CADA: Scaling EU Cloud Autonomy

CADA: Scaling EU Cloud Autonomy in Foreign Tech Diplomacy By Aleksandra Leks

Introduction:

Digital competitiveness is no longer just an economic concern, but rather a strategic one. The Trump administration’s willingness to treat American technology as a transactional lever has exposed the EU’s precarious reliance on American-managed infrastructure. With Washington increasingly viewing the tech stack as a tool for power politics, Europe faces a systemic strategic vulnerability, where critical services, from banking to defense, are operating on foreign-bought infrastructure, which is ultimately outside of its control.

Under the changing world order, the EU leans towards active development of its digital infrastructure. Central to this shift is the Cloud and AI Development Act (CADA), a legislative framework designed to secure the bloc's digital foundations, aiming to transform tech sovereignty from a political ambition into a reality, ensuring that its essential services remain independent from sudden geopolitical shifts. Does CADA solve the Bloc’s strategic vulnerability?

1. Europe's Cloud Dependency and US Hyperscaler Dominance 1.1 The State of the EU’s Cloud Market

The European Union is heavily reliant on foreign powers, notably the United States and China, for crucial digital technologies like cloud computing, defined by the European Union Agency for Cybersecurity as a paradigm for enabling network access to a scalable and elastic pool of shareable physical or virtual resources with self-service provisioning and administration on demand.1

1 European Union Agency for Cybersecurity. (2020). EUCS – Cloud services scheme: EUCS, a candidate cybersecurity certification scheme for cloud services.

https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme

EU Dependency on Foreign Digital Products and Services2

As outlined in the Mario Draghi report, over 80% of the EU’s digital products, services, infrastructures, and intellectual property come from third countries.3 The Union’s cloud market is dominated by USA hyperscalers like AWS, Microsoft Azure, and Google Cloud, which constitute 65% of the market. In contrast, EU providers hold less than 16%, with the most prominent ones - SAP and Deutsche Telekom each controlling only 2% of the European market.4

2 European Commission. (2024). The future of European competitiveness: A competitiveness strategy for Europe (Part A, p. 57).

3 European Commission. (2024). The future of European competitiveness: A competitiveness strategy for Europe (Part A, p. 57).

4 Synergy Research Group. (2025, July 24). European cloud providers’ local market share now holds steady at 15%.

The EU Cloud Market5

While the US and China invested heavily in information and communications technology (ICT) the EU’s share of global Information and Communications Technology (ICT) revenues decreased between 2013 and 2023, from 22% to 18%, while the US increased its share from 30% to 38%, and China’s rose from 10% to 11%.6

https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-h olds-steady-at-15

5 Synergy Research Group. (2025, July 24). European cloud providers’ local market share now holds steady at 15%.

https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-h olds-steady-at-15

6 Statista (2023). Global market share of the information and communication technology (ICT) market from 2013 to 2023.

https://www.statista.com/statistics/263801/global-market-share-held-by-selected-countries -in-the-ictmarket/

Despite efforts to promote European cloud sovereignty, the EU’s decline in ICT investments makes it difficult to catch up with foreign actors, necessitating substantial annual spending to be increased from about USD 157 billion to USD 1.2 trillion by 2030-2050 to bridge the gap.7

1.2 European Data under Foreign Control

Taking a careful look at the US legal framework surrounding cloud subscription, one can easily deduct how little control Europeans have over the data stored in Europe itself. The Clarifying Lawful Overseas Use of Data (CLOUD) Act which legally obligates American companies to hand over data stored on servers located outside of the US upon request of a US-government entity:

“A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”8

This 2018 newly-adopted law came into life as a result of a legal dispute between the Government of the United States and Microsoft. In 2013, U.S. federal agents issued a warrant to Microsoft under the Stored Communications Act (SCA), to grant access to emails of a suspect involved in a drug-related case. However, the data mentioned was stored on a Microsoft server located in Ireland. The company refused to comply with the ordeal, arguing that the U.S. government did not have the authority to issue warrants for data stored outside the United States.

7 Bauer, M., Erixon, F., & Pandya, D. (2024, May). The EU’s trillion dollar gap in ICT and cloud computing capacities: The case for a new approach to cloud policy (Occasional Paper No. 03/2024). ECIPE.

8 18 U.S.C. § 2713. (2018). https://www.law.cornell.edu/uscode/text/18/2713

This means that the United States Government could contact an American cloud service provider (like Microsoft, Google, or AWS) directly and easily access the data stored in Europe-located servers with no formal consent of the hosting government being needed.

