For most of the past decade, "digital sovereignty" in European policy discourse meant data residency: the requirement that data about EU citizens and institutions be stored on servers physically located within the European Union. It was a defensible starting position — one that addressed the most visible dimension of digital dependence — but it was always insufficient. A server located in Frankfurt operated by Amazon Web Services is physically in the EU but legally subject to US jurisdiction under the CLOUD Act (18 U.S.C. § 2713), which requires US-domiciled companies to produce data under their control regardless of where it is physically stored.
The European Commission's Cloud and AI Development Act (CADA), formally proposed on 3 June 2026 as part of the Tech Sovereignty Package, is the most significant acknowledgement to date that data residency is not digital sovereignty. CADA introduces a four-tier assurance framework that moves the definitional boundary from physical location to legal jurisdiction, ownership structure, and supply chain control. This analysis examines what CADA actually requires, why it matters beyond the public sector, and what it means for organisations that have built their cloud strategies on the assumption that EU-hosted equals EU-sovereign.
The Jurisdictional Problem CADA Is Designed to Solve
The CLOUD Act, enacted in 2018, resolved a long-running legal dispute about the extraterritorial reach of US law enforcement requests for data held by US companies. Its resolution was unambiguous: US companies must comply with lawful US government requests for data under their control, regardless of where that data is physically stored. The Act includes a mechanism for bilateral executive agreements that could limit its reach — the US-UK agreement is the most developed example — but no such agreement exists between the US and EU, and the negotiations have been complicated by GDPR's restrictions on international data transfers.
The practical consequence is a structural conflict between EU data protection law and US law enforcement authority. GDPR prohibits the transfer of EU personal data to third countries without adequate protection. The CLOUD Act requires US companies to transfer data to US authorities on demand. When a US hyperscaler hosts EU data, these two legal obligations are in direct tension — and the resolution of that tension is determined by US courts, not EU regulators.
The European Commission has characterised this situation as a strategic vulnerability. With approximately 80% of the professional cloud market in the EU held by non-EU providers — primarily AWS, Microsoft Azure, and Google Cloud — the EU's digital infrastructure is subject to legal regimes it did not design and cannot control. CADA is the legislative response to this vulnerability.
Data residency is not digital sovereignty. The CLOUD Act requires US-domiciled companies to produce data under their control regardless of where it is physically stored. An EU-hosted server operated by a US hyperscaler is legally accessible to US authorities — a fact that CADA's four-tier framework is designed to make impossible to ignore.
The Four-Tier Union Assurance Framework
CADA's central mechanism is a four-tier classification system for cloud services, designed to guide public sector and critical infrastructure procurement. Each tier addresses a different dimension of sovereignty risk:
Level 1: Data Residency
Level 1 requires that data be stored and processed within the EU. This is the baseline — the data residency requirement that has been the de facto standard for sensitive public sector data for several years. Level 1 does not address jurisdictional risk; a US hyperscaler can meet Level 1 requirements while remaining fully subject to CLOUD Act obligations. For most non-sensitive public sector workloads, Level 1 is the appropriate tier.
Level 2: Jurisdictional Independence
Level 2 adds requirements for independence from third-country legal jurisdictions and transparency regarding the software supply chain. A provider meeting Level 2 requirements must demonstrate that it is not subject to legal obligations that could compel it to disclose EU data to non-EU authorities without EU regulatory approval. This effectively excludes US-domiciled providers from Level 2 certification unless they can demonstrate structural separation from their US parent entities — a complex and legally uncertain proposition.
Level 2 also introduces supply chain transparency requirements: providers must disclose the provenance of software components used in their services, including AI models and data processing tools. This is the first formal EU requirement for Software Bills of Materials (SBOMs) in cloud services, and it has significant implications for the AI supply chain, where model provenance is often opaque.
Data residency is not digital sovereignty. The CLOUD Act requires US-domiciled companies to produce data under their control regardless of where it is physically stored. An EU-hosted server operated by a US hyperscaler is legally accessible to US authorities — a fact that CADA's four-tier framework is designed to make impossible to ignore.
Level 3: EU Ownership and Control
Level 3 mandates that providers be owned and controlled within the EU, with potential requirements for personnel citizenship and local governance structures. This tier is designed for the most sensitive government workloads — classified information, critical infrastructure control systems, law enforcement data. Level 3 effectively requires a European cloud provider, and the limited number of European providers with the scale and capability to serve large government workloads is a significant constraint on Level 3 adoption.
