Summary As proposed in Article 7 of the Cloud and AI Development Act (CADA), Austria would have to establish a national cloud and AI strategy within one year of the Regulation's entry into force. Article 7(2) sets out eight mandatory elements (points (a)–(h)), running from objectives aligned with the "AI first" principle, through measures for SMEs and SMCs, to data centre capacity and high-intensity computing infrastructure (AI factories, AI gigafactories and quantum computers). Austria would have to notify the Commission within three months of adoption and review the strategy at least every three years on the basis of key performance indicators (Article 7(5)).

Detail

CADA, COM(2026) 502 final, is a proposed Regulation. One of the obligations it would place on every Member State is to adopt and maintain a coherent national strategy. Article 7 sets out the requirements, the timeline, and the monitoring and review mechanism.

The obligation to adopt a strategy

As proposed in Article 7(1), Member States "shall establish national cloud and AI strategies" by the date of entry into force plus one year. This is mandatory language, and the strategy is intended as an operational plan, not merely a declaration. Under Article 7(3) the strategy must be consistent with the objectives of the Regulation, and under Article 7(4) it must be consistent with, and contribute to, the digital targets established under Article 4 of Decision (EU) 2022/2481 (the Digital Decade Policy Programme 2030).

The eight mandatory elements

Article 7(2) lists the minimum content of Austria's strategy:

  1. Objectives, priorities and governance (Article 7(2)(a)): key objectives and priorities for cloud and AI adoption, in line with the "AI first" principle — which, per the proposal's recitals, is the principle defined in the Apply AI Strategy urging organisations to reflect on their business processes by considering the needs and opportunities offered by AI while taking potential risks into account — together with a governance and monitoring framework.
  2. Acceleration at national, regional and local level (Article 7(2)(b)): measures to accelerate development and adoption of cloud and AI, particularly among public sector bodies, SMEs and SMCs, including by supporting the Experience and Acceleration Centres for AI (the "Centres for AI") under Article 5 as entry points to the European AI innovation ecosystem.
  3. Deployment in strategic sectors (Article 7(2)(c)): measures to support the broad deployment and uptake of AI in strategic industrial and public sectors, with the proposal expressly naming healthcare, energy and mobility.
  4. Data centre capacity (Article 7(2)(d)): measures to support the deployment of data centre capacity, with a particular focus on high-value data centres delivering significant economic and societal benefits while adhering to high environmental and energy-efficiency standards.
  5. High-intensity computing infrastructure (Article 7(2)(e)): measures to invest in high-intensity computing infrastructure, including AI factories, AI gigafactories and quantum computers, treated as strategic national and cross-border assets.
  6. Capabilities, excellence and innovation through procurement (Article 7(2)(f)): measures to develop cloud and AI capabilities and promote excellence and innovation, including public procurement measures and the public procurement of innovation measures set out in Article 33.
  7. Open hardware and software stacks (Article 7(2)(g)): measures to support cloud computing stack technologies built upon open hardware and software to strengthen technological sovereignty.
  8. Accessibility of high-quality data (Article 7(2)(h)): measures to ensure the accessibility of high-quality data for AI development, notably by preventing data bottlenecks.

Reading the elements together

The eight elements are not eight separate workstreams; they are designed to interlock. The "AI first" governance frame in point (a) is meant to drive the adoption measures in points (b) and (c); those in turn depend on the infrastructure built under points (d) and (e); and points (f), (g) and (h) supply the procurement levers, the technological base, and the data that make adoption possible. For Austria, this means the strategy cannot be a list of disconnected initiatives — Article 7(2)(a) expressly requires "a governance and monitoring framework," so the strategy must show how the pieces are steered and measured against the key performance indicators that Article 7(5) makes the basis of the three-yearly review.

Two of the elements are worth isolating because they carry the heaviest sovereignty weight. Article 7(2)(e) elevates high-intensity computing infrastructure — AI factories, AI gigafactories and quantum computers — to "strategic national and cross-border assets," signalling that Austria's strategy is expected to consider not only domestic capacity but participation in cross-border initiatives. Article 7(2)(g) ties the strategy to open hardware and software as a route to technological sovereignty, which connects to the open-source-promotion provisions elsewhere in the proposal. Counsel advising on the strategy's drafting should treat these as the provisions most likely to attract Commission scrutiny during the Article 7(5) monitoring.

