Summary Under the proposed Cloud and AI Development Act (CADA), a colocation provider is generally a data centre service provider β€” CADA defines "data centre service" in Article 2(12) by reference to the NIS2 Directive, which covers colocation. But if the same business also owns and runs the facility, it can simultaneously be a data centre operator under Article 2(11). As proposed, the two definitions are not mutually exclusive, so a single entity can wear both hats and must meet the duties attached to each role it performs.

Detail

To classify a colocation provider under CADA you go to Article 2 of the proposal. CADA does not invent standalone definitions here; it imports them from existing EU instruments β€” chiefly the NIS2 Directive (Directive (EU) 2022/2555) and the data-centre rating framework under Delegated Regulation (EU) 2024/1364.

Data centre service

Article 2(12) of CADA defines a "data centre service" as:

"β€˜data centre service’ means data centre service as defined in Article 6, point (31), of Directive (EU) 2022/2555."

The NIS2 concept of a data centre service centres on a service providing structures, or groups of structures, dedicated to the centralised accommodation, interconnection and operation of IT and network equipment providing data storage, processing and transport β€” the category under which colocation services sit. In a typical colocation arrangement the provider supplies physical space, power, cooling and connectivity while the customer owns the hardware. Because the provider delivers a hosting service rather than necessarily operating the customer's computing resources, it falls within the data centre service provider concept.

For CADA's purposes, that classification connects a colocation provider to the proposal's service-side rules, particularly the sovereignty framework where the colocation business offers or underpins cloud computing services to public sector clients.

Data centre operator

Article 2(11) of CADA defines a "data centre operator" as:

"β€˜data centre operator’ means data centre operator as defined in Article 2, point (7), of Delegated Regulation (EU) 2024/1364."

Delegated Regulation (EU) 2024/1364 establishes the Union rating scheme for data centres. Its data-centre-operator concept focuses on the entity responsible for operating the facility β€” its infrastructure, energy use and operational performance.

The overlap: when a colocation provider is also an operator

The complexity arises when one entity does both. In many markets, the company providing colocation space is also the entity that owns and runs the physical facility.

CADA's definitions are not mutually exclusive β€” an entity can be both a data centre operator and a data centre service provider:

  • As an operator, it is exposed to the proposal's rules on deploying data centre capacity, including provisions on data centre acceleration zones and the designation of strategic projects.
  • As a service provider, it is exposed to the autonomy and sovereignty framework (Title IV), including the path to Union assurance levels where it serves public sector bodies.

If a colocation provider only rents space from a third-party operator and resells it, it is a service provider but not an operator. If it owns the building and infrastructure, it is an operator. If it does both, it must satisfy both sets of obligations.

Why the distinction matters for CADA compliance

  1. Deployment and permitting. The proposal's measures on data centre acceleration zones and facilitated deployment are oriented to those who deploy and operate facilities β€” typically operators. A colocation provider that neither owns nor operates the facility is not the entity responsible for those processes, though it may benefit from them.
  2. Sovereignty and assurance levels. The Title IV sovereignty framework targets cloud computing service providers and, by extension, data centre service providers offering computing resources. A colocation provider that bundles managed or cloud services must engage with the Union assurance levels.
  3. Strategic projects. Designation of data centre strategic projects is geared to the entity deploying the capacity, which is usually the operator.

What this means for you

Map your business model against both definitions:

  • Pure colocation providers. If you supply space, power and cooling but not the servers, you are a data centre service provider. Focus on the sovereignty framework if you intend to serve public sector clients, and assess whether your service can meet the relevant Union assurance level. You are not the entity responsible for facility permitting if you are not the operator.
  • Hybrid providers (operator + service provider). If you own the facility and provide colocation or cloud services, you are both. You must address operator-side deployment and sustainability rules and service-side sovereignty rules β€” which calls for internal governance that tracks both tracks.
  • Cloud providers using colocation. If you rent colocation space to run your service, you are the cloud computing service provider. Ensure your colocation provider's infrastructure supports your ability to meet the relevant assurance level, and reflect sovereignty and security requirements in your contracts.

Common misconceptions

  • "Colocation is not a data centre service." Incorrect. Under the NIS2 definition imported by CADA Article 2(12), colocation falls within the data centre service concept.
  • "An entity can only be an operator or a service provider." A false dichotomy. CADA's definitions overlap; one legal entity can be both and must then meet both sets of obligations.
  • "Only hyperscalers are data centre service providers." No. Colocation providers, edge providers and traditional hosts can all fall within the definition where they meet the NIS2 criteria.

Related

This is general information about a draft EU regulation, not legal advice.