Summary As proposed in Article 7 of the Cloud and AI Development Act (CADA), Bulgaria would have to adopt a national cloud and AI strategy within one year of the Regulation's entry into force. Article 7(2) sets out eight mandatory elements (points (a)–(h)), from objectives aligned with the "AI first" principle to specific measures for data centre capacity and high-intensity computing infrastructure such as AI factories. The strategy must be notified to the Commission within three months of adoption and reviewed at least every three years (Article 7(5)). The Article 7 obligation is one the proposal places on the Member State; it is distinct from the penalties regime (Article 24), which applies to provider infringements of the cloud-sovereignty Chapter, not to a Member State's strategy duties.

Detail

CADA, COM(2026) 502 final, is a proposed Regulation. For Member States such as Bulgaria, a core obligation is the creation of a national cloud and AI strategy under Article 7.

The deadline and legal basis

As proposed in Article 7(1), Member States must establish their national strategies by the date of entry into force plus one year. The strategy must be consistent with the Regulation's objectives (Article 7(3)) and must be consistent with, and contribute to, the Digital Decade targets under Decision (EU) 2022/2481 (Article 7(4)).

The eight mandatory elements

Article 7(2) lists the minimum content of Bulgaria's strategy:

  1. Key objectives and "AI first" (Article 7(2)(a)): objectives and priorities for cloud and AI adoption in line with the "AI first" principle — which, per the proposal's recitals, is the principle defined in the Apply AI Strategy, urging organisations to reflect on their business processes by considering the opportunities of AI while taking potential risks into account — plus a governance and monitoring framework.
  2. Acceleration at all levels (Article 7(2)(b)): measures to accelerate adoption at national, regional and local level, targeting public sector bodies, SMEs and SMCs, including support for the "Centres for AI" (Article 5).
  3. Strategic sectors (Article 7(2)(c)): measures for AI in strategic industrial and public sectors, with the proposal naming healthcare, energy and mobility.
  4. Data centre capacity (Article 7(2)(d)): measures to support high-value data centres meeting high environmental and energy-efficiency standards.
  5. High-intensity computing infrastructure (Article 7(2)(e)): investment in AI factories, AI gigafactories and quantum computers as strategic national and cross-border assets.
  6. Capabilities and procurement (Article 7(2)(f)): measures to develop capabilities and promote innovation, including public procurement and the procurement-of-innovation measures in Article 33.
  7. Open hardware and software (Article 7(2)(g)): support for cloud-stack technologies built on open hardware and software.
  8. Data accessibility (Article 7(2)(h)): measures to ensure access to high-quality data for AI development, preventing data bottlenecks.

How the elements fit together

The eight elements interlock rather than stand alone. Article 7(2)(a) requires "a governance and monitoring framework," so the "AI first" objectives are meant to drive the adoption measures in points (b) and (c); those rely on the infrastructure built under points (d) and (e); and points (f), (g) and (h) provide the procurement levers, the open technological base and the data that make adoption possible. For Bulgaria — which the proposal's broader context treats as part of a Union effort to close a concentrated capacity gap — the infrastructure elements carry particular weight: Article 7(2)(d) directs attention to high-value, energy-efficient data centres, and Article 7(2)(e) treats AI factories, AI gigafactories and quantum computers as "strategic national and cross-border assets," signalling that the strategy is expected to consider cross-border participation, not only domestic build-out.

The role of SMEs and SMCs

The definitions in Article 2(8) and Article 2(9) identify SMEs and SMCs, and Article 7(2)(b) expressly requires measures to support them. Bulgaria's strategy must therefore set out actionable plans giving SMEs and SMCs access to cloud resources, AI tools and the Centres for AI under Article 5, which the proposal frames as entry points to the European AI innovation ecosystem. The SME dimension also runs through the procurement element: Article 33 sets an objective that at least 25% of cloud and AI procurement be awarded to innovative SMEs and requires Member States to include in their national strategy plans for achieving that objective. So a strategy that addressed SMEs only under point (b) and ignored the procurement angle under point (f) would be incomplete.