Level 4: Strategic Autonomy
Level 4 represents the highest tier, intended for defence and national security applications. It requires absolute transparency and control over the software stack, ensuring that no third country can exert influence over the design, development, or evolution of software components. Level 4 is, in practice, a requirement for sovereign cloud infrastructure — government-owned or government-controlled systems with no commercial cloud dependencies. The number of EU member states with the technical capacity to operate Level 4 infrastructure is small.
The Compliance Cascade: CADA in Context
CADA does not operate in isolation. It sits atop a stack of existing EU digital regulations that together constitute what analysts have termed a "compliance cascade" — a layered set of requirements that interact and reinforce each other in ways that are not always obvious from reading any single instrument.
The EU Data Act
The EU Data Act, with cloud switching provisions effective since 12 September 2025, prohibits vendor lock-in by requiring cloud providers to support data portability and interoperability. By 12 January 2027, providers will be legally barred from charging any fees for data egress or migration. CADA reinforces the Data Act's portability requirements by adding sovereignty-based restrictions on international data transfers — a provider that cannot demonstrate Level 2 compliance cannot be used for sensitive public sector workloads regardless of its portability credentials.
NIS2 and Cybersecurity
The NIS2 Directive enforces strict governance and incident reporting requirements across critical sectors, including 24-hour preliminary warnings and 72-hour detailed reports for significant incidents. NIS2 serves as the baseline security requirement upon which CADA's sovereignty tiers are built. An organisation that is not NIS2-compliant cannot credibly claim CADA Level 2 or above.
DORA
The Digital Operational Resilience Act (DORA), in force since January 2025, requires financial institutions to manage ICT third-party concentration risks. By November 2025, major cloud providers were classified as "Critical Third-Party Providers" under DORA, placing them under direct oversight by EU financial regulators. CADA's sovereignty tiers codify the sovereignty-related expectations already emerging from DORA — financial institutions that have addressed DORA's concentration risk requirements are well-positioned to meet CADA's lower tiers.
The EU AI Act
The 2026 "Digital Omnibus" on AI adjusted some AI Act implementation timelines, deferring the most rigorous obligations for high-risk AI systems to 2 December 2027. However, CADA provides the infrastructure and sovereignty framework necessary for the trustworthy deployment of high-risk AI systems — an organisation cannot credibly claim AI Act compliance for a high-risk AI system hosted on infrastructure that does not meet appropriate CADA sovereignty tiers.
The European Commission's characterisation of non-EU cloud dependence as a strategic vulnerability is not rhetorical. With approximately 80% of the professional cloud market held by non-EU providers, the EU's digital infrastructure is subject to legal regimes it did not design and cannot control.
The European Commission's characterisation of non-EU cloud dependence as a strategic vulnerability is not rhetorical. With approximately 80% of the professional cloud market held by non-EU providers, the EU's digital infrastructure is subject to legal regimes it did not design and cannot control.
Strategic Implications for Multinational Organisations
The most common misreading of CADA is that it is a public sector concern. It is not. The compliance cascade flows downstream from government procurement to every organisation in the supply chain. An organisation that supplies services to EU public sector entities — as a software vendor, data processor, or managed service provider — will face CADA-derived requirements through contractual obligations, even if it is not itself a public sector entity. The sovereign compliance requirement is becoming a standard prerequisite for large-scale enterprise and supply chain contracts.
For private enterprises, treating CADA as a public-sector concern is a strategic error. Sovereign compliance is becoming a standard prerequisite for large-scale enterprise and supply chain contracts — the compliance cascade flows downstream from government procurement to every organisation in the supply chain.
The Multi-Cloud Imperative
CADA's Level 3 and Level 4 requirements effectively necessitate infrastructure providers free from US CLOUD Act reach. For most organisations, this means a multi-cloud or hybrid architecture: US hyperscalers for workloads that do not require Level 2 or above, and European sovereign cloud providers for workloads that do. The practical challenge is that European sovereign cloud providers — OVHcloud, Deutsche Telekom's Open Telekom Cloud, Scaleway, and others — do not yet match the service breadth, geographic coverage, or pricing of the major US hyperscalers. Organisations moving sensitive workloads to European sovereign cloud must accept capability trade-offs.
The Open-Source-First Principle
CADA mandates an "open-source-first" principle for public procurement, which compels vendors to provide Software Bills of Materials (SBOMs) and demonstrate model provenance for AI components. This has significant implications for AI supply chains. Many AI models used in enterprise applications are proprietary, with opaque training data and architecture. CADA's transparency requirements will force a reckoning with AI supply chain opacity — organisations that cannot demonstrate the provenance of AI components in their public sector offerings will be excluded from Level 2 and above procurement.
