EU defines four cloud sovereignty levels with the CADA proposal

The European Commission presented the Technology Sovereignty Package on June 3, 2026, a set of initiatives designed to strengthen the continent's digital autonomy. This package includes two key legislative proposals: the Chips Regulation 2.0 and the Cloud and AI Development Act (CADA). The initiative seeks to transform digital sovereignty from a political concept into a binding regulatory framework that determines the conditions under which cloud services can be considered sovereign.

The urgency of this regulation responds to a concerning market reality: three major non-European providers concentrate more than 70% of the European cloud services market. Meanwhile, the market share of EU operators has fallen from 29% in 2017 to 15% in 2022, remaining stagnant since then. CADA attempts to reverse this trend without isolating Europe from the global technology ecosystem, establishing clear criteria for acceptable technological dependence.

The CADA proposal introduces for the first time a four-level assurance classification to determine to what extent a cloud service can be considered sovereign. This stratification allows the public sector and companies to evaluate the degree of control over their data, infrastructures, and technological tools. The system distinguishes between services operating under full European jurisdiction and those that, although present in the EU, maintain critical dependencies with foreign providers.

The legal dimension is the fundamental pillar of this classification. A sovereign service must be subject exclusively to European law, avoiding the application of extraterritorial legislations such as the US CLOUD Act. This US law could allow authorities from that country to access data stored in Europe, a risk that European regulation seeks to mitigate through data residency requirements and independent operational control.

While the EU moves towards strict regulation, US hyperscalers have responded with adaptation strategies. AWS launched its European Sovereign Cloud as a physically and logically separate infrastructure, with all its components located within the EU. The first region of this sovereign cloud is located in the state of Brandenburg, Germany, and is designed to meet the strictest sovereignty requirements demanded by European clients.

Microsoft has followed a similar trajectory with its Microsoft Sovereign Cloud, announced in June 2025. The company offers end-to-end AI data processing in Europe as part of the EU Data Frontier, expanding in-country processing for services like Microsoft 365 Copilot. These initiatives demonstrate that global providers can operate under strict sovereignty frameworks without renouncing their presence in the European market.

For European organizations, CADA implies a deep review of deployment architecture. Companies will have to evaluate not only the physical location of data, but also the applicable legal jurisdiction, the operational independence of the provider, and the underlying technological dependencies. The public sector will be the first affected, as the law establishes specific conditions for the procurement of cloud services by administrations.

Analysts warn that the transition will be gradual. Fernando Pereiro, Director of Analysis at Gartner, points out that "the direction is correct, but execution will be slow". CADA leaves a wide margin for US providers to continue serving the European public sector, provided they meet the corresponding assurance levels. This allows companies to maintain their multi-cloud strategies while gradually adapting to the new regulatory requirements.

The European strategy seeks to balance the need for autonomy with the reality of a globalized market. The European Alliance for Industrial Data, Edge and Cloud works in parallel to foster the development of cutting-edge technologies and next-generation cloud, bringing together companies, member states, and experts to define strategic investment roadmaps. This alliance complements CADA regulation by promoting local innovation and interoperability.

The objectives of the EU Digital Decade establish that, by 2030, 75% of European companies should use cutting-edge cloud technologies. Currently, only 45.2% of companies use cloud services, with adoption varying significantly depending on the size of the organization. CADA and associated measures seek to close this adoption gap while building a European industrial base capable of competing with global hyperscalers.