The Proposed Cloud and AI Development Act
On June 3, 2026, the European Commission published its proposal for a Cloud and AI Development Act. The proposed regulation introduces the first EU-wide harmonized sovereignty framework for cloud services and links it to binding procurement rules for the public sector. Manufacturers that run cloud backends or supply critical infrastructure should take a close look.
Contents
What is the Cloud and AI Development Act?
The Cloud and AI Development Act is a proposal by the European Commission for a regulation to strengthen the European cloud and AI ecosystem. It combines support measures for research and data center expansion with a sovereignty framework of four Union assurance levels. The framework determines which cloud services the public sector may use in the future. The regulation is to apply one year after its entry into force.
Why is the Commission proposing it?
The explanatory memorandum is clear. Three non-European hyperscalers control more than 70% of the European cloud market. The market share of European providers fell from 29% (2017) to 15% (2022) and has stagnated since. The Commission sees risks for data sovereignty, business continuity, and public order, in particular from third-country laws with extraterritorial effect that could allow access to data or interrupt services.
The proposal responds with a package of three strands:
- supply-side support: Cloud and AI Leadership Initiatives and data center acceleration zones with a maximum permitting time of 12 months,
- demand-side measures: procurement obligations and a EuroCloud Federation for the public sector, and
- the sovereignty framework that links the two.
How does the sovereignty framework work?
Title IV is the core of the proposal. Article 16 establishes four Union assurance levels, and Annex II sets out their cumulative criteria. The levels differ mainly in three dimensions: establishment and data localization, control by third countries, and the procedure for demonstrating compliance.
- Level 1 requires establishment in the EU, infrastructure and customer data in the EU, and transparency about subcontractors. Compliance is demonstrated by a conformity self-assessment with an EU declaration of conformity (Article 19).
- Level 2 adds independent third-party audits, software supply chain requirements including a software bill of materials (SBOM), and a cybersecurity certificate at assurance level “substantial” or higher. Third-country control remains permitted if legal, technical, and organizational safeguards prevent data access and service interruption.
- Level 3 in principle excludes providers under third-country control. The only exception is for third countries that the Commission has recognized by implementing act under Article 18. The basis for recognition includes a GDPR adequacy decision and reciprocal market access.
- Level 4 requires complete freedom from third-country control with no possible exception, EU citizenship of the staff, and a cybersecurity certificate at assurance level “high”. Levels 3 and 4 are also meant to allow the hosting of EU classified information.
The recognition procedure runs through the national authority in the Member State where the provider has its headquarters. A recognition is valid across the EU and is entered in a public central register. For levels 2 to 4, an annual review of the audit report is planned.
The links to existing legislation stand out. Annex II takes over the SBOM definition of the Cyber Resilience Act. For evidence of certification, it refers to a future European cybersecurity certification scheme for cloud services under the Cybersecurity Act. In the proposal, the Commission explicitly announces that it will resume work on the long-blocked EUCS scheme. Until then, national schemes apply or, where none exist, evidence of the highest cybersecurity standards customary in the market.
Who will have to use the Union assurance levels?
Within one year after entry into force, Member States and Union bodies must carry out risk assessments and decide which public activities require which assurance levels. Procurement then follows a two-tier logic:
- All public bodies must use at least level 1 services.
- Contracting authorities whose activities have been classified as relevant to public order may only procure services at levels 2 to 4. Examples are activities in the NIS2 sectors, defense, justice, and law enforcement.
Exceptions are narrow, for example when no suitable recognized service is available.
For the private sector, the proposal is cautious for now. Companies in NIS2 sectors of high criticality (Annex I of the NIS2 Directive) can carry out comparable impact assessments voluntarily. The Commission can, however, make such assessments, together with risk mitigation measures, mandatory by delegated act. The proposal names the reason clearly: experience shows that regulated industries mirror public-sector procurement requirements, which shifts the market as a whole.
The proposal also adds award criteria for European added value. When procuring innovative cloud services and AI systems, contracting authorities are to assess how far providers contribute to the European supply chain. Examples are software or hardware developed in the EU. The proposal explicitly ranks this criterion below technical and financial criteria.
What does the proposal mean for manufacturers?
The Cloud and AI Development Act does not address manufacturers of machinery, plant, and equipment directly. They are affected in two ways nonetheless.
First, through their customers. Take a manufacturer of pump systems with a cloud platform for monitoring and remote maintenance whose customers are water utilities. It supplies operators that fall under Annex I of NIS2. If their risk assessments classify the supply activity as relevant to public order, these operators may only use recognized cloud services at levels 2 to 4. The cloud infrastructure that runs the manufacturer's backend then becomes a procurement criterion for the customer, not just a technical detail.
Second, through their own cloud strategy. If you build an IoT backend on a hyperscaler today, you should include the sovereignty debate in your architecture decision. For the first time, the proposal creates a uniform, auditable benchmark for what “sovereign cloud” means in the EU. It is likely to end the patchwork of national criteria catalogs and providers' own “sovereign cloud” offerings. In the proposal, the Commission explicitly states that such offerings do not solve the core problems.
The proposal now enters the ordinary legislative procedure in Parliament and Council. Changes to the content are to be expected, in particular to the third-country rules and the criteria in Annex II. The basic architecture of graded assurance levels and binding procurement is likely to remain. The regulation is to apply one year after entry into force, and the Member States' risk assessments follow within the same period.