Consistency and alignment

Article 7(3) requires consistency with the objectives of the Regulation, and Article 7(4) requires consistency with, and a contribution to, the Digital Decade targets established under Article 4 of Decision (EU) 2022/2481. Those targets include ambitions such as a high share of Union enterprises taking up cloud, big data and AI, and the deployment of secure, climate-neutral edge nodes — so Austria's strategy must be drafted to pull in the same direction rather than merely coexisting with the Digital Decade programme.

Where Austria already has a national strategy in place, the proposal does not require it to start from scratch; rather, the existing strategy would have to satisfy the Article 7(2) elements and the Article 7(3)–(4) consistency requirements, and be updated where it falls short. It is worth being precise here: the text of Article 7(3) says only that "national strategies shall be consistent with the objectives of this Regulation" — it does not contain an explicit carve-out or "exemption" for pre-existing strategies. The practical effect is the same (an adequate existing strategy need not be replaced wholesale), but the legal basis is the general content-and-consistency obligation, not a specific exemption clause.

Notification, monitoring and review

Article 7(5) sets out the procedural obligations:

  • Notification: Austria must notify the Commission of its strategy within three months of adoption.
  • Assessment and update: Austria must assess the strategy at least every three years on the basis of key performance indicators and update it where necessary.
  • Monitoring: the Commission monitors the adoption and revision of national strategies.

Article 7(6) provides that the European Artificial Intelligence Board (the "AI Board"), established by Regulation (EU) 2024/1689, advises and assists Member States on coordinating their national strategies and facilitates the exchange of best practices. For Austria this places the strategy within a peer network: although Austria retains responsibility for the content of its own strategy, the coordination role of the AI Board is intended to reduce divergence between Member States and to spread approaches that work. In practice, Austria's drafters would be expected to engage with that process rather than treat the strategy as a purely domestic exercise.

How the notification and review cycle is likely to run

The three-month notification window in Article 7(5) runs from the adoption of the strategy, not from the Regulation's entry into force, so the operative sequence for Austria would be: adopt the strategy within one year of entry into force, then notify the Commission within three months of that adoption, then review at least every three years thereafter. Because the review is tied to key performance indicators, the indicators chosen at the outset effectively define how the strategy will be judged later — a point counsel should flag early, since weak or unmeasurable indicators would make the mandatory review difficult to satisfy.

What this means for you

For in-house counsel and compliance officers in Austria, the Article 7 strategy obligation has practical consequences once the Regulation is adopted:

  1. Strategic alignment. Your organisation's cloud and AI roadmap should track the eventual national strategy, which must include measures for SMEs and SMCs (Article 7(2)(b)). Watch for the support measures and funding routes Austria introduces.
  2. Procurement and innovation. Because the strategy must leverage procurement and procurement of innovation (Article 7(2)(f)), expect new procurement criteria — including the "Union added value" criteria in Article 32 — and possible multi-cloud strategies.
  3. Infrastructure and sustainability. If you operate or invest in data centres, note the strategy's focus on high-value, energy-efficient capacity (Article 7(2)(d)), which may influence permitting and grid-connection priorities.
  4. Data access. The focus on preventing data bottlenecks (Article 7(2)(h)) signals upcoming national data-access measures.
  5. Timeline. With the strategy due within one year of entry into force and reviewed at least every three years, build internal processes to track the cycles.

Common misconceptions

  • "The strategy is optional or merely advisory." Article 7(1) uses "shall." Adoption is a binding obligation as proposed; failure could engage the Member State's obligations under Union law.
  • "Only large tech companies are affected." Article 7(2)(b) expressly requires measures for SMEs and SMCs; the strategy targets broad adoption across the economy.
  • "The strategy is a static document." Article 7(5) requires assessment at least every three years and updates where necessary.
  • "Austria can ignore the 'AI first' principle." Article 7(2)(a) expressly requires the strategy's objectives to be in line with the "AI first" principle.
  • "Data centres are not a strategic priority." Article 7(2)(d) and (e) mandate specific measures for data centre capacity and high-intensity computing infrastructure, including AI factories and quantum computers.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.