Summary As proposed, the Cloud and AI Development Act (CADA) includes several provisions aimed at helping small and medium-sized enterprises (SMEs) and small mid-caps (SMCs) compete in the EU cloud market. The headline measures would be automatic, cross-border recognition of an SME's self-assessed Union assurance level 1 (so no national authority sign-off is needed), a Member State objective to award at least 25% of cloud and AI procurement to innovative SMEs, "Union added value" as a non-price award criterion, and support through a network of Experience and Acceleration Centres for AI. None of this is yet in force — CADA is a proposal.

Detail

The proposed CADA borrows existing EU size definitions. Under Article 2, an "SME" takes the meaning in Commission Recommendation 2003/361/EC, and a "small mid-cap" (SMC) takes the meaning in Commission Recommendation (EU) 2025/1099. These definitions would determine eligibility for the SME-specific benefits below.

Automatic recognition at Union assurance level 1

CADA would establish a Union cloud computing sovereignty framework of four Union assurance levels (UAL 1–4), with the criteria set out in Annex II (Article 16). Under Article 17, a provider that wants to be recognised at a given level applies to the national competent authority of its place of establishment.

For UAL 1, providers self-assess and issue an EU statement of conformity (Article 19). Article 17(3) then adds a derogation specifically for SMEs: as proposed, the EU statement of conformity issued by an SME "shall be directly and automatically recognised in all Member States without the need for prior recognition by the evaluating national competent authority." In practice this would let an SME's UAL 1 self-declaration take effect EU-wide without waiting on a national recognition decision — removing a procedural step, though not the underlying substantive criteria.

Procurement targets and "Union added value"

CADA aims to use public demand to open the market to smaller European providers. Article 33 requires Member States to monitor and report on their procurement of innovation in cloud and AI, and Article 33(4) provides that Member States "shall pursue as objective that at least 25% of their procurement for cloud computing services and AI systems be awarded to innovative SMEs," setting out how in their national strategies. Article 33(5) asks Union entities and contracting authorities to promote preliminary market consultations, matchmaking between public buyers and European SMEs and start-ups, and SME-favourable contract clauses.

Separately, Article 32 requires contracting authorities, in procurement for innovative cloud services and AI systems, to include non-price award criteria assessing a tenderer's contribution to a European cloud and AI ecosystem — for example, use of software or hardware designed or manufactured in the Union. As proposed, these criteria must be ancillary and not decisive in the award (Article 32(2)), so they would complement rather than replace price-based evaluation.

Centres for AI

Article 5 would require each Member State to establish Experience and Acceleration Centres for AI ("Centres for AI"), building on the European Digital Innovation Hubs set up under Regulation (EU) 2021/694. Their tasks would include helping organisations accelerate digital transformation and connecting them with European cloud and AI providers, supporting upskilling and reskilling, facilitating the transfer of expertise across regions, and supporting the scaling-up of spin-offs and start-ups by easing access to clients and organisations seeking specialised AI services.

National strategies

Article 7 would require Member States to adopt national cloud and AI strategies within one year of entry into force, including measures to accelerate cloud and AI adoption "particularly among public sector bodies, SMEs and SMCs," and to support Centres for AI as entry points to the EU AI innovation ecosystem.

What this means for you

If you are an SME or SMC providing cloud computing services or AI systems, CADA — as proposed — would offer routes to the public-sector market while adding compliance considerations.

For cloud service providers:

  1. Use automatic UAL 1 recognition. If you are an SME aiming for Union assurance level 1, a robust self-assessment and EU statement of conformity would, as proposed, be recognised across all Member States without a national recognition decision, shortening time-to-market.
  2. Target public procurement. Watch for tenders and emphasise "Union added value" — EU-designed or EU-manufactured hardware, Union-based data and operations, contribution to the EU supply chain — given Article 32 and the 25% SME objective in Article 33.
  3. Engage Centres for AI. Use the Article 5 network for technical support, access to AI infrastructure, upskilling, and matchmaking.

For data centre operators:

  1. Acceleration zones. CADA's data-centre framework (Title III) focuses on streamlined permitting in acceleration zones rather than on SME status; align projects with the sustainability and grid criteria to benefit.
  2. Partnerships. Partnering with innovative SMEs offering cloud-stack or energy-efficient technologies can strengthen alignment with CADA's innovation goals.

General:

  • Confirm your status. Eligibility for SME-specific benefits, including Article 17(3) automatic recognition, depends on meeting the Article 2 definitions.
  • Watch secondary legislation. Much detail — assurance-level criteria (Annex II) and the operational arrangements for Centres for AI — would be developed through delegated and implementing acts.

Common misconceptions

  • Myth: CADA only helps large European cloud providers. Reality: As proposed, CADA includes SME-specific measures — automatic UAL 1 recognition (Article 17(3)) and the 25% SME procurement objective (Article 33(4)) — intended to diversify the market.
  • Myth: SMEs are exempt from sovereignty requirements. Reality: The Article 17(3) simplification concerns the recognition process for UAL 1, not the substantive Annex II criteria. An SME must still self-assess and issue a valid EU statement of conformity.
  • Myth: Public authorities would have to buy only from EU providers. Reality: CADA does not mandate exclusive EU procurement. It sets an SME procurement objective (Article 33(4)) and allows "Union added value" as a non-price, ancillary criterion (Article 32). Assurance-level procurement obligations (Articles 29–30) turn on a risk assessment, not nationality.
  • Myth: Centres for AI are only for AI developers. Reality: As proposed, Centres for AI also help organisations adopt cloud technologies and connect with European providers (Article 5).

Related

This is general information about a draft EU regulation, not legal advice.