The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement

The legal framework

Status and the texts

The Cloud and AI Development Act is a proposal. The Commission published it on 3 June 2026 as COM(2026) 502 final, a proposal for a Regulation "establishing a framework of measures for strengthening Europe's cloud and AI ecosystem". The procedure is 2026/0138(COD). On 13 November 2026 the Legislative Observatory showed it as "Awaiting committee decision", after referral in Parliament on 17 September 2026. Nothing in it binds anyone yet, and the text can still change.

As proposed, the Regulation would enter into force on the twentieth day after publication and apply one year after entry into force (Article 48). Member States would designate competent authorities within the same year (Article 25(1)), and public bodies would carry out their first risk assessments within that year too (Article 29(1)).

Two adopted texts form the background. The Data Act, Regulation (EU) 2023/2854, already regulates switching between cloud providers in Chapter VI. The proposal's explanatory memorandum calls the Data Act "an enabler" for the new rules. The public procurement Directive, Directive 2014/24/EU, supplies the definition of contracting authority (Article 2(1), point (1)) that the proposal uses.

What the proposal covers

Article 1 lists five measures: the Cloud and AI Leadership Initiatives, faster deployment of data centres, a sovereign cloud and AI offer to safeguard public order, fewer dependencies on critical technologies, and wider use of cloud services in the public sector. This article focuses on the parts that affect contracts: Chapters I and II of Title IV on autonomy (Articles 16 to 33), the European public sector cloud federation and Commission procurement (Articles 34 to 40), and the open source chapter (Articles 41 to 44). Data centre acceleration zones and strategic projects are in Articles 10 to 14. Computing support for AI projects (Articles 8 and 9) is covered in our article on access to EU computing.

Who would be caught

• Cloud computing service providers that want to sell to Union entities and public sector bodies. A provider is any legal entity providing a cloud computing service as defined in the NIS2 Directive (Article 2, points (1) and (2)).
• Contracting authorities and Union entities buying cloud services for their exclusive use (Article 30(1)).
• Bidders for innovative cloud and AI contracts, through the award criteria of Article 32.
• Auditing organisations that audit cloud services (Article 20).
• Private entities in NIS2 Annex I sectors, which may carry out similar assessments, and could be required to if the Commission adopts a delegated act (Article 31).

Example: a Belgian hosting company with data centres in Flanders wants to keep a regional government as a customer. Under the proposal, it would need its service recognised at the assurance level the government's risk assessment requires.

The duties, article by article

Four Union assurance levels (Article 16 and Annex II). The proposal sets up a cloud sovereignty framework with four levels that providers must meet to provide cloud services to Union entities and public sector bodies. The criteria are cumulative and grow with each level. In short, as Annex II drafts them:

• Level 1: provider established in the Union; infrastructure and customer data, including metadata and telemetry, in the Union unless the public body explicitly asks otherwise; state-of-the-art cybersecurity; full transparency on subcontractors.
• Level 2: also subcontractors established in the Union, personnel in the Union, a European cybersecurity certificate of at least "substantial" under the Cybersecurity Act once a cloud scheme exists, no use of data generated by the service to train AI systems operated by a third country or third-country entity, support performed exclusively in the Union, and a software bill of materials. A provider under third-country control must show measures that prevent that control from affecting the service.
• Level 3: personnel who are Union citizens, with security clearance where classified information is handled, and in principle no third-country control. A provider controlled from a third country could only be audited for level 3 if the Commission has listed that country under Article 18.
• Level 4: a certificate of at least "high", no third-country control at all, and effective control over the software components used.

Recognition (Article 17). A provider applies to the competent authority of the Member State where it is established. That authority has 60 days to assess the evidence, then gives the other Member States 60 days to object. Without objection, the recognition is valid throughout the Union. Level 1 statements of conformity issued by SMEs would be recognised automatically (Article 17(3)). Recognition can be revoked for incorrect or misleading information (Article 17(11)).

Associated third countries (Article 18). The Commission could list third countries whose providers may be audited for level 3. The criteria include a GDPR adequacy decision, no measures conflicting with the Data Act rules on lawful access to non-personal data in Article 32(2) and (3), and reciprocal access to public procurement.

Self-assessment and audits (Articles 19 to 21). Level 1 rests on a self-assessment and a public EU statement of conformity, for which the provider takes responsibility. Levels 2 to 4 require an independent third-party audit at the provider's expense. The auditor must be independent: no non-audit services on the audited matters in the 12 months before and after the audit, no audit of the same provider in the previous 10 years, and no fees contingent on the result (Article 20(4)). The audit report is reviewed every year (Article 20(8)).

Repository and transparency (Articles 22 and 23). Recognised services go into a public central repository. A recognised provider must notify the auditor and the competent authority as soon as possible of any material change that may affect its audit or recognition.

