Brussels. 6th November 2026. CISPE supports the ambition and the initiative of the Cloud and AI Data Act (CADA). Mandating sovereign cloud solutions is the right way to reduce dependence and build Europe’s strategic autonomy in the digital sector. That autonomy comes from choice and control, and CISPE stands ready to help deliver it: its Sovereign and Resilient Cloud Services Framework already gives cloud and AI vendors two equally robust ways to demonstrate that their services meet customers’ expectation of control.
Unintended Consequences
However, as drafted by the Commission, the current CADA text may hinder rather than support Europe’s strategic autonomy in cloud and AI. There are several troubling aspects which may have unintended consequences that could derail the ultimate goals of the law.
As we await the rapporteur’s report, and consider the compromise text from the Council Presidency, we are concerned that some of these issues remain unexplored and some positive elements may already even be weakened. Furthermore, with the accelerated and extremely short deadlines for amendments, and the goal to finalise negotiating positions and enter trilogues early next year -will there be sufficient time to fully consider the implications, impacts and consequences of this complex piece of legislation.
Take Time to Consider Legitimate Industry Concerns
We urge all parties to fully consider the voices of Europe’s own cloud and AI players to ensure the finished CADA act is effective in supporting the development of Europe’s cloud and AI capacity.
CISPE’s consultation response raises five main points that require urgent attention:
- It sets a technical bar that disadvantages sovereign European providers whilst allowing in hyperscalers-backed joint ventures;
- It builds a register of trusted services but gives public buyers no reason to use them;
- It leaves loopholes through which foreign-controlled services can be resold as sovereign, and;
- It makes providers prove again what independent audits have already established.
- And it leaves the concept of trusted countries undefined creating uncertainty in EEA and aligned nations.
A Step Backwards?
The compromise text of the Cloud and AI Development Act proposed by the Irish Presidency threatens to weaken CADA and undermine its ambition to create a resilient and growing European capacity in cloud and AI. Whilst the Nation States have suggested changes that close some of the loopholes that would allow overseas providers acting as subcontractors to escape audits and so be included in ‘Sovereign’ cloud and AI services, at the same time the proposed text softens data residency requirements.
For example, the substantial narrowing of the procurement scope, which removes police and defence from scope, eliminates the requirement for all public sector tenders to meet at least level one, and drops the European Commission’s ability to extend provisions to the private sector.
In addition, the removal of the 25% aspiration for inclusion of small and medium-sized enterprises (SMEs) in public sector cloud and AI tenders is concerning, as are changes and limits to criteria regarding how European value add is assessed and considered in those procurements.
Relaxed rules concerning telemetry data would seem to have been included to ease compliance for global providers. We feel that these may run contrary to existing frameworks such as GDPR and NIS 2.
Finally, the problematic requirement for source code audits was not addressed in this compromise text – a missed opportunity to correct one of the most serious holes in the law. In our opinion, these requirements, whatever their intent, remain a significant barrier to any cloud or AI provider that does not own all of the source code in their stack.
Collaborating to Get it Right
CISPE remains committed to a strong and effective Cloud and AI Development Act as an essential step that will reinforce Europe’s growth and position in the global digital economy. It is a complex and far-reaching piece of legislation that will set the tone for the next decade of growth and development. It is therefore vital that due diligence, debate and engagement with the details of its clauses and terms is neither rushed nor truncated and that all voices are heard and considered.
-Ends-