EU Draft Softens Cloud Sovereignty Rules
The compromise text extends public-sector cloud migration to 18 months and narrows Commission powers, though it remains a negotiating draft.
Updated on Nov. 2, 2026 in Data Centers
The Irish Presidency of the Council of the EU has released a first compromise text on the proposed Cloud and AI Development Act (CADA) Regulation, dated 30 October 2026, that scales back several obligations on Member States and curtails Commission powers. The development is at the draft-negotiation stage, not an enacted rule.
Why it matters
The compromise text narrows the autonomy provisions of CADA, the third pillar of the regulation that sets a four-level cloud sovereignty label for public-sector services. Softening member-state obligations and Commission powers at this stage signals how the EU is balancing cloud sovereignty ambitions against practical deployment constraints for data centre operators.
The draft sets a four-level cloud sovereignty label, requiring public administrations to use a service certified to at least assurance level 1 and services certified to levels 2 to 4 for sensitive activities. The compromise text allows three or more Member States to request review of a third country's associated status, a process the Commission would have three months to decide.
The players
Irish Presidency of the Council of the EU
The rotating Council presidency, currently held by Ireland, which produced the first compromise text on the CADA Regulation.
European Commission
The EU executive body that presented the CADA proposal in June 2026 and would hold the review powers over third-country associated status.
The details
The compromise text is a negotiating draft, so its provisions can still change before adoption. Under the scaled-back text, a Member State authority must inform its counterparts and supply a summary of facts and conclusions before revoking a service's recognition, and those counterparts then have 30 days to object. Revocation would only take effect after a transition period of at least 12 months, giving operators time to adapt.
Timeline
June 2026: The European Commission presented the CADA proposal.
30 October 2026: The Irish Presidency compromise text was dated.
1 November 2026: Agence Europe published its report on the text.
The Tech Race
The compromise text sits within the EU's effort to build a sovereign cloud framework under the CADA proposal presented by the Commission in June 2026. Its softening of Commission powers and extended migration timelines shows how member states are shaping the framework's sovereignty requirements in negotiation.
Public administrations would be required to use cloud services certified to at least assurance level 1, with services at levels 2 to 4 for sensitive work, and the migration window would extend to 18 months. Cloud providers face a harmonised fine ceiling of €1 million or 1% of total worldwide annual turnover, whichever is higher, though these terms remain under negotiation.
The takeaway
The compromise text signals that EU cloud sovereignty rules are being shaped toward longer migration periods and narrower Commission powers. Watch for the Council's position and the Parliament's response to the 30 October text as negotiations on the CADA Regulation continue.
Further reading
For background on how cloud capacity is built and governed, see the Data Centers section.
More information
Read the Irish Presidency CADA compromise text for the full draft provisions.
