The Cloud and AI Development Act is the most concrete attempt so far to turn European talk of digital sovereignty into procurement rules. Proposed by the Commission on 3 June 2026 as part of its Technological Sovereignty Package, it sets out to triple EU data centre capacity within five to seven years and to grade cloud providers by how much control Europeans keep over their data.

The text is still a proposal, so the European Parliament and the Council must now negotiate it. Law firm analysis published on 20 October shows how far the Cloud and AI Development Act would reshape public-sector cloud buying.

Why the Cloud and AI Development Act targets dependence

The problem the Commission describes is one of market structure. US hyperscalers hold roughly 70% of the EU cloud market, and the Union produces less than 10% of the world’s semiconductors. Artificial intelligence raises the stakes, because training and running models depends on both chips and large data centres.

The proposal therefore treats compute capacity as strategic infrastructure. Under the Cloud and AI Development Act, faster permitting and clearer rules for data centres are meant to attract investment, while a separate call for AI gigafactories launched on 30 July 2026 aims to mobilise EUR 20 billion through InvestAI. Capacity and sovereignty are being pursued together.

How the four sovereignty levels would work

The core of the Cloud and AI Development Act is a cloud sovereignty framework with four Union Assurance Levels. Level 1 relies on a provider’s own assessment. Levels 2 to 4 require independent third-party audits and add stricter conditions on where data sits, who can access it, how subcontractors are controlled and who owns the provider.

The framework would become mandatory for public bodies when they buy cloud services. The Commission estimates that about 70% of public-sector use cases fall under Level 1, 20% under Level 2, 9% under Level 3 and 1% under Level 4. In other words, only a thin slice of government workloads would face the toughest ownership and control tests.

That distribution matters for the debate. Critics who fear exclusion of foreign providers should note that most public workloads would need only a self-assessment. Supporters of strict sovereignty, by contrast, may find the top tier too narrow to change the market.

What it means for private companies

Private firms that do not serve the public sector and fall outside the NIS2 cybersecurity directive would face no binding obligations. The draft still has indirect reach. Large buyers often copy public procurement standards, so the assurance levels could become a reference point for contracts, insurers and auditors.

Cloud providers face a practical choice under the Cloud and AI Development Act. Those with European operating structures can market higher assurance levels as a selling point, while global providers will weigh whether to create separate European entities to qualify. The audit costs of Levels 2 to 4 could also favour firms that already hold certifications.

Open questions for lawmakers

Three issues are likely to dominate the Parliament and Council talks. The first is whether the thresholds between levels are clear enough for procurement officers to apply without litigation. The second is whether national governments will accept a single EU framework when many already run their own cloud schemes. The third is whether the capacity targets come with funding or only with permits.

There is also a trade dimension. Partners outside the Union will read the Cloud and AI Development Act for signs of discrimination, and the way ownership and control criteria are written will decide whether they see a safeguard or a barrier.

The Cloud and AI Development Act will not break hyperscaler dominance by itself. Its real test is whether the assurance levels give public buyers a credible way to choose European or European-controlled services at scale, and whether the investment promised alongside them arrives in 2026 and the years that follow.