EU CADA Proposal: What Cloud Buyers Should Know

The EU has put cloud infrastructure back on the strategic agenda. On 3 June 2026, the European Commission adopted a proposal for the Cloud and AI Development Act, or CADA, to strengthen Europe’s cloud and AI ecosystem, investment, and infrastructure, according to the Commission’s original CADA announcement.

For European startups and growing businesses, this is not just policy news. It is a sign that cloud capacity, data centre location, AI compute, and digital sovereignty will keep shaping software buying decisions.

If you are already comparing European infrastructure options, start with EuroToolKit’s Cloud Providers category and our guide to European alternatives to Google Cloud.

What is the Cloud and AI Development Act?

CADA is a proposed EU regulation focused on strengthening Europe’s cloud and AI foundations. According to the Commission, the proposal is meant to support the EU’s cloud and AI ecosystem, investment, and infrastructure.

The proposal sits alongside the EU’s work on AI factories and AI gigafactories. These initiatives aim to give European businesses and researchers broader access to high-capacity computing resources for AI.

The missing layer is wider cloud and data centre capacity. AI tools need compute. Compute needs resilient, energy-aware data centres. And businesses need infrastructure they can evaluate through a European legal and operational lens.

The three goals behind CADA

The Commission describes three main objectives.

First, research, development, and innovation. CADA aims to support next-generation cloud and AI technologies, with a focus on cutting-edge and sustainable systems.

Second, capacity. The proposal seeks to improve the conditions for deploying data centres across the EU, especially facilities that support essential public sector functions.

Third, autonomy. CADA would introduce a single EU-wide assessment framework for cloud and AI sovereignty, together with a public sector adoption mechanism.

That last point matters for buyers. If the EU creates a clearer sovereignty framework, it may become easier to compare providers on jurisdiction, infrastructure, control, and resilience. But the details will matter, and the proposal still needs to move through the EU legislative process.

Why this matters for European startups

Most startups will not build data centres or train frontier AI models. But they still depend on cloud infrastructure every day.

Your hosting provider, analytics stack, AI tools, CRM, email system, and file storage all sit inside a wider infrastructure chain. When that chain crosses borders, uses non-European providers, or depends on unclear subprocessors, your compliance review becomes harder.

CADA does not mean every European company must immediately switch cloud providers. It also does not replace GDPR work, vendor due diligence, or legal advice. But it does underline a practical trend: Europe wants more control over the infrastructure layer behind AI and cloud services.

For startups, that means procurement questions will become more specific:

• Where is customer data stored and processed?
• Which legal jurisdiction applies to the provider?
• Can the provider explain its subprocessors and data transfer setup?
• Does the infrastructure support your security and availability needs?
• Can you document the choice for investors, customers, or public-sector buyers?

These questions are not just for enterprise teams. They are useful for any European business that wants to avoid painful migrations later.

CADA fits a wider sovereignty push

The Commission says CADA complements other initiatives, including Chips Act 2.0 and the EU Open Source Strategy, as part of a more competitive, secure, and resilient European digital economy.

That wider picture is important. Europe is not only regulating digital markets. It is also trying to build more of the technology stack inside Europe, from chips and open source to AI compute and cloud capacity.

For software buyers, this does not mean you should choose a European provider blindly. A European cloud provider still needs the right pricing, uptime, support, integrations, security controls, and migration path. But it does mean European options deserve a serious place on the shortlist.

If your main concern is exposure to non-European legal frameworks, our guide to the US CLOUD Act and FISA 702 explains why provider jurisdiction can matter when choosing infrastructure and SaaS tools.

What to do now

CADA is a proposal, not a finished rulebook. So the best next step is not panic. It is preparation.

Review the cloud and AI services your business already uses. List where important data lives, which vendors process it, and whether you have basic documentation such as DPAs, subprocessors, security pages, and data transfer information.

Then compare your highest-risk tools first. Infrastructure, email, analytics, file storage, AI tools, and customer databases usually deserve early attention because they can touch sensitive or high-volume data.

Finally, keep your options open. A European provider may reduce some jurisdiction and data residency concerns, but it still has to fit your product, budget, team skills, and reliability needs. The goal is not to buy “European” as a slogan. The goal is to choose infrastructure you can explain, document, and trust.

CADA is another signal that cloud sovereignty is moving from policy documents into practical buying decisions. Start building that muscle now, and your next cloud review will be much easier.