Consistency with the Digital Decade targets

Article 7(4) requires Bulgaria's strategy to be consistent with, and contribute to, the digital targets established under Article 4 of Decision (EU) 2022/2481 (the Digital Decade Policy Programme 2030), such as a high share of Union enterprises taking up cloud, big data and AI. The strategy should therefore be drafted to reinforce Bulgaria's existing Digital Decade commitments rather than to sit alongside them.

Notification, monitoring and review

Under Article 7(5), Bulgaria must notify the Commission within three months of adoption, must assess the strategy at least every three years on the basis of key performance indicators, and update it where necessary; the Commission monitors adoption and revision.

Coordination with the AI Board

Article 7(6) provides that the European Artificial Intelligence Board (the "AI Board"), established under Regulation (EU) 2024/1689, advises and assists Member States on coordinating national strategies and facilitates the exchange of best practices. For Bulgaria this situates the strategy within a peer network: Bulgaria keeps responsibility for its own content, but the AI Board's coordination role is intended to reduce divergence between Member States and to circulate approaches that work. The three-month notification window in Article 7(5) runs from adoption, so the operative sequence is to adopt within one year of entry into force, notify within three months of adoption, then review at least triennially against key performance indicators — which makes the choice of those indicators an early and consequential drafting decision.

The strategy as a delivery vehicle for other obligations

Several other provisions of the proposal route through the national strategy, so it is best read as a delivery vehicle rather than a stand-alone policy paper. Article 33(4) requires Bulgaria to include in its strategy its plans for achieving the objective that at least 25% of cloud and AI procurement be awarded to innovative SMEs. The Article 5 Centres for AI are expressly named in Article 7(2)(b) as something the strategy must support. And the strategy's infrastructure elements (points (d) and (e)) sit alongside the acceleration-zone and strategic-project regimes elsewhere in the proposal. The drafting task is therefore partly one of cross-referencing — showing how procurement, support structures and infrastructure cohere — and counsel reviewing a draft should check that each Article 7(2) element is matched by a concrete, monitorable measure, because the three-yearly review under Article 7(5) is conducted against key performance indicators.

What this means for you

For in-house counsel and compliance officers in Bulgaria, the national strategy is the roadmap that will shape the regulatory environment for your organisation:

  1. Procurement compliance. The strategy will influence public-procurement requirements; suppliers to the public sector should align with the sovereignty levels and assurance criteria in the Regulation.
  2. SME/SMC support. Watch the measures under Article 7(2)(b) — access to Centres for AI, training and possibly support for compute access.
  3. Data centre investments. Article 7(2)(d) and (e) signal where public support is likely to flow; aligning projects with energy-efficiency and EU-technology criteria may help with strategic-project designation or funding.
  4. Open source. The support for open hardware and software (Article 7(2)(g)) suggests a growing preference for open-source solutions in the public sector.
  5. Monitoring and reporting. Expect increased reporting on cloud and AI adoption to support the strategy's KPIs.

Common misconceptions

  • "The strategy is optional or purely advisory." Article 7 uses mandatory language ("Member States shall establish"). It is a binding obligation as proposed.
  • "The strategy only applies to large tech companies." Article 7(2)(b) expressly requires measures for SMEs and SMCs.
  • "'AI first' means adopting AI at all costs." No. The "AI first" principle referenced in Article 7(2)(a) requires weighing the opportunities of AI against potential risks — a framework for considered, not indiscriminate, adoption.
  • "The strategy is a one-time document." Article 7(5) requires review at least every three years.
  • "Failing on the strategy triggers CADA fines on the Member State." No. The penalties in Article 24 target infringements by cloud computing service providers of the cloud-sovereignty Chapter; they are not the mechanism for a Member State's Article 7 strategy obligation.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.