EU CADA Sovereignty Tiers: What the Four Cloud Levels Mean

Key takeaways

• CADA introduces four cloud sovereignty assurance levels for EU public procurement. Four measurable criteria define each level.
• Member States and EU entities must do a sovereignty risk assessment for every cloud use case. This is mandatory.
• The compliance requirement cascades. Organisations that supply public bodies will face the same questions indirectly.
• The four criteria are specific enough to start an internal mapping exercise now, before the EU publishes formal guidance.

The EU’s Cloud and AI Development Act (CADA) was proposed on 3 June 2026. It introduces four cloud sovereignty tiers for public sector procurement. A specific set of criteria defines each tier, and a mandatory risk assessment process attaches to each one. This is the first time the EU has built a formal sovereignty classification system directly into procurement law. Most European organisations buy cloud services from non-EU providers. If your organisation buys cloud from any provider, the tier you sit in will soon become a procurement compliance question, not a strategic preference.

Why CADA exists: a market that has not corrected itself

The EU’s cloud market has become structurally concentrated, and this trend has not reversed. Three US hyperscalers together hold more than 70% of the EU cloud market. European providers held 29% of the market in 2017. That share fell to 15% by 2022, and it has not recovered in four years.

The Commission’s Communication on European Tech Sovereignty (COM(2026) 503) frames this as both a market failure and a security issue. European dependency on non-EU cloud exposes the EU to “risks relating to foreign jurisdictional data reach and surveillance, creating material risks to public order.” High market concentration and vendor lock-in by a few non-EU players, it states, “may reduce competition, slow down innovation and leave public administrations, businesses and citizens vulnerable to economic and security risks.”

CADA is the regulatory response. It does not restrict which providers public bodies can use. Instead, it creates a classification system for how sovereign a cloud service actually is, and it makes that classification a procurement requirement.

CADA’s four cloud sovereignty tiers: what the criteria cover

The Union cloud and AI sovereignty framework in CADA has four distinct assurance levels. These levels form a progression from baseline to full sovereignty. The Commission defines the levels using four criteria:

The four levels scale from a baseline of data residency requirements at the lower end. At the upper end, they require full supply chain control, EU-governed AI inference processing, EU-located infrastructure, and high cybersecurity assurance. Implementing legislation will define the specific criteria for each level. The Commission confirmed that it will publish guidance to ensure a consistent approach across Member States.

Member States and EU entities must do a sovereignty risk assessment to determine which level of assurance each use case needs. This is mandatory, not advisory. Public sector bodies must classify each cloud service they procure against the tier framework. This includes communications platforms, data storage, AI tools, and collaboration environments.

Procurement processes must reflect those classifications. CADA also aims to promote EU added value in public procurement of cloud and AI more broadly. The sovereignty assurance tiers are the mechanism that turns that objective into a concrete, auditable requirement rather than a policy statement.

The compliance cascade: who it affects and when

CADA is a proposal as of June 2026. It is moving through the European Parliament and Council. Two factors make this relevant now rather than in 2028.

The Commission already adopted a Cloud Sovereignty Framework for its own procurement. This framework sets eight concrete sovereignty objectives and minimum assurance levels for cloud providers that serve Commission departments. Public sector bodies at Member State level are watching this as a direct reference point. Procurement language is already shifting ahead of CADA’s formal adoption.

The second factor is the cascade. When a public body procures cloud at a given assurance level, every organisation that supplies services to that body faces indirect pressure. This includes contractors, research partners, and technology vendors. Each must understand and document its own cloud sovereignty position. Requirements do not stay inside public administration. They move through supply chains.

If you have worked through vendor lock-in risks in your AI and cloud infrastructure, CADA adds a direct regulatory dimension to that exposure. The dependency risk was always there. The CADA sovereignty tiers turn it into a compliance classification.

Start the mapping exercise: a five-step checklist

The EU has not yet published formal guidance. But the four criteria are specific enough to start an internal audit today.

1. Map your cloud services — list every platform your organisation uses for communications, data storage, AI tools, and collaboration
2. Identify supply chain visibility — for each service, document what you know about where the software is developed and maintained, and by whom
3. Locate AI inference — if your team uses AI tools, find out where the data is processed and which legal jurisdiction governs the inference
4. Confirm infrastructure geography — check whether your provider can show EU-located infrastructure, and confirm that personnel with operational access fall under EU jurisdiction
5. Audit cybersecurity certifications — identify which EU security certifications your primary cloud providers currently hold or are actively pursuing

None of these steps needs a formal assessment process to start. An inventory mapped against the four criteria gives you the baseline for a sovereignty risk assessment once the Commission publishes guidance.

CADA’s sovereignty tier framework is new. The market problem it addresses has built up for a decade. Three US hyperscalers account for more than 70% of EU cloud infrastructure, and the EU’s own provider share has not recovered in four years. The four assurance levels do not restrict trade. They form a classification system designed to make cloud sovereignty a measurable, procurable, and eventually enforceable standard. Organisations that start mapping their position now will enter the formal assessment process with a documented baseline rather than a blank sheet.

If you are working through cloud strategy or procurement decisions at your organisation, get in touch →

If you found this useful

• “The hidden cost of enterprise AI in Europe: compounding vendor lock-in” — how compounding AI and cloud dependencies create risks that are harder to unwind than they first appear
• “AI Vendor Lock-In: The Startup Audit You Should Run Before Scale” — a practical audit framework for organisations that want to assess their dependency exposure
• “The Infrastructure Gap Slowing Claude Adoption in European Research” — how procurement barriers and infrastructure constraints shape AI adoption decisions across European organisations

Browse all Perspectives or get in touch →