Summary As proposed, the Cloud and AI Development Act (CADA) does not impose an outright ban on third-country providers, but it establishes a strict conditional pathway for accessing EU public procurement markets, particularly those linked to strategic funding. Providers subject to third-country control can only qualify for Union assurance level 3β€”the highest tier generally available to themβ€”if the European Commission formally recognizes their home country as providing sufficient safeguards. A critical, non-negotiable condition for this recognition is reciprocity: the third country must grant equivalent levels of access to its own public procurement procedures for EU-based providers. Consequently, funding-backed procurement mandates that require sovereign assurance levels will effectively exclude providers from non-reciprocal third countries, regardless of their technical capabilities.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, introduces a "Union cloud computing sovereignty framework" designed to reduce critical dependencies on non-European providers and safeguard the Union's public order. This framework operates through four distinct Union assurance levels (1–4), which dictate the minimum sovereignty standards cloud services must meet before public sector bodies and Union entities can procure them. For third-country providers, the path to market accessβ€”and by extension, access to the substantial procurement budgets often linked to EU funding programmesβ€”is strictly regulated by Article 18 and the detailed criteria in Annex II.

The Architecture of Access: Assurance Levels and Article 18

Under CADA, public procurement is tiered based on risk. Most public sector activities require at least Union assurance level 1. However, activities deemed to contribute to the preservation of public orderβ€”specifically those in sectors falling under Annex I or II of the NIS2 Directive, and in areas such as national security, internal security, external border management, defence, justice, or law enforcementβ€”require Union assurance levels 2, 3, or 4 (Article 30(3)).

For a third-country provider to compete for these high-value, often funding-backed contracts, their service must be formally recognized at a specific assurance level. Article 18 establishes the specific mechanism for recognizing third countries as providing "sufficient assurances" to allow cloud services controlled from that third country to qualify for Union assurance level 3.

It is crucial to note that Union assurance level 4 generally prohibits third-country control entirely (Annex II, Section 4.1(g)), making Level 3 the highest attainable tier for providers subject to third-country jurisdiction. Without a Commission decision under Article 18, a provider subject to third-country control cannot achieve Level 3 and is therefore ineligible for the most critical public-order-sensitive procurements.

The Reciprocity Condition: Article 18(1)(f)

The Commission may adopt implementing acts to identify third countries eligible for Level 3 recognition, but only if they fulfill a set of cumulative criteria listed in Article 18(1). These criteria are designed to ensure that the third country does not pose risks to EU data sovereignty, operational autonomy, or the integrity of the single market.

While the criteria include requirements for GDPR adequacy decisions (Article 18(1)(a)) and the absence of laws compelling service degradation (Article 18(1)(c)), the most commercially significant condition for market access is Article 18(1)(f). This provision mandates that the third country "grants equivalent levels of access to public procurement procedures of cloud computing services subject to the control of a Union Member State or entity or a legal entity established in the Union."

This reciprocity requirement is a two-way street. It means that a third country cannot simply have strong data protection laws or a stable regulatory environment; it must also actively allow EU-based cloud providers to bid for, win, and execute public cloud contracts within that country on terms equivalent to those granted to local providers. If a third country restricts its public cloud procurement to domestic entities, or imposes discriminatory barriers on EU firms, it fails this specific criterion.

Consequently, the Commission cannot adopt an implementing act recognizing that country under Article 18. Without such recognition, providers subject to that country's control cannot be audited against the Level 3 criteria, rendering them ineligible for the highest tiers of public procurement.

Impact on Funding-Backed Procurement and Strategic Investment

CADA is designed to leverage public procurement as a strategic tool to drive investment in European cloud capabilities and reduce dependencies. Many EU funding programmes, such as those under the Digital Europe Programme or the proposed European Competitiveness Fund, are explicitly tied to the deployment of sovereign infrastructure and the adoption of resilient cloud services.

When public authorities procure cloud services using these funds, they are bound by the procurement obligations in Article 30. If the procurement is for a public-order-sensitive activity, the authority must procure services recognized at Level 2, 3, or 4. If a third-country provider's home country does not meet the Article 18 reciprocity test, the provider cannot achieve Level 3. Without Level 3 recognition, they are legally barred from these specific, high-value public contracts, regardless of the funding source.

