EU cloud sovereignty proposal could shut UK firms out of public contracts

The EU’s proposed Cloud and AI Development Act (CADA) could cost the UK economy between £19.6 billion and £22.3 billion, according to modelling by trade body techUK. The legislation would introduce assurance requirements for cloud and AI providers seeking EU public sector contracts, with the strictest categories potentially excluding British suppliers.

Higher assurance tiers would require EU-based staff, data processing and storage within the region, and restrictions on providers subject to third-country control. The European Commission estimates that around 10% of public procurement would fall into the highest categories, but techUK warns that restrictions could spread as more contracts move into those tiers and private buyers adopt similar rules. Compliance requirements and annual supply chain audits could add further costs.

The trade body also warns that excluding UK-headquartered businesses with EU operations could leave European public bodies with fewer suppliers in sensitive areas, including cyber resilience and defence. Ahead of the UK-EU Summit in Brussels on 20 November, techUK is calling for a trusted-partner pathway and reciprocal market openness. It wants sovereignty assessments to focus on technical security safeguards, including customer-exclusive keys, zero-retention policies, data portability and service continuity, rather than ownership.