2. CADA - a step towards digital sovereignty?

2.1 CADA Legal Framework

The Cloud and AI Development Act (CADA) is a legislative proposal designed by the European Commission in 2025 to complement existing laws, such as the AI Factories and the Data Act.9 Unlike those regulations, CADA’s primary focus is an investment in digital infrastructure , including AI gigafactories and unifying the legal framework between the member-states, aiming to triple the EU's data centre capacity within the next five to seven years. Proposed under Article 114 of the TFEU, the Act would be directly applicable in all Member States simultaneously upon passage. 10

2.2 CADA Pillars

The CADA proposal consists of three major pillars which, if implemented, would serve as a framework to effectively bridge the technological gap between the EU and the US and China and support the member states with development of a modern infrastructure.

a) First pillar: Advancing research and innovation - boosting broadly understood cutting-edge research and innovation (R&I) in AI-enabling technologies.11

9 European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)7792 51_EN.pdf

10 European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)7792 51_EN.pdf

11 European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

A modern AI-infrastructure requires massive energy consumption. As for now around 1.5% of global energy consumption accounts solely for sustaining the work of data centres globally, with the demand projected to double by 2030.12 According to the Eurostat data, the EU companies face energy prices 2.5 times higher than their US-based counterparts.13 Recognising the need for large energy supply to AI data-centres, the Block aims to develop a resource-efficient data processing infrastructure. To achieve this goal, researchers from the Coalition for Academic Scientific Computation (CASC) suggest solutions such as:

● Usage of AI-Specific Hardware - using chips that perform complex AI tasks much faster and with significantly less electricity than standard processors.

● Dynamic Power Management - preventing financial and energy waste by automatically scaling back server activity during low-demand periods or shifting heavy tasks to times when renewable energy is cheapest and most available.

● Optimized computation - improving code efficiency so that the hardware completes tasks faster, reducing the electricity consumption for every AI request.

Furthermore, the European Commission proposes the computation continuum and decentralization as a broader strategic solution for AI leadership, shifting from relying on distant, centralized data centers to a distributed network of processing power. This solution would enable AI to process information in real-time by eliminating the delay of long-distance data travel, avoiding the massive energy consumption required to transport and cool data in centralized warehouses.

b) Second pillar: Creating the right conditions for investment in and deployment of

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)7792 51_EN.pdf

12International Energy Agency. (2024). Electricity 2024: Analysis and forecast to 2026 – Executive summary. https://www.iea.org/reports/electricity-2024/executive-summary

13 Bijnens, G., Hutchinson, J., & Saint Guilhem, A. (2025, May 5). How enduring high energy prices could affect jobs. ECB Blog, European Central Bank.

https://www.ecb.europa.eu/press/blog/date/2025/html/ecb.blog20250505~86c88d726c.en .html

data centres.14

The second pillar seeks to resolve administrative and structural challenges that currently actively prevent private sector investment in sustainable data centers. The Commission critically identifies a significant gap in European technological sovereignty, particularly in comparison with its biggest ally - the United States, which currently possesses twice the share of global data center capabilities as the European Union. As noted in Mario Draghi’s Europe’s structural challenges stem from limited data center capacity, electricity prices, and legal regulations around permitting processes for energy infrastructure that combined create a hostile environment for digital growth. As possible solutions, CADA suggests:

- Facilitating legal procedures: CADA aims to triple the EU’s data centre capacity within the next five to seven years, harmonising and simplifying the legal procedures for data centre construction across the 27 Member States by characterising data centres as critical infrastructure, enabling creating fast-track construction procedures.

- Financial Support: the Commission acknowledges that a significant capital gap might create barriers to newly-founded companies when developing new data centres. As a possible solution, researchers from the European Council on Foreign Relations suggest using the proposed new European competitiveness fund (ECF) alongside EU rules laying down a strategy, and public and private investment to support critical technology innovators.15

14 European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)779251_EN.pdf

15 European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)7792 51_EN.pdf

c) Third pillar: Ensuring highly secure EU-based cloud and AI.

16The third pillar takes a closer look at procedures aiming at protecting European digital sovereignty and cloud sovereignty, ensuring that critical services remain under the Block’s control. Sovereign cloud keeps data local, ensures compliance with European Union (EU) regulations, and protects against foreign access. For regulated sectors, it offers a secure, future-proof path to cloud-driven transformation and control.17 To fulfill those objectives, the Commission proposes Narrowly Defined Critical Use Cases, meaning that a specific set of highly critical use cases, such as defense programs, public administration, and critical infrastructure would be operated exclusively using highly secure EU-based cloud infrastructure.

