The proposal in brief

Following a call for evidence from April to July 2025, the Commission adopted the proposal for the Cloud and AI Development Act (COM(2026) 502) on 3 June 2026 as the centrepiece of the European Technological Sovereignty Package, alongside the revised Chips Act, an EU Open Source Strategy and a roadmap for AI in the energy system. It is not yet law: the file is under negotiation by Parliament and Council, with a rapporteur appointed in mid-2026, adoption expected by the end of 2027 and estimated entry into force in the second quarter of 2029. The act pursues three objectives: research and innovation for next-generation cloud and AI technologies; capacity, with Member States designating data centre acceleration zones and a target of at least tripling EU data centre capacity within five to seven years; and autonomy, through a single EU-wide assessment framework with four assurance levels for public procurement – from EU-located infrastructure (level 1) to demonstrated third-country independence (level 2), EU ownership, control and personnel (level 3), and full supply-chain transparency without third-country interference (level 4). The most critical functions, including defence, are reserved for the highest levels. The proposal also establishes the EuroCloud Federation, open-source obligations for the public sector, a recognition procedure, and a one-year cloud usage mapping for each Member State; operators in NIS2-critical sectors are at first assessed voluntarily, with the Commission empowered to make assessment mandatory by delegated act. The Commission’s diagnosis is blunt: three US providers hold about 70 % of the European cloud market, and the US CLOUD Act as well as the risk that an external actor could disrupt essential services remain the driving concerns.

Five points GISAD recommends for the trilogue negotiations

1. Whoever triples capacity without measuring the operator triples dependence. The tripling target and the acceleration zones apply to anyone who builds – including US hyperscalers erecting data centres in the EU while remaining subject to the CLOUD Act. An EU location alone (level 1) must not count as sovereignty. The measure must be the operator and its legal-order and control anchoring – otherwise the capacity of dependence is tripled.

2. Measure sovereignty instead of declaring it. The level-3 criteria – EU ownership, control and personnel – must be demonstrable economically and technically; shareholding structures are the best-known circumvention route. Verification in operation, recertification upon substantial change, measurement outside the manipulable area. The level-3 recognition clause for third-country providers is the key variable of the negotiations.

3. Critical infrastructure without opt-out. Leaving NIS2-critical operators to voluntary assessment leaves the largest exposure open. GISAD recommends making the assessment mandatory for critical infrastructure from entry into force – not deferring it to a later delegated act.

4. A EuroCloud Federation open to medium-sized providers. Gigafactories and corporate alliances are one path – decentralised medium-sized nodes are the more resilient one. Public administrations as anchor customers should give planning certainty also to smaller European providers, not only to the large ones. A sovereignty framework that only corporate consortia can satisfy trades US hyperscalers for European oligopolies.

5. The four-year evaluation must measure structure, not spending. GISAD recommends as indicators the share of critical public workloads on level-3-plus infrastructure, the origin distribution of operators, and the share of independent European providers – not the number of gigafactories built.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: AI Continent: new Cloud and AI Development Act · European Commission – Cloud and AI Development Act · Proposal COM(2026) 502 (EUR-Lex)