Proposed EU cloud law could restrict government access to US AI

The proposed Cloud and AI Development Act (CADA) would introduce accreditation requirements for AI products used by EU governments, with increasingly strict conditions for sensitive applications such as security, defence and justice. Member states would establish national authorities to accredit products. Basic eligibility would require companies to be established in the EU, while stricter tiers would impose requirements on infrastructure, personnel and foreign ownership or influence.

Those conditions could exclude American frontier AI providers from important government contracts. Restrictions involving foreign vulnerability-reporting obligations could also conflict with proposals for mandatory US government oversight supported by leading AI companies. Requirements to prevent service disruption by foreign governments present another potential obstacle, particularly given the risk of US export controls.

The proposal’s impact assessment acknowledges that audits, certification, EU-based infrastructure and staffing requirements would increase customer prices. Beyond costs, restricting access to leading services could constrain public-sector capabilities without producing competitive European alternatives. For Britain, closer alignment raises questions about whether recognition under CADA would require adopting similar restrictions, how that might affect existing US-based services, and whether stronger oversight through AISI could conflict with EU eligibility conditions.