On 11 November 2026, MEPs presented their draft report on the Cloud and AI Development Act (CADA), the European text intended to reduce Europe’s dependence on the American cloud giants. Among other things, they are calling for public buyers to turn more to European providers and for data centres to be authorised more quickly. Companies in critical sectors and cloud providers have every reason to follow this file, which is not expected to be voted on before spring 2027.
What the Commission proposed in June
The Commission published its proposal on 3 June 2026. According to an analysis by the law firm Wilson Sonsini, it is based on four assurance levels that measure how well a cloud service is protected against control from outside the EU, foreign legal risks and service interruptions. Public administrations would have to assess the risks before using the cloud:
- level 1, the lowest, would be sufficient for bodies with no connection to public order;
- levels 2 to 4 would be required in NIS2 sectors linked to public order, as well as for security, defence, justice and law enforcement;
- as a general rule, only providers established in the EU would be eligible; a non-European player could only be selected if it reaches at least level 3 and comes from a country approved by the Commission.
The text also aims to triple data centre capacity in the Union within five to seven years, with “acceleration zones” where Member States would guarantee sufficient electrical power.
What MEPs are calling for
According to Euronews, the joint draft report presented to the European Parliament calls for common rules and standards for cloud and AI infrastructure, more European investment, support for the growth of the continent’s technology companies and stronger protection for critical sectors such as health, energy and transport. It also argues for public administrations to buy more cloud services from European providers. Finally, it wants to speed up authorisations for new data centres, provided they meet environmental requirements and benefit the areas that host them.
The starting point is quantified by the Commission: three non-European hyperscale cloud providers control more than 70% of the European market.
Sovereignty, the central argument
At the press conference, Spanish conservative MEP Diego Solier presented the issue as a question of decision-making capacity and not just competitiveness, while specifying that sovereignty does not mean closing Europe off. Dutch Green Reinier Van Lanschot summed up the concern in one sentence, reported by Euronews: “our critical systems run on someone else’s technology, and someone else can switch it off”. He added that European companies are asking for customers rather than subsidies.
Euronews recalls the context: since Donald Trump’s return, European leaders have come to see the United States as less reliable, and the temporary blocking in June 2026, on Donald Trump’s orders according to the outlet, of access to Anthropic’s Fable 5 and Mythos 5 models outside the United States revived the debate on “kill switches” capable of cutting off European infrastructure.
What it means for businesses
In the short term, nothing: the text is only at the start of the legislative process. But the direction is clear. Cloud providers targeting public contracts will have to prove where their data, assets and even teams are located, and the higher levels will require an independent audit. According to Wilson Sonsini, private operators in the most critical NIS2 sectors, such as energy, banking or health, could be allowed, and encouraged, to apply comparable criteria, with the Commission reserving the right to go further. For European providers, a preference in public procurement would be a major outlet; for customers of American hyperscalers, it is a migration risk to anticipate in long-term contracts.
The timetable
According to Euronews, the draft report was due to be published on 12 November. Parliamentary committees will debate it on 1 December, a committee vote is envisaged for mid-March 2027 and the plenary vote in April. Next, Wilson Sonsini points out, will come negotiations between the Commission, Parliament and the Council to finalise the text.
Frequently asked questions
Will the CADA ban AWS, Azure or Google Cloud from public administrations?
Not across the board. The Commission’s proposal in principle reserves public-sector cloud for providers established in the EU, but provides for an exemption for non-European players that reach at least level 3 and come from a country approved by the Commission, according to Wilson Sonsini’s analysis.
Are private companies affected?
Directly, mainly cloud providers. Private operators in critical sectors within the meaning of NIS2 could also be encouraged to follow similar criteria, according to Wilson Sonsini’s analysis.
When could the text apply?
Not for several years. Parliament plans to vote on its position in April 2027, ahead of negotiations with the Council, followed by an implementation period that has yet to be defined.
Sources
- EU lawmakers push to reduce Europe's dependence on foreign cloud providers — Euronews, 2026-11-11
- European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI — Wilson Sonsini Data Advisor, 2026-06