive tariffs, with Berlin treating digital procurement rules as the lesser exposure.
Adoption finally came on 3 June 2026, narrowed to public-sector tenders after Germany's resistance in the College of Commissioners produced three successive delays. The G7 non-appearance is the clearest single measure of what those delays cost: a missed diplomatic showcase for the Commission's flagship sovereignty instrument.
Why has the EU Cloud and AI Development Act been delayed three times?
How does CAIDA relate to the USTR Section 301 investigation into EU digital rules?
Does CADA restrict private-sector cloud contracts?
When does CADA enter into force?
What is the Cloud and AI Development Act (CADA)?
What is the difference between CAIDA and the existing EU sovereign cloud procurement framework?
How does CADA relate to the Draghi report?
