The EU Cloud and AI Development Act: What CADA Means for SaaS Buyers and Vendors

On 3 June 2026 the European Commission published its proposal for the Cloud and AI Development Act, known as CADA. It is the centrepiece of a wider Tech Sovereignty Package that spans semiconductors, artificial intelligence, cloud, and open source. For anyone buying or selling software in Europe, CADA is the most consequential sovereignty regulation since the AI Act.

This guide explains what CADA proposes, who it affects, and what practical steps SaaS buyers and vendors should take now, before the regulation works its way through the legislative process.

What CADA Is, in Plain Terms

CADA is a regulation aimed at strengthening Europe's cloud and AI ecosystem and reducing strategic dependence on non-EU providers. It does this in two ways. First, it sets out measures to grow European cloud and AI capacity through investment and infrastructure. Second, and more controversially, it introduces sovereignty requirements for how sensitive data, especially public-sector data, can be processed.

The proposal sits alongside the Sovereign Cloud Framework, under which the Commission awarded a 180 million euro contract in April 2026 to procure sovereign cloud for EU institutions from four providers. CADA is the legislative backbone that the framework points towards.

The Four Sovereignty Tiers

The most discussed element of CADA is a tiered model for cloud sovereignty in the public sector. Rather than a single binary test, the proposal defines escalating levels of sovereignty, from baseline data residency through to full operational and legal independence from non-EU jurisdiction.

The practical effect is that the most sensitive government workloads are expected to sit at the higher tiers, where processing by foreign-controlled providers is restricted. Less sensitive workloads can remain at lower tiers with looser requirements. This graduated approach is designed to be workable rather than absolutist, and it deliberately leaves room for US hyperscalers at the lower tiers.

Why This Matters Beyond Government

CADA's hard requirements focus on the public sector, but its gravity will be felt across the private market. Public procurement is a large share of European IT spending, and vendors that want to sell to government will need to meet sovereignty criteria. That pushes the entire supply chain towards EU jurisdiction, EU operation, and clearer data residency guarantees.

For regulated industries already navigating NIS2 and DORA, CADA adds another reason to evaluate where critical workloads run. Buyers should expect sovereignty questions to move from the legal annex to the centre of the procurement conversation.

What SaaS Buyers Should Do Now

• Map which of your workloads touch public-sector data or regulated data, since these are most exposed to tiered requirements.
• Ask current vendors where data is processed, who controls the infrastructure, and which jurisdiction ultimately applies.
• Treat EU jurisdiction and operational independence as procurement criteria, not nice-to-haves.
• Build optionality on lower-risk workloads first, so you have operational experience before higher-tier requirements bite.

What Vendors Should Do Now

• Document your data residency and processing arrangements clearly, in language a procurement officer can verify.
• Understand which sovereignty tier your offering can credibly meet, and be honest about it.
• If you rely on non-EU subprocessors, map that exposure and plan alternatives.
• Watch the legislative timeline closely, since the final text will shift as it moves through Parliament and Council.

The Bottom Line

CADA does not ban US cloud providers, and it does not force an overnight migration. What it does is make sovereignty a structured, tiered, and increasingly mandatory part of how Europe buys cloud and AI. The direction of travel is unmistakable. Organisations that start mapping their exposure and building credible European options now will be ready when the requirements take effect. Those that wait will be reacting under pressure.

You can explore verified European alternatives across cloud infrastructure, AI, and security in our directory, organised by category and jurisdiction.