Summary As proposed, the Cloud and AI Development Act (CADA) establishes a comprehensive framework to accelerate the adoption of Artificial Intelligence within the EU public sector. Through Article 4(7), the proposal mandates the development of AI models specifically for critical domains like healthcare, public administration, and crisis management, aiming to improve service delivery and simplify administrative procedures. The Act promotes the secure sharing of training data and AI models across Member States to avoid fragmentation, while explicitly facilitating privacy-enhancing health data reuse. This is reinforced by a requirement for Member States to adopt national cloud and AI strategies and to establish a network of Experience and Acceleration Centres for AI, ensuring that public bodies have the necessary infrastructure, skills, and strategic direction to deploy sovereign AI solutions.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, represents a strategic shift from merely regulating AI to actively fostering its deployment within the public sector. While the EU AI Act focuses on the safety and fundamental rights of AI systems, CADA addresses the "supply side" of the equation: ensuring that the European public sector has access to the computational capacity, data ecosystems, and technical expertise required to build and deploy AI at scale.

The proposal achieves this through a multi-layered approach involving specific operational objectives, targeted research challenges, and structural governance mechanisms.

Operational Objective 7: Accelerating Public Sector AI

The core legislative driver for public sector AI is found in Article 4(7) of the proposal, which defines Operational Objective 7 of the Cloud and AI Leadership Initiatives. This article explicitly tasks the initiatives with "increasing the development and adoption of AI models and systems across the Union's public sectors."

The text of Article 4(7) outlines five specific mandates to achieve this:

  1. Accelerate Development in Critical Domains: The initiatives must support the technological development and uptake of AI models in "critical public sector domains." The proposal specifically highlights healthcare, public administration, law, and crisis management as priority areas where AI can have the most significant impact.
  2. Improve Service Delivery and Decision-Making: The objective is to develop AI systems that "increase the effectiveness of public service delivery and accessibility for the general public." This includes using AI to "improve decision-making" and "simplify administrative procedures," thereby reducing bureaucratic burdens on citizens and businesses.
  3. Share and Reuse Data and Models: To prevent the "fragmentation" of AI capabilities across the Union, Article 4(7) promotes the "sharing and reusing of training data and AI models across the Union's public services." This is designed to enable the "scaling-up of successful, user-oriented solutions" rather than having every Member State or agency develop isolated systems from scratch.
  4. Facilitate Health Data Reuse: Recognizing the unique sensitivity and value of health data, the proposal includes a specific measure to "facilitate secure, privacy-enhancing health data reuse for AI models and tools in healthcare." This acknowledges that while data protection is paramount, the potential for AI to revolutionize diagnostics and treatment requires secure mechanisms for data utilization.
  5. Support Automotive and Mobility AI: While broader than just the public sector, Article 4(7) also mandates facilitating the "development, testing and deployment of AI models and tools in the automotive sector, including for autonomous driving." This highlights the intersection of public infrastructure (roads, traffic management) and advanced AI deployment.

Grand Challenge 8: Public Sector AI

To translate these high-level operational objectives into concrete research and innovation outcomes, CADA establishes a series of "Grand Challenges" in Annex I. Grand Challenge 8 is dedicated exclusively to "Public Sector AI."

The scope of Grand Challenge 8 is defined by its focus on developing AI models and systems based on "high-quality data from the public sector." The challenge targets the following critical domains:

  • Healthcare
  • Public administration
  • Law
  • Crisis management
  • Public services

The primary goal is to create public service solutions that have a "high positive impact on the most critical public services" and can be "shared across different levels of public sector organisations." A key technical requirement of this challenge is enabling "data sharing and frontier model development across national public services."

Crucially, Grand Challenge 8 addresses the tension between data utility and privacy. It explicitly calls for the use of "privacy-preserving frameworks," such as:

  • Federated learning: A technique where models are trained across multiple decentralized devices or servers holding local data samples, without exchanging them.
  • High-fidelity synthetic data generation: Creating artificial data that mimics the statistical properties of real data without containing actual personal information.

These technologies allow for the training of advanced AI models without "compromising the confidentiality of underlying datasets." The challenge also aims to accelerate the "broad uptake of those models, including at regional and local level," ensuring that innovation is not limited to central governments but permeates the entire public administration.

National Strategies and Centres for AI

The proposal recognizes that technology alone is insufficient; it requires a supportive ecosystem of governance and expertise. This is achieved through two key structural pillars: National Strategies and the Centres for AI network.

National Cloud and AI Strategies Under Article 7, Member States are required to establish "national cloud and AI strategies" within one year of the regulation's entry into force. These strategies are not merely advisory; they are mandatory planning documents that must include specific measures to:

  • Accelerate the development and adoption of cloud and AI at national, regional, and local levels, with a particular focus on "public sector bodies."
  • Support the broad deployment of AI in strategic sectors, including "healthcare, energy and mobility."
  • Invest in high-intensity computing infrastructure, such as "AI factories" and "AI gigafactories," which serve as strategic assets for research and industrial AI deployment.
  • Promote the development of cloud and AI capabilities through "public procurement measures."

