Summary Under the proposed Cloud and AI Development Act (CADA), Cyprus would be required to designate one or more single information points (SIPs) to assist data centre operators with all authorisations for projects located in data centre acceleration zones (Article 12). These SIPs would coordinate procedures ranging from spatial planning to grid connections. Crucially, Cyprus would also be obliged to issue an aggregated baseline permit for each acceleration zone, covering zone-level authorisations while excluding installation-specific permits. This mechanism would cap the standard permit-granting procedure at a maximum of 12 months from the submission of a comprehensive application (Article 13). If Cyprus has already established an SIP under the Gigabit Infrastructure Act (Regulation (EU) 2024/1309), it may upgrade or integrate that existing body to fulfil these new CADA obligations, creating a unified "one-stop-shop" for connectivity and infrastructure.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, introduces a harmonised framework designed to accelerate the deployment of data centres across the European Union. For Cyprus, as for all Member States, this represents a structural shift from fragmented national permitting processes to a coordinated, zone-based approach. The core mechanisms driving this change are detailed in Article 12 (Single information points) and Article 13 (Facilitating administrative and permit-granting processes). These provisions aim to reduce regulatory uncertainty and address the "limited and geographically concentrated availability of computing capacity" identified in the proposal's explanatory memorandum.

The Role of the Single Information Point (Article 12)

Article 12 imposes a clear obligation on Cyprus to designate one or more single information points (SIPs) specifically for data centre operators working within designated data centre acceleration zones. The primary function of the SIP is to provide assistance to the operator throughout the entire lifecycle of the data centre project regarding all authorisations required for deployment.

This assistance is not merely advisory; the SIP is tasked with a comprehensive coordination role. According to Article 12(2), the role may include coordinating, facilitating, monitoring, and sharing information on procedures relating to:

  • Spatial planning and building permits.
  • Environmental assessments, conducted in accordance with the upcoming Regulation on speeding-up environmental assessments (referenced as Regulation (EU) 202X/XXX in the proposal).
  • Authorisations regarding water abstraction, wastewater discharge, and heat utilisation and recovery.
  • Compliance with applicable administrative and reporting obligations.
  • Public information campaigns to increase acceptance of the project.
  • Applications for connection to electricity, heat, or communications networks.

A critical feature of Article 12(1) is the provision for leveraging existing administrative infrastructure. The text explicitly states that Member States "may designate for this purpose a single information point established under Regulation (EU) 2024/1309" (the Gigabit Infrastructure Act). If Cyprus chooses this route, the functions, procedures, and mechanisms applicable to the Gigabit SIPβ€”including digital access, administrative coordination, and dispute settlementβ€”would apply to the CADA SIP as well. This creates a potential "one-stop-shop" for both high-speed connectivity and data centre infrastructure, significantly reducing administrative duplication for operators requiring both.

Furthermore, the SIP must pay particular attention to small and medium-sized enterprises (SMEs). Article 12(4) requires the SIP to establish a dedicated channel for communication with SMEs to provide guidance and respond to queries. This ensures that smaller operators, who may lack the extensive legal resources of hyperscalers, are not disadvantaged by the complexity of the new regulatory framework.

The Aggregated Baseline Permit (Article 13)

While the SIP facilitates the process, Article 13 transforms the substantive permitting landscape through the introduction of the aggregated baseline permit.

For each designated acceleration zone, Cyprus must prepare and issue an aggregated baseline permit. Article 13(2) specifies that this permit authorises the deployment of data centres within that specific zone and covers the permits and administrative authorisations required for the data centre projects located within the acceleration zone. However, it explicitly excludes installation-specific permits.

This distinction is vital for operators. The aggregated baseline permit effectively pre-approves the zone-level environmental and planning impacts. Before issuing this permit, Article 13(3) mandates that Cyprus must carry out all necessary procedures and assessments, including any relevant environmental assessments and planning procedures applicable at the level of the acceleration zone. Consequently, data centres deployed in these zones are only required to obtain additional permits for activities falling outside the scope of the aggregated baseline permit. This shifts the regulatory burden from the individual project to the zone level, streamlining the entry for multiple projects within the same area.

Time Limits and Strategic Status

Article 13(5) imposes a strict deadline on the administrative process. The permit-granting procedure for data centre projects deployed in acceleration zones shall not exceed 12 months from the moment a comprehensive application has been submitted. This time limit is without prejudice to any shorter time limits Cyprus may set domestically.

To ensure this speed, Cyprus must ensure that administrative applications are processed in an efficient, transparent, and timely manner. The provision further states that where a status of "highest national significance" exists in national law, data centre projects in acceleration zones should be allocated this status to expedite processing. However, Article 13(5) clarifies that this paragraph "shall not create an obligation for Member States to introduce such status" if it does not already exist in national law. Thus, while CADA would accelerate the timeline, it would not force Cyprus to create new statutory categories of national significance if none exist.

Interaction with the Gigabit Infrastructure Act

The interaction with Regulation (EU) 2024/1309 (the Gigabit Infrastructure Act) is a key efficiency measure. Article 12(1) allows Cyprus to designate an SIP established under that Regulation for data centre purposes. The Gigabit Infrastructure Act already requires Member States to designate single information points to reduce the cost of deploying gigabit electronic communications networks. By allowing the integration of these two functions, CADA would prevent the creation of parallel administrative silos. If Cyprus integrates its existing Gigabit SIP, operators could receive coordinated support for both the physical data centre infrastructure and the necessary high-speed network connections, aligning with the proposal's goal of "accelerating the deployment of data centres" while ensuring "high-speed, gigabit and beyond connectivity is a prerequisite."