Infrastructure Investment
CADA mandates a tripling of the EU's total data centre capacity within five to seven years. This is an infrastructure investment target of extraordinary scale — the EU's current data centre capacity is already significant, and tripling it will require sustained capital investment, land, power, and cooling infrastructure. The investment will create opportunities for European data centre operators and construction firms, but it will also create demand for power that intersects with the EU's energy transition objectives. Data centres are energy-intensive; the sovereignty imperative and the decarbonisation imperative must be reconciled.
Legislative Status and Implementation Timeline
CADA is currently a proposed regulation (COM(2026) 502), formally adopted by the European Commission on 3 June 2026. The legislative process — trilogue negotiations between the Commission, Council, and Parliament — is expected to continue into 2027, with final adoption anticipated by late 2027. The Commission has indicated a phased rollout for enforcement:
- February 2028: Lower-tier requirements (Level 1 and Level 2) potentially become mandatory for public sector procurement.
- August 2029: Higher-tier requirements (Level 3 and Level 4) follow for the most sensitive workloads.
For private enterprises, treating CADA as a public-sector concern is a strategic error. Sovereign compliance is becoming a standard prerequisite for large-scale enterprise and supply chain contracts — the compliance cascade flows downstream from government procurement to every organisation in the supply chain.
Although CADA is not yet binding, its principles are already influencing public procurement tenders and infrastructure planning. Organisations that wait for final adoption before beginning compliance planning will face a compressed implementation timeline. The organisations that begin now — assessing their cloud architecture against CADA's tiers, identifying workloads that require Level 2 or above, and evaluating European sovereign cloud alternatives — will be better positioned when the regulation takes effect.
What CADA Does Not Solve
CADA is a significant step forward in EU digital sovereignty policy, but it is not a complete solution to the structural dependencies it identifies. Several limitations are worth noting:
The Capability Gap
European sovereign cloud providers do not yet match the service breadth of US hyperscalers. The AI services, machine learning platforms, and developer tooling available on AWS, Azure, and Google Cloud are significantly more mature than those available on European alternatives. Organisations that move sensitive workloads to European sovereign cloud will face capability trade-offs that may affect their competitiveness. CADA's infrastructure investment mandate addresses the capacity gap but not the capability gap.
The Talent Gap
Building and operating sovereign cloud infrastructure requires specialised talent — cloud architects, security engineers, AI researchers — that is in short supply across Europe. The talent gap is a binding constraint on the pace of sovereign cloud development that CADA does not address.
The Interoperability Challenge
CADA's open-source-first principle and SBOM requirements are designed to promote interoperability, but the practical implementation of interoperability between sovereign cloud environments and commercial cloud environments is technically complex. The standards for cloud interoperability — APIs, data formats, identity federation — are not yet mature enough to support seamless workload portability across sovereignty tiers.
The Global Dimension
CADA addresses EU digital sovereignty but does not resolve the global dimension of digital dependence. EU organisations that operate globally — or that use cloud services provided by non-EU, non-US providers — face sovereignty questions that CADA's framework does not address. The bilateral executive agreement mechanism in the CLOUD Act provides a partial solution for US-EU data flows, but no equivalent mechanism exists for data flows involving China, India, or other major digital economies.
Conclusion: The Sovereignty Reckoning
CADA represents a maturation of EU digital sovereignty policy from a data residency requirement to a comprehensive framework addressing legal jurisdiction, ownership, and supply chain control. Its four-tier assurance framework makes explicit what was always implicit: that hosting data in the EU while using US-domiciled providers does not constitute digital sovereignty. The CLOUD Act's extraterritorial reach means that data residency without jurisdictional independence is a compliance posture, not a sovereignty posture.
For organisations operating in or supplying to the EU market, the implications are clear. The compliance cascade from CADA, the Data Act, NIS2, DORA, and the AI Act creates a layered sovereignty requirement that will affect cloud architecture decisions, vendor selection, AI supply chain management, and infrastructure investment. The organisations that treat CADA as a public sector concern will find themselves excluded from supply chains and procurement processes that have already internalised its requirements. The organisations that engage with it now — as a strategic framework for digital infrastructure, not merely a compliance obligation — will be better positioned for the sovereignty-defined digital economy that CADA is designed to create.
The sovereignty reckoning that CADA represents is not unique to Europe. The questions it raises — who controls the infrastructure that processes your data? under whose legal jurisdiction does that infrastructure operate? what happens to your data when geopolitical relationships change? — are questions that every organisation operating in a digitally dependent economy must eventually answer. Europe has chosen to answer them through legislation. Other jurisdictions will follow, in their own ways and on their own timelines. The organisations that have developed a coherent sovereignty strategy will be prepared for whatever framework emerges.
