Summary Under the proposed Cloud and AI Development Act (CADA), Member States are legally required to embed specific procurement measures within their national cloud and AI strategies. Article 7(2)(f) mandates that these strategies include measures to support innovation through public procurement, explicitly referencing the rules in Article 33. Crucially, Article 33(4) sets a concrete objective: Member States must pursue awarding at least 25% of their procurement for cloud computing services and AI systems to innovative SMEs. To achieve this, national strategies must include detailed plans on how this target will be met. Furthermore, these strategies must align with the digital targets established under Decision (EU) 2022/2481 (the Digital Decade Policy Programme 2030), ensuring that procurement drives broader EU digital transformation goals.

Detail

The proposed Cloud and AI Development Act (CADA), as set out in COM(2026) 502 final, establishes a rigorous framework for Member States to integrate cloud and AI procurement into their national digital policies. This is not a voluntary guideline but a statutory obligation designed to reduce dependency on non-European providers, stimulate the domestic market, and ensure that public spending acts as a catalyst for innovation. The mechanism for this integration is twofold: the structural requirement of the national cloud and AI strategy and the quantitative benchmark for innovation procurement.

The National Cloud and AI Strategy as a Procurement Vehicle

Article 7 of the CADA proposal imposes a clear obligation on Member States to establish "national cloud and AI strategies" (referred to in the text as "national strategies"). These strategies must be adopted within one year of the Regulation's entry into force. Far from being high-level policy statements, these documents serve as operational roadmaps that must contain specific, actionable measures.

According to Article 7(2)(f), these national strategies must explicitly include:

"measures to support the development of cloud and AI capabilities and promote excellence and innovation, including through public procurement measures, and public procurement of innovation measures set out in Article 33;"

This provision creates a direct legal link between strategic planning and execution. It obliges Member States to define precisely how they will leverage their purchasing power to develop domestic cloud and AI capabilities. Consequently, the national strategy cannot be generic; it must contain concrete plans detailing how public authorities will procure these services, with a specific emphasis on fostering innovation and supporting smaller market players.

Furthermore, Article 7(4) reinforces the strategic coherence of these plans by requiring that national strategies be "consistent with, and contribute to, the associated digital targets established under Article 4 of Decision (EU) 2022/2481." This Decision, known as the Digital Decade Policy Programme 2030, sets specific targets for the digital transformation of businesses, including the adoption of cloud computing, big data, and AI by at least 75% of Union enterprises. By linking national strategies to these targets, CADA ensures that procurement decisions are not made in isolation but contribute to measurable EU-wide outcomes, such as the deployment of climate-neutral, highly secure edge nodes and the reduction of latency in critical regions.

The 25% Innovative SME Objective

While Article 7 establishes the structural requirement to plan for procurement, Article 33 provides the specific quantitative benchmark. The CADA proposal places a significant emphasis on supporting Small and Medium-sized Enterprises (SMEs) to diversify the market and reduce reliance on a limited pool of non-European hyperscalers.

Article 33(4) states unequivocally:

"Member States shall pursue as objective that at least 25% of their procurement for cloud computing services and AI systems be awarded to innovative SMEs. Member States shall include, in their national strategies referred to in Article 7, plans on how they intend to achieve this objective."

This is a pivotal provision for public-sector procurement officers and national policymakers. The language "pursue as objective" indicates a target to strive for rather than a rigid, legally binding quota that would automatically invalidate tenders if missed (which could conflict with EU procurement principles of equal treatment and non-discrimination). However, the requirement to include "plans on how they intend to achieve this objective" in the national strategy transforms this from a vague aspiration into a measurable political and administrative commitment.

To achieve this 25% target, Member States must actively monitor and report on their use of procurement of innovation. Article 33(1) requires Member States to monitor and report on their use of procurement of innovation in cloud computing services and AI systems. Article 33(2) further mandates that these monitoring efforts be used to identify barriers to SME participation, improve access to procurement markets, and support the design of "simplified, proportionate and SME-friendly procurement strategies." This explicitly includes the division of contracts into lots where appropriate, a key mechanism to make large-scale cloud and AI projects accessible to smaller, innovative providers who might otherwise be excluded by the scale of the contract.

Monitoring and Reporting Obligations

The CADA proposal enforces accountability through a lean but strict reporting framework. Under Article 33(3), Member States are required to inform the Commission on a yearly basis regarding specific data points. This annual reporting ensures that the plans outlined in the national strategy are not merely theoretical but are actively implemented and tracked.

The required annual report must include:

  1. The size of the economic operators participating in such procurement.
  2. SME participation trends, specifically including:
    • The number of contracts awarded to SMEs.
    • Their share of the total contract value, expressed as a percentage.
    • Where available, the share of cross-border SME participation.
  3. Measures taken to improve SMEs' access to public procurement procedures.

This data allows the Commission to monitor the overall health of the EU's cloud and AI ecosystem and the effectiveness of the CADA framework in achieving its goal of reducing dependencies and fostering a competitive single market.