Sovereignty and Permitting

It is important to distinguish the permitting process under Articles 12 and 13 from the sovereignty framework established in Title IV of CADA. While Articles 12 and 13 focus on physical deployment, environmental compliance, and administrative speed, the Union cloud computing sovereignty framework (Articles 16–28) governs the assurance levels required for cloud services provided to public sector bodies. A data centre operator in Cyprus could benefit from the 12-month permitting cap for their physical infrastructure but would still need to undergo independent audits and obtain recognition at a specific Union assurance level (1–4) if they intend to serve public sector clients. The permitting process does not automatically confer sovereignty status; the two tracks operate in parallel.

What this means for you

For CTOs, infrastructure architects, and SMEs evaluating the practical impact of CADA in Cyprus, the introduction of the Single Information Point and the Aggregated Baseline Permit represents a significant reduction in regulatory uncertainty and timeline risk.

For Project Timelines and Budgeting

The 12-month cap on permit-granting procedures (Article 13(5)) provides a hard ceiling for the administrative phase of your project. In the past, data centre projects in Cyprus could face open-ended delays due to fragmented approvals across different ministries (energy, environment, local planning). With the aggregated baseline permit, the zone-level environmental and planning assessments are done once for the zone, not per project. This means your primary focus will be on installation-specific permits (e.g., building safety, specific grid connection details), which should be significantly fewer and faster to resolve. You should budget for a maximum of one year from the submission of a comprehensive application to the final permit, allowing for more accurate ROI calculations and construction scheduling.

For SMEs and Smaller Operators

Article 12(4) explicitly mandates that the SIP establish a dedicated channel for SMEs. This is a critical provision for smaller cloud providers and edge computing operators who may lack the legal teams of hyperscalers. You should actively seek out this dedicated channel when engaging with the Cypriot SIP. It is designed to provide tailored guidance on the implementation of CADA, helping you navigate the specific requirements for water, heat, and grid connections without the need for expensive external legal consultation at the initial stages.

For Strategic Planning and Site Selection

Your site selection strategy should now prioritize locations within designated data centre acceleration zones. Outside these zones, the streamlined procedures and aggregated baseline permits do not apply. You should monitor the Cypriot government's announcements regarding the designation of these zones (required within six months of CADA's entry into force, per Article 10). Once designated, the aggregated baseline permit will provide a level of regulatory certainty that is unavailable in non-acceleration areas. Additionally, if Cyprus integrates its existing Gigabit Infrastructure Act SIP, you may benefit from a unified point of contact for both your data centre's physical infrastructure and its high-speed connectivity requirements, simplifying your vendor and regulatory management.

For Compliance and Documentation

Ensure your applications are comprehensive. The 12-month clock starts ticking from the moment a "comprehensive application" is submitted (Article 13(5)). Incomplete applications could lead to delays or restarts of the clock, negating the benefits of the accelerated process. Work closely with the SIP from the pre-application phase to ensure your documentation covers all aspects of the aggregated baseline permit and any installation-specific requirements.

Common misconceptions

Misconception 1: The Single Information Point makes decisions for you. The SIP is a facilitator and coordinator, not a decision-making authority. It assists with the process, shares information, and helps coordinate between different authorities (e.g., energy, environment, local planning). The actual permits are still issued by the relevant competent authorities. The SIP's role is to ensure these authorities work together efficiently and that you are guided through the process, but it does not replace the need for formal approvals.

Misconception 2: The Aggregated Baseline Permit covers everything. The aggregated baseline permit covers zone-level authorisations, such as environmental assessments and spatial planning for the acceleration zone as a whole. It explicitly excludes installation-specific permits (Article 13(2)). You will still need to obtain permits for specific building constructions, electrical installations, and other project-specific details. However, the number of such permits should be significantly reduced compared to traditional projects.

Misconception 3: Cyprus must create a brand new SIP from scratch. Article 12(1) allows Cyprus to designate an SIP established under Regulation (EU) 2024/1309 (the Gigabit Infrastructure Act). If Cyprus has already set up an SIP for gigabit network deployment, it can upgrade or integrate this existing body to handle data centre projects. This means the infrastructure for streamlined permitting may already be partially in place, and the transition could be smoother than creating a new agency entirely.

Misconception 4: The 12-month limit applies to all data centre projects in Cyprus. The 12-month permit-granting limit (Article 13(5)) applies only to data centre projects deployed in data centre acceleration zones. Projects outside these designated zones are subject to standard national permitting procedures, which may be longer and less coordinated. Therefore, locating your data centre within an acceleration zone is a strategic necessity if you want to benefit from CADA's accelerated timelines.

Misconception 5: CADA overrides national environmental laws. CADA does not override national environmental laws; rather, it accelerates the process of environmental assessments within the framework of the upcoming Regulation on speeding-up environmental assessments. Article 13(3) requires Cyprus to carry out all necessary environmental assessments before issuing the aggregated baseline permit. The proposal aims to "maintain high levels of protection of human health and the environment" while reducing administrative bottlenecks.

Related

This is general information about a draft EU regulation, not legal advice.