Galway: A revised draft of the Cloud and AI Development Act would narrow the European Commission’s powers over cloud sovereignty requirements and make compliance easier for public buyers, according to a report from MLex published on 4 November. The Irish presidency of the Council, which chairs member states until the end of the year, prepared the compromise. Ambassadors were scheduled to discuss it on 10 November.

The Cloud and AI Development Act forms part of the EU effort to reduce reliance on non-European technology providers. The Commission proposed rules that would let public authorities favour cloud services meeting sovereignty criteria. Member states have since asked how much discretion Brussels should keep when it defines those criteria, and how quickly buyers must change existing contracts.

The Irish compromise answers both questions in favour of governments and their procurement offices. It would curb the Commission’s room to set sovereignty requirements through its own acts. It would also extend the deadlines for migration, which gives public bodies more time to move workloads away from providers that fail the tests. Both changes lower the immediate cost of the Cloud and AI Development Act for ministries, regions and agencies that run large legacy systems.

A third change touches the technical heart of the sovereignty debate. The draft would allow certain transfers of metadata and telemetry to destinations outside the EU where the transfer serves cybersecurity purposes. Security teams rely on that data to detect attacks across networks, and a strict ban on overseas flows could weaken defences. Critics will ask whether the exemption leaves a gap that large non-EU providers can use.

The politics are delicate. Supporters of strong sovereignty rules argue that a softer text risks turning the Cloud and AI Development Act into a statement of intent without bite. Governments with tight budgets and ageing infrastructure argue that unrealistic deadlines would force costly rushed decisions or leave them in breach of the law. The presidency has tried to find a middle path, but the final balance will depend on which member states push back at working-party level.

Industry will watch the metadata exemption most closely. European cloud providers want clear preference for their services, while global providers want access to the market on fair terms. The compromise gives each camp something to read as a win, which often signals that the hard negotiation has only started.

The Council still needs a position before talks with the European Parliament can open. If the Irish text survives, the Cloud and AI Development Act will reach those talks as a more flexible instrument, and the Commission will have to defend its role in setting sovereignty rules from a weaker starting point.