Summary Yes, as proposed, the Cloud and AI Development Act (CADA) explicitly mandates the sharing of AI models and data across public services to prevent fragmentation. Article 4(7)(c) establishes a specific operational objective to "promote the sharing and reusing of training data and AI models across the Union's public services." This initiative relies on privacy-preserving frameworks, such as federated learning, to enable collaboration without compromising data confidentiality. These efforts are structurally supported by the EuroCloud Federation (established under Article 34), which provides the sovereign infrastructure necessary for secure cross-border data and model exchange.

Detail

The proposed Cloud and AI Development Act (CADA) identifies the siloed development of AI within the European public sector as a critical inefficiency. Currently, Member States and Union entities often develop similar AI solutions in isolation, resulting in duplicated costs, inconsistent technical standards, and a failure to leverage successful innovations across borders. To address this, CADA proposes a structured legal framework that transforms data and model sharing from an optional best practice into a core operational objective of the EU's cloud and AI ecosystem.

The Legal Mandate: Article 4(7)(c)

The primary driver for this initiative is found in Article 4, which defines the operational objectives of the Cloud and AI Leadership Initiatives. Specifically, Article 4(7)(c) sets a clear directive for the Union's strategic funding and coordination mechanisms. It states that the initiatives shall:

"(c) promote the sharing and reusing of training data and AI models across the Union's public services;"

This provision is not merely aspirational; it is a binding operational objective for the Commission and Member States as they implement the Act. By embedding this requirement into the legislation, CADA ensures that future EU-funded projects, national strategies, and public procurement activities must prioritize interoperability and reuse. The legislative intent is to move the public sector away from "reinventing the wheel" in every jurisdiction. If a public service in one Member State develops a robust AI model for healthcare diagnostics or administrative processing, CADA aims to create the necessary technical and legal pathways for that model to be adapted and reused by public services in other Member States. This approach is designed to accelerate digital transformation, reduce public expenditure, and enhance the overall quality of public services across the Union.

Privacy-Preserving Frameworks and Data Security

A primary concern in cross-border data sharing is the protection of personal data and sensitive information. CADA explicitly addresses this by mandating the use of advanced technical solutions that allow for collaboration without the transfer of raw, sensitive data. This approach is detailed in the explanatory memorandum and reinforced by Annex I, specifically Grand Challenge 8: Public Sector AI.

Annex I, Section 8 outlines the strategic focus for developing AI models and systems based on high-quality public sector data. It states:

"Privacy-preserving frameworks, (such as federated learning and high-fidelity synthetic data generation), that make it possible to train models without compromising the confidentiality of underlying datasets..."

This provision clarifies that public services do not need to share raw citizen data to collaborate effectively. Instead, the Act promotes techniques like federated learning, where the AI model travels to the data rather than the data traveling to the model. This allows for the collective training of powerful AI systems while keeping sensitive data localized and secure within its original jurisdiction. Additionally, the use of high-fidelity synthetic data generation enables the creation of realistic datasets for training without exposing real personal information. These methods align with the GDPR's principles of data minimization and "data protection by design," ensuring that sovereignty and privacy are maintained even in a highly collaborative environment.

The Infrastructure Enabler: The EuroCloud Federation

The sharing of AI models and data is inextricably linked to the infrastructure on which they run. CADA establishes the European public sector cloud federation (EuroCloud Federation) under Article 34 to provide the foundational layer for this collaboration.

Article 34(2) states that the EuroCloud Federation "shall facilitate the sharing of public sector data centre services and cloud computing services between Union entities and public sector bodies." While the Federation primarily focuses on infrastructure (compute, storage, and network resources), it serves as the secure backbone for AI collaboration. By providing a trusted, sovereign, and interoperable cloud environment, the EuroCloud Federation removes the technical barriers that often prevent cross-border data sharing.

Public services can leverage this federated infrastructure to deploy shared AI models securely, knowing that the underlying compute resources meet the Union's strict sovereignty and security standards (Union Assurance Levels). Furthermore, Article 35 outlines the conditions for sharing these services, ensuring that the exchange is governed solely by considerations of public interest and does not distort competition. This creates a "safe harbor" for public entities to collaborate on AI projects without navigating complex commercial procurement rules for every interaction. The Federation effectively operationalizes the sharing mandate of Article 4(7)(c) by providing the secure, sovereign "highway" on which these models and data can travel.

Strategic Alignment with National Strategies

To ensure these sharing mechanisms are effective and not just theoretical, CADA requires Member States to adopt national cloud and AI strategies under Article 7. These strategies must be consistent with the objectives of the Regulation, including the broad deployment and uptake of AI in strategic sectors. By aligning national strategies with the EU's push for data and model sharing, Member States are encouraged to build domestic capabilities that are interoperable with their neighbors from the outset. This ensures that the technical standards and legal frameworks required for sharing are established at the national level, facilitating a seamless Union-wide ecosystem.

What this means for you

For public-sector procurement officers, IT decision-makers, and policy leads, CADA's provisions on sharing AI models and data represent a significant shift in how public digital services are developed and deployed.

  1. Prioritize Interoperability in Procurement: When procuring AI systems or cloud services, evaluate how well the solution integrates with EU-wide frameworks. Solutions that support federated learning, standardized data formats, and open-source components will be more valuable, as they directly facilitate the sharing and reuse mandated by Article 4(7)(c).
  2. Leverage the EuroCloud Federation: Actively explore participation in the EuroCloud Federation. Accessing shared computing resources through this federation can reduce the cost of deploying AI models and provide a secure, sovereign environment for testing and running shared AI services, as envisioned in Article 34.
  3. Adopt Privacy-Preserving Technologies: Invest in or procure AI solutions that utilize privacy-enhancing technologies (PETs) such as federated learning or synthetic data generation. This will allow your organization to contribute to and benefit from cross-border AI training projects without violating data protection laws or compromising citizen privacy.
  4. Collaborate Across Borders: Actively seek partnerships with public entities in other Member States. CADA creates a supportive legal and financial environment for such collaborations, potentially unlocking EU funding for joint AI initiatives that demonstrate the effective sharing of models and data.

Common misconceptions

"CADA forces public services to share all their data." This is incorrect. CADA promotes the sharing of training data and AI models where it adds value and is secure. It explicitly supports privacy-preserving frameworks that allow for collaboration without sharing raw, sensitive personal data. The GDPR and national data protection laws remain fully applicable and are reinforced by these technical safeguards.

"Sharing AI models means losing control over them." No. The sharing mechanisms are designed to be governed by clear legal and technical agreements. The EuroCloud Federation and other frameworks ensure that sovereignty and security standards are maintained. Public entities retain control over their data and can define the terms of model reuse, ensuring that sensitive information never leaves their jurisdiction unless explicitly authorized.

"This only applies to large EU institutions." While Union entities are key players, CADA's provisions on national strategies (Article 7) and the EuroCloud Federation (Article 34) are designed to include Member States and public sector bodies at various levels. The goal is to create a Union-wide ecosystem, not just an EU-level silo, ensuring that local and regional authorities can also benefit from shared innovations.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.