Penalties and compensation (Article 24). Member States would set penalties. Customers would have the right to seek compensation from providers for damage caused by a breach of the chapter.

Risk assessments by public bodies (Article 29). Member States and Union entities would identify the public sector activities that use cloud services and contribute to public order in NIS2 sectors and in security, defence, justice and law enforcement. They decide which of levels 2 to 4 fits. If the assessment requires migration to another service, it must happen within a transition period of at most 12 months. They must also consider whether a multi-vendor or multi-cloud strategy is appropriate (Article 29(9)).

Public procurement (Article 30). Public bodies whose activities are not identified as public-order relevant would use services recognised at level 1. Contracting authorities whose activities are identified would only procure services recognised at level 2, 3 or 4. Exceptions are possible where no recognised service can supply the subject matter, where a similar tender in the previous year produced no suitable bids, or where compliance would mean disproportionate cost.

Union added value (Article 32). In tenders for innovative cloud services and AI systems, contracting authorities would have to include non-price award criteria on the bidder's contribution to a European cloud and AI ecosystem, such as the use of software or hardware designed or made in the Union. These criteria must be linked to the subject matter, set out in the tender documents, and "ancillary and not decisive".

SMEs (Article 33). Member States would pursue the objective that at least 25% of their procurement of cloud services and AI systems goes to innovative SMEs.

Shared public cloud and Commission purchasing (Articles 34 to 40). The proposal sets up the EuroCloud Federation, through which public bodies may share their own data centre and cloud services with each other at cost. The Commission could also buy cloud services, software and AI systems as a central purchasing body for Member State contracting authorities, through framework contracts or dynamic purchasing systems.

Open source (Articles 41 to 44). Public bodies would be encouraged to use open standards and open source components. Software they release under an open source licence would be published through the EU Open Source Solutions Catalogue on the Interoperable Europe portal. See Interoperable Europe for the reuse rules already in force.

In practice

For providers, the question is which level to aim for. A provider established in the Union with EU-only infrastructure may reach level 1 by self-assessment. For level 2 and higher, check your subcontractors, support desks, telemetry flows and software supply chain against Annex II now. Data that leaves the Union through a support tool or an AI feature is exactly what the criteria test.

For bidders on AI or cloud tenders, the award criteria of Article 32 would reward use of Union technology. Document where your software, models and hardware come from. You will need that evidence in the tender.

For contracting authorities, the proposal adds a risk-assessment step before buying, and a migration clock of 12 months where the assessment calls for another service. That makes exit terms important. The Data Act already requires a written contract with switching rights, a maximum notice period of two months and a transitional period of 30 days (Article 25). We cover these in switching cloud providers.

Contract steps

1. Add a sovereignty schedule to cloud contracts: location of data, metadata and telemetry; subcontractors and their establishment; where support is performed.
2. Oblige the provider to notify changes that could affect its recognition, mirroring Article 23.
3. Tie termination and migration assistance to a loss of recognition or a change of required level.
4. Ask for the software bill of materials where level 2 or higher is in play.
5. For AI tenders, prepare a short evidence file on Union-made components for the award criteria.

Frequently asked questions

Does the Cloud and AI Development Act already apply?

No. It is a Commission proposal of 3 June 2026, still in the parliamentary committee stage on 13 November 2026. As proposed, it would apply one year after entry into force.

Would non-EU cloud providers be excluded from public contracts?

Not entirely, as drafted. Level 1 requires establishment in the Union, and levels 2 and 3 allow third-country control only with safeguards or, for level 3, a Commission decision under Article 18. Level 4 excludes third-country control. Which level applies depends on the public body's risk assessment.

Does this replace the Data Act switching rules?

No. The proposal builds on them. The Data Act rules on switching, in Articles 23 to 31, keep applying to all providers of data processing services.

Can a private company use the assurance levels?

The levels are written for public procurement. Private entities in NIS2 Annex I sectors may carry out similar assessments under Article 31, and the Commission could make them mandatory by delegated act.

How this connects

The proposal turns sovereignty into contract terms. Our commercial contracts and transactions team drafts and negotiates cloud agreements and tender responses. We review existing cloud contracts against the proposed criteria with the clause library and risk review, and prepare schedules with Document Studio, our proprietary document analysis and development system.

Cited provisions: proposal COM(2026) 502, Articles 1, 2, 16 to 24, 25, 29 to 44 and 48 and Annex II; Regulation (EU) 2023/2854, Articles 25 and 32; Directive 2014/24/EU, Article 2(1).

Key dates:

• 3 June 2026: proposal COM(2026) 502 published
• 17 September 2026: referred to committee in Parliament
• 12 January 2027: Data Act switching charges end (Article 29(1))
• One year after entry into force: proposed date of application

Related reading: the EU Data Act, switching cloud providers, Interoperable Europe, access to EU computing and running a request for information or proposal.