Dublin: Operators in the Irish capital have spent a decade answering questions about megawatts, grid connections and water. The Cloud and AI Development Act asks them something they have never had to answer in a tender document: who controls your software supply chain, and which passport do your administrators hold.
The Commission adopted the proposal on 3 June 2026 inside its technology sovereignty package, alongside a revision of the Chips Act, and anchored it in the AI Continent Action Plan. The Commission sets out three pillars: research and innovation in frontier, industrial and physical AI; capacity, including a pledge to at least triple Union data centre capacity within five to seven years; and autonomy, which is where the argument lives.
The autonomy pillar creates a single sovereignty framework with four assurance levels that public bodies apply according to their own risk assessments. Level 1 requires processing and storage on infrastructure located in the Union. Level 2 adds demonstrated independence from third countries and transparency over the software supply chain. Level 3 requires EU ownership and control plus additional criteria such as personnel citizenship, with a carve-out letting the Commission recognise third-country providers. Level 4 demands full transparency and control over the software supply chain and no third-country interference at all.
The regulation delegates the hard decision
Read the four levels closely and the decisive actor is not the legislator. Public purchasers choose their level through a risk assessment, so national procurement officers in 27 capitals will decide how much of the European public cloud market stays contestable. A ministry that labels payroll processing high risk pushes the contract toward Level 3 and effectively excludes every hyperscaler. A ministry that labels the same workload routine stops at Level 1 and changes nothing. The text promises that the vast majority of the market remains open to partners, yet the text does not control that outcome.
A second tension runs through the proposal. Tripling data centre capacity in five to seven years requires the firms that build at that speed, and those firms are mostly the non-EU providers the autonomy pillar aims to displace. The capacity pillar therefore offers faster permitting and better access to energy, land, water and financing to everyone, while the autonomy pillar reserves the most sensitive public contracts for a narrower group. Both pillars can succeed only if European providers convert cheap permits into genuine scale within the same window, and European cloud revenues today do not suggest that trajectory.
Industry objections deserve a fair hearing. Providers argue that assurance levels will fragment procurement, raise costs for small public bodies, and entrench whichever handful of European firms clears Level 3 first, producing a protected oligopoly rather than a competitive market. Supporters answer that every serious jurisdiction now conditions sensitive public workloads on legal control, that the audit-based recognition route keeps the door open, and that Europe cannot treat extraterritorial data access laws as a theoretical risk.
What decides the file in Parliament
Parliament and the Council now examine the text, and three provisions will absorb most of the negotiating energy. The personnel citizenship criterion at Level 3 sits uneasily beside internal market law and will attract amendments. The common Union procurement framework, which pools public purchasing power, worries member states that run their own sovereign cloud programmes. The permitting acceleration measures touch national planning competence, where the Union persuades rather than commands.
The Commission chose a sovereignty architecture over an outright ban, and that choice leaves room for the market to decide outcomes. It also means the Act will be judged less by its final wording than by the first dozen national risk assessments published after it applies. Operators in Dublin, Frankfurt and Madrid will read those documents more carefully than they read the regulation.
