EU cloud sovereignty plan faces proportionality test

The European Commission’s proposed Cloud and AI Development Act, or CADA, sits within the European Commission’s Technological Sovereignty Package and aims to reduce reliance on non-European cloud providers while expanding domestic cloud and AI infrastructure. Its main tools include support for research and adoption, faster data centre permitting, better access to energy and financing, and a cloud sovereignty framework that classifies services by European control.

The sovereignty model places heavy weight on ownership, establishment, jurisdiction and provider control. That approach may be relevant for highly sensitive workloads, but it risks treating provider nationality as a proxy for resilience in a global technology ecosystem built on cross-border hardware, software, personnel, subcontractors and support functions. Extraterritorial legal exposure is also broader than the U.S. CLOUD Act, with examples cited in the EU, UK, Canada and EU Member States.

A more proportionate framework would assess practical safeguards alongside corporate status. Relevant controls include legal challenge mechanisms, customer notification, encryption, customer-controlled key management, data residency commitments, access restrictions, supply chain resilience, continuity planning, portability and independent assurance. Risk-based regimes in the United States, Singapore, Australia and the UK offer alternatives that pursue security and sovereignty through audited controls rather than nationality-based exclusion.