3. Further Challenges to the EU Cloud Scaling

3.1 Vendor lock-in risks

Because the cloud market requires continuous, massive investment and vast economies of scale, European providers are often restricted to offering basic infrastructure services (IaaS). Consequently, EU firms must frequently host or resell the more profitable and integrated platform services (PaaS) developed by these US giants, creating a high level of "technological dependency" where European companies are deeply connected to foreign platforms that are harder to compete with and are making it harder for customers to leave behind. Draghi warns that this lack of comparable scale for investment makes it difficult for EU operators to enlarge their market share, leaving even "sovereign cloud" solutions as a second-best option because the underlying deep technology is not fully developed within Europe.

3.2 Talent/skills gap

The European Union's competitiveness in high-tech sectors is severely weakened by a structural talent gap and a lack of specialized manpower - a direct result of lack of tech

16 European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(2025)779251_EN.pdf

17 T-Systems. (n.d.). What is the sovereign cloud?

https://www.t-systems.com/de/en/sovereign-cloud/topics/what-is-the-sovereign-cloud

investments in the EU. The Block is struggling to retain its most skilled professionals while failing to attract enough highly qualified migrants to fill technical vacancies in fields like AI and cloud computing.18 One might conclude that those specialists opt for careers in the USA, where the technological sector is significantly more developed, offering attractive career and self-development opportunities. As Draghi points out, the problem is particularly evident in the academic and research sectors, where European universities often cannot offer the competitive salaries or comparable facilities provided by top institutions in the United States.19

18 European Commission. (2024). The future of European competitiveness: A competitiveness strategy for Europe (Part A, p. 37-38).

19 European Commission. (2024). The future of European competitiveness: A competitiveness strategy for Europe (Part A, p. 34).

5. Conclusion

The Cloud and AI Development Act (CADA), expected in the first quarter of 2026, would represent a significant move to extend European technology and governance standards beyond the EU’s borders. By building highly secure, EU‑based cloud capacity under full European control, it would help the Union reduce dependence on foreign providers and strengthen its position in the global digital market. Faster development of cloud and data infrastructure would not only boost the EU’s economic competitiveness, but also raise security standards for sensitive sectors such as defence, public administration and critical infrastructure.

However, CADA would still confront substantial obstacles. Member States remain divided over what should qualify as highly secure cloud capacity. Moreover, structural barriers persist, among them high energy costs, the capital‑intensive nature of data centres, fragmented and too slow legal procedures, and difficulties accessing suitable land, water.

Ultimately, CADA could reduce the EU’s strategic vulnerability, but it would not eliminate it on its own. Unless the underlying political, financial and regulatory challenges are effectively addressed, the Act is more likely to be a necessary first step than a complete solution to the Bloc’s dependence on foreign cloud and AI infrastructure.

6. Bibliography:

1. 18 U.S.C. § 2713. (2018). https://www.law.cornell.edu/uscode/text/18/2713 2. Draghi, M. (2024). The future of European competitiveness: A competitiveness strategy for Europe – Part A: A competitiveness strategy for Europe. European Commission.

https://commission.europa.eu/topics/competitiveness/draghi-report_en 3. European Central Bank. (2025, May 5). How enduring high energy prices could affect jobs.

https://www.ecb.europa.eu/press/blog/date/2025/html/ecb.blog20250505~86c88d7 26c.en.html

4. European Parliamentary Research Service. (2025). Cloud and AI Development Act (Briefing PE 779.251). European Parliament.

https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779251/EPRS_BRI(202 5)779251_EN.pdf

5. European Union Agency for Cybersecurity. (2020). EUCS – Cloud services scheme: EUCS, a candidate cybersecurity certification scheme for cloud services. https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme

6. International Energy Agency. (2024). Electricity 2024: Analysis and forecast to 2026 – Executive summary.

https://www.iea.org/reports/electricity-2024/executive-summary

7. SRG Research. (n.d.). European cloud providers’ local market share now holds steady at 15%.

https://www.srgresearch.com/articles/european-cloud-providers-local-market-share now-holds-steady-at-15

8. Statista. (2023). Global market share of the information and communication technology (ICT) market from 2013 to 2023.

https://www.statista.com/statistics/263801/global-market-share-held-by-selected-co untries-in-the-ictmarket/

9. T-Systems. (n.d.). What is the sovereign cloud?

https://www.t-systems.com/de/en/sovereign-cloud/topics/what-is-the-sovereign-clo ud