Summary No — the Cloud and AI Development Act (CADA) is not yet in force. Proposed by the European Commission on 3 June 2026, it remains a legislative proposal that has not been adopted. It would only enter into force after both the European Parliament and the Council adopt the text under the ordinary legislative procedure, and it would then apply one year later. Until then, its provisions have no binding legal effect.

Detail

CADA is currently a proposal for a Regulation of the European Parliament and of the Council, identified as COM(2026) 502 final (procedure 2026/0138 COD), presented by the European Commission on 3 June 2026. Because it is a proposal, it has not yet been voted on, amended, or approved by the EU's co-legislators — the European Parliament and the Council.

Under the ordinary legislative procedure, a proposal must be examined, potentially amended, and finally adopted by both institutions before it becomes law. This can take months or years, depending on the complexity of the text and the level of agreement between the Parliament and the Council. Throughout, the text is subject to change.

Entry into force is set out in Article 48 of the proposal, which states:

"This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union."

So the clock toward binding effect only starts once the final agreed text is published in the Official Journal — and publication only follows final adoption by both the Parliament and the Council. As of today, the Regulation is not published, not adopted, and not in force.

It is also important to distinguish "entry into force" from "application." Article 48 provides that the Regulation "shall apply from [same day and month as date of entry into force plus 1 year]" — a one-year gap between when the law becomes formally active and when its substantive rules actually bind market participants and public authorities. Neither stage has been reached, because the adoption phase is incomplete.

As proposed, the Regulation aims to strengthen Europe's cloud and AI ecosystem, including measures on sovereign cloud services, data-centre deployment, and public procurement. These are the Commission's proposed rules; they create no current obligations for public-sector bodies or cloud providers until the legislative process concludes.

What this means for you

For public-sector procurement officers and legal teams, CADA's current status means:

  1. No immediate compliance obligations. You are not yet required to comply with the assurance levels, risk-assessment mandates, or procurement criteria in the proposal. Existing EU and national procurement rules remain fully applicable.
  2. Preparation and monitoring. Though not binding, the proposal signals the direction of EU digital policy. Monitor the legislative process (via the European Parliament and Council) and start familiarising teams with concepts like the Union assurance levels and sovereign-cloud criteria.
  3. Contractual planning. For long-term cloud contracts, consider clauses allowing adaptation to future EU regulatory change, so that if CADA is adopted you can align contracts without renegotiating from scratch.
  4. Stakeholder engagement. As the proposal moves through the procedure, there may be opportunities for feedback. Bodies with specific sovereignty needs may wish to engage national representatives in the Council or relevant parliamentary committees.

Common misconceptions

  • "CADA is already law because the Commission proposed it." Incorrect. A Commission proposal is the starting point for legislation; it has no legal force until both the Parliament and the Council adopt it.
  • "The rules apply immediately once the proposal is published." Incorrect. Article 48 provides that entry into force is 20 days after publication in the Official Journal — which only happens after final adoption — and the rules then apply one year after entry into force.
  • "The current text is final." Incorrect. The text is subject to amendment during the ordinary legislative procedure; the final adopted version may differ from the Commission's initial proposal.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.