Furthermore, Article 32 introduces "Union added value" criteria for public procurement of innovative cloud services and AI systems. Contracting authorities are required to include non-price award criteria that evaluate the tenderer's contribution to strengthening the digital technology supply chain in the Union. This includes the use of software or hardware designed or manufactured in the Union. This provision further disadvantages third-country providers who cannot demonstrate such integration, even if they were to achieve Level 3 recognition through a reciprocal agreement. The combination of Article 18 (access to the market) and Article 32 (scoring within the market) creates a robust framework that prioritizes EU-based or deeply integrated providers for strategic funding.

Procedural Safeguards and Dynamic Revocation

The recognition process under Article 18 is not static; it is dynamic and subject to ongoing review. If available information reveals that a third country no longer fulfills the requirements of Article 18(1)β€”for example, if it introduces new restrictions on EU providers' access to its public procurement markets, or if its legal framework changes to allow extraterritorial access to EU dataβ€”the Commission is obligated to repeal, amend, or suspend the recognition decision (Article 18(2)).

The Commission is also required to publish a list of third countries that fulfill the requirements and those that no longer do so (Article 18(3)). This transparency mechanism ensures that market access remains contingent on ongoing reciprocal behavior. A provider that was eligible yesterday could become ineligible tomorrow if their home government alters its procurement policies, creating a significant compliance risk for third-country operators relying on the EU market.

What this means for you

If you are a cloud service provider or data centre operator established in a third country, your ability to bid for EU public cloud contractsβ€”particularly those involving sensitive data or backed by EU strategic fundingβ€”depends heavily on your home government's trade and procurement policies.

  1. Assess Reciprocity Immediately: Verify whether your country grants EU-based cloud providers equivalent access to its public procurement procedures. If your country restricts public cloud bids to domestic entities or imposes discriminatory barriers, you are likely ineligible for Union assurance level 3 under CADA.
  2. Monitor Commission Decisions: Closely watch for the Commission's implementing acts under Article 18. Only providers from recognized third countries can compete for Level 3 contracts. The list of recognized countries is the gatekeeper for high-value public procurement.
  3. Consider Structural Decoupling: To compete at higher assurance levels without relying on Article 18, some third-country providers may need to establish fully independent EU subsidiaries that are not subject to third-country control. Such entities could potentially qualify under the standard criteria for Levels 2–4. However, even then, the "Union added value" criteria in Article 32 may still favour providers with deeper EU supply chain integration.
  4. Level 1 is Insufficient for Strategic Contracts: Note that Union assurance level 1 (Annex II, Section 1) does not have the same strict reciprocity requirement for the country of control and allows for self-assessment. However, Level 1 is typically insufficient for public-order-sensitive procurements, which mandate Level 2, 3, or 4 under Article 30(3). Relying on Level 1 effectively excludes you from the most strategic, funding-backed contracts.

Common misconceptions

  • "CADA bans all third-country cloud providers." Incorrect. CADA does not impose a blanket ban. It creates a tiered system. Providers can access the market at Level 1 (self-assessed) or, if their country is recognized under Article 18, at Level 3. The barrier is not an outright prohibition, but a conditional recognition based on reciprocity and sovereignty safeguards.

  • "Data protection adequacy is enough for public procurement." Incorrect. While Article 18(1)(a) requires an adequacy decision under the GDPR, this is only one of six cumulative conditions. The reciprocity requirement in Article 18(1)(f) is distinct and often harder to meet. A country can have adequate data protection laws but still fail Article 18 if it blocks EU providers from its public cloud markets.

  • "Funding programmes override procurement rules." Incorrect. While EU funding can support cloud deployment, the actual procurement of services by public bodies must comply with CADA's sovereignty framework. Funding may be used to develop infrastructure, but the contracts awarding the use of that infrastructure are subject to Article 30's assurance level requirements. A provider cannot bypass Article 18 simply because a project is funded by the EU.

  • "Article 18 applies to Level 4." Incorrect. Article 18 specifically addresses the derogation for Union assurance level 3. Union assurance level 4 generally requires that the provider and its subcontractors are not subject to the control of a third country (Annex II, Section 4.1(g)), leaving no room for the Article 18 derogation.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.