Alignment with Digital Decade Targets

The requirement for alignment with Decision (EU) 2022/2481, mentioned in Article 7(4), adds a critical layer of context to the procurement strategy. The Digital Decade targets include specific metrics for cloud adoption and the deployment of edge nodes. By linking national cloud and AI strategies to these targets, CADA ensures that procurement decisions contribute to tangible infrastructure goals.

For instance, the Digital Decade targets the deployment of at least 10,000 climate-neutral, highly secure edge nodes in the Union. When Member States plan their procurement for innovation under Article 33, they must consider how these purchases contribute to these broader infrastructure goals. This means that a procurement plan cannot focus solely on the 25% SME target; it must also ensure that the procured services support low-latency compute capacity, energy efficiency, and the strategic distribution of data centre capacity across the Union.

What this means for you

For public-sector procurement officers, legal advisors, and national strategy coordinators, the proposed CADA introduces several immediate and long-term obligations that will fundamentally reshape how cloud and AI services are purchased and planned.

1. Strategic Planning is Now Procurement Planning You can no longer treat procurement as a standalone operational task. Your Member State's national cloud and AI strategy must explicitly detail how procurement will be used to drive innovation and support SMEs. If your Member State is drafting or updating its national strategy, you must provide input on the specific measures that will be included to meet the Article 7(2)(f) requirements. This includes identifying which procurement tools (e.g., innovation partnerships, pre-commercial procurement, or specific award criteria) will be used to support innovative SMEs. The strategy must be a living document that guides actual tendering processes.

2. The 25% Target Requires Active Management While the 25% target for innovative SMEs under Article 33(4) is an "objective" rather than a strict quota, it requires active management and deliberate planning. Procurement officers will need to:

  • Structure Tenders for SMEs: Break down large cloud and AI contracts into smaller, manageable lots to make them accessible to smaller, innovative providers who lack the capacity to bid on massive, monolithic contracts.
  • Simplify Requirements: Ensure that technical specifications, financial guarantees, and administrative burdens do not disproportionately exclude SMEs. The strategy must outline how these barriers will be removed.
  • Track Data: Implement robust internal tracking systems to monitor the share of contracts awarded to innovative SMEs. This data is not optional; it is the basis for the annual report required by Article 33(3).

3. Reporting Burdens and Data Collection Be prepared for increased reporting requirements. Article 33(3) mandates annual reporting on SME participation, including the share of cross-border SMEs. Procurement departments will need to collect and analyze this data systematically, likely requiring new IT systems or processes to tag and categorize contracts by the size and innovativeness of the winning bidder. Failure to report or inaccurate reporting could lead to scrutiny from the Commission, which monitors the implementation of the CADA framework.

4. Alignment with Broader Digital Goals Your procurement decisions must align with the Digital Decade targets. This means considering not just the cost and functionality of cloud and AI services, but also their contribution to broader goals like energy efficiency, security, and the deployment of edge computing infrastructure. When evaluating tenders, you may need to consider how the proposed solution contributes to these strategic objectives, ensuring that the procurement of innovative SMEs also advances the Union's digital sovereignty and sustainability goals.

Common misconceptions

Misconception 1: The 25% SME target is a mandatory quota. Many procurement officers fear that missing the 25% target for innovative SMEs will invalidate a tender or lead to legal challenges. In reality, Article 33(4) uses the language "pursue as objective," which indicates a target to strive for rather than a rigid legal quota. However, because this objective must be planned for in the national strategy under Article 7, it carries significant political and administrative weight. Ignoring it entirely could be seen as a failure to implement the national strategy effectively, potentially triggering Commission intervention or public scrutiny.

Misconception 2: National strategies are optional or purely advisory. Some may view the national cloud and AI strategy as a high-level policy document with no legal teeth. However, Article 7 makes it a mandatory requirement for Member States, with specific content requirements (including procurement measures) and alignment obligations (with Digital Decade targets). The strategy serves as the foundational document for implementing CADA's procurement rules, making it legally significant. Member States must notify the Commission of these strategies within three months of adoption and update them at least every three years.

Misconception 3: Only large cloud providers can meet CADA requirements. A common belief is that only large, established hyperscalers can meet the technical and security requirements of CADA, particularly the higher assurance levels. However, the CADA framework explicitly aims to support SMEs and innovative providers. By setting the 25% target and requiring measures to improve SME access, the legislation encourages a more diverse market. Procurement officers should look for opportunities to engage with smaller, innovative providers, especially for specific modules or components of larger cloud and AI solutions, or for pre-commercial procurement phases.

Misconception 4: CADA replaces existing EU procurement rules. CADA does not replace the EU Public Procurement Directives. Instead, it complements them by introducing specific criteria and objectives for cloud and AI procurement. Procurement officers must still comply with all existing EU procurement laws, but they must now also integrate the specific CADA requirements, such as the use of EU-added-value criteria (Article 32) and the pursuit of the 25% SME target (Article 33). The two frameworks operate in parallel, with CADA adding a layer of strategic direction to the procedural rules of the Directives.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.