These strategies ensure that public sector AI adoption is coordinated, monitored, and aligned with the broader EU objectives of technological sovereignty. They serve as the roadmap for how each Member State will implement the "AI first" principle, urging organizations to reflect on their business processes and consider the opportunities offered by AI.

Experience and Acceleration Centres for AI To ensure that public sector bodies, particularly smaller municipalities or agencies with limited technical resources, can access the necessary expertise, Article 5 mandates the establishment of "Experience and Acceleration Centres for AI" (Centres for AI) in each Member State. These centres build upon the existing network of European Digital Innovation Hubs.

The specific tasks of the Centres for AI relevant to the public sector include:

  • Scaling Up Use Cases: Supporting the integration and scaling-up of AI use cases in strategic public sectors.
  • Regional Adoption: Accelerating the broad adoption of cloud and AI technologies at regional and local levels, notably for public sector bodies.
  • Digital Transformation: Helping organizations accelerate their digital transformation by connecting them with European providers of cloud and AI technologies.
  • Skills Development: Ensuring or providing access to relevant "upskilling and reskilling schemes," in close collaboration with the AI Skills Academy, to equip public servants with the necessary competencies.
  • Infrastructure Access: Leveraging relevant infrastructure to accelerate the development and fine-tuning of AI models and systems.

By creating this network, CADA ensures that the benefits of the Cloud and AI Leadership Initiatives are distributed geographically and that public sector bodies have a "one-stop-shop" for technical support, testing facilities, and skills training.

Sovereignty and Procurement Integration

While the primary focus of this article is on development and adoption, it is important to note that CADA integrates these efforts with a robust sovereignty framework. Article 30 requires public sector bodies to procure cloud computing services that meet specific "Union assurance levels." For activities contributing to the preservation of public order (such as law enforcement or national security), higher assurance levels (2, 3, or 4) are mandatory.

This ensures that the AI models and systems developed under Article 4(7) and Grand Challenge 8 are deployed on infrastructure that guarantees data sovereignty, operational autonomy, and resilience against third-country interference. The proposal thus creates a closed loop: it funds the development of sovereign AI, mandates the sharing of data through privacy-preserving means, and requires the procurement of sovereign cloud infrastructure to host these solutions.

What this means for you

For public sector leaders, IT directors, and policy makers, the proposed CADA offers a clear, albeit mandatory, pathway for AI modernization.

  1. Align with National Strategies: If you are a public body, your AI roadmap must align with your Member State's national cloud and AI strategy (required under Article 7). Ensure your projects reflect the "AI first" principle and prioritize domains like healthcare and crisis management.
  2. Engage with Centres for AI: Do not attempt to build AI capabilities in isolation. Reach out to your national Centres for AI (established under Article 5) for access to testing facilities, skills training, and connections to European providers. These centres are designed to lower the barrier to entry for complex AI projects.
  3. Prioritize Data Sharing: Look for opportunities to participate in cross-border data sharing initiatives. The proposal encourages the reuse of training data and models across the Union. By participating in these networks, you can access larger, more diverse datasets that improve the quality of your AI systems.
  4. Adopt Privacy-Enhancing Technologies: For sensitive projects, particularly in healthcare, prioritize solutions that utilize federated learning or synthetic data generation as highlighted in Grand Challenge 8. This allows you to leverage the power of AI while maintaining strict compliance with data protection regulations.
  5. Prepare for Sovereign Procurement: When procuring AI or cloud services, be aware that you will likely be required to select providers that meet specific Union assurance levels (under Article 30). Start evaluating your current providers against these criteria now to ensure continuity of service.

Common misconceptions

"CADA is just about buying more servers."

  • Reality: While infrastructure is a component, CADA is fundamentally about capability. It mandates the development of specific AI models for public use (Article 4(7)), creates a network of human expertise (Centres for AI), and establishes a legal framework for sharing data securely (Grand Challenge 8).

"Public sector AI must be built from scratch by each country."

  • Reality: The proposal explicitly aims to avoid fragmentation. Article 4(7) and Grand Challenge 8 are designed to promote the sharing and reuse of training data and AI models across the Union. The goal is to scale successful solutions, not to reinvent the wheel in every Member State.

"Data sharing means sending all data to a central EU server."

  • Reality: CADA promotes data sharing through privacy-preserving frameworks. Grand Challenge 8 specifically highlights "federated learning" and "synthetic data generation," which allow models to be trained on decentralized data without the raw data ever leaving the local jurisdiction.

"CADA replaces the AI Act."

  • Reality: CADA complements the AI Act. The AI Act ensures AI systems are safe and rights-compliant. CADA ensures the public sector has the sovereign infrastructure and data ecosystems necessary to deploy those systems effectively.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.