Summary Under the proposed Cloud and AI Development Act (CADA), Finland is legally required to establish a national cloud and AI strategy within one year of the Regulation's entry into force, as mandated by Article 7. This is not a voluntary policy document but a binding instrument that must contain eight specific, mandatory elements. These include the adoption of an "AI first" principle, concrete measures to support SMEs and SMCs, and detailed plans for deploying data centre capacity and high-intensity computing infrastructure (such as AI factories, gigafactories, and quantum computers). Crucially, once adopted, Finland must notify the European Commission within three months and review the strategy at least every three years to ensure continued alignment with Union objectives.

Detail

The Cloud and AI Development Act (CADA), presented as Commission Proposal COM(2026) 502 final, establishes a harmonised framework to strengthen the EU's cloud and AI ecosystem. For Member States like Finland, the cornerstone of national implementation is the requirement to adopt a comprehensive national strategy. Article 7 of the CADA proposal outlines the precise obligations, timelines, and content requirements for these strategies, transforming what might have been voluntary national roadmaps into a strict regulatory compliance exercise.

The Deadline and Legal Basis

According to Article 7(1), Member States must establish their national cloud and AI strategies by the date that is one year after the Regulation enters into force. Given that CADA is a proposal that would enter into force on the 20th day following its publication in the Official Journal and apply one year later, this creates a defined implementation window for national authorities.

The strategy is not merely a statement of intent; it must be consistent with the objectives of the Regulation and contribute to the digital targets established under the Digital Decade Policy Programme 2030 (Article 7(4)). This ensures that Finland's national approach is not developed in isolation but is integrated into the broader Union-wide digital transformation goals.

The Eight Mandatory Elements of the Strategy

Article 7(2) explicitly lists the minimum content that Finland's national strategy must include. These are not suggestions but mandatory components that the Commission will monitor. The strategy must contain the following eight elements:

  1. Objectives and Governance (Art 7(2)(a)): The strategy must define key objectives and priorities for cloud and AI adoption. Crucially, it must align with the "AI first" principle, which urges organisations to reflect on their business processes by considering the needs and opportunities offered by AI, while taking into account potential risks. The strategy must also establish a governance and monitoring framework to achieve these objectives.
  2. Acceleration Measures (Art 7(2)(b)): Finland must outline measures to accelerate the development and adoption of cloud and AI at national, regional, and local levels. This specifically includes supporting public sector bodies, SMEs (small and medium-sized enterprises), and SMCs (small mid-caps). The strategy must identify how Experience and Acceleration Centres for AI (Centres for AI) will serve as entry points to the European AI innovation ecosystem.
  3. Strategic Sector Deployment (Art 7(2)(c)): The strategy must include measures to support the broad deployment and uptake of AI in strategic industrial and public sectors. The CADA text explicitly highlights healthcare, energy, and mobility as priority areas, though Finland's specific industrial strengths (such as forestry, mining, or clean tech) would also fall under this requirement.
  4. Data Centre Capacity (Art 7(2)(d)): Finland must include measures to support the deployment of data centre capacity. This is not just about quantity; the strategy must focus on high-value data centres that deliver significant economic and societal benefits. Furthermore, these data centres must adhere to high environmental and energy-efficiency standards, reflecting the EU's dual green and digital transition goals.
  5. High-Intensity Computing Infrastructure (Art 7(2)(e)): This is a critical element for a tech-forward nation like Finland. The strategy must include measures to invest in high-intensity computing infrastructure. Specifically, it must address AI factories, AI gigafactories, and quantum computers. These are to be treated as strategic national and cross-border assets that support research, development, and industrial AI deployment across strategic sectors.
  6. Capabilities and Procurement (Art 7(2)(f)): The strategy must include measures to support the development of cloud and AI capabilities and promote excellence and innovation. This includes leveraging public procurement measures and public procurement of innovation measures as set out in Article 33 of CADA.
  7. Open Hardware and Software (Art 7(2)(g)): Finland must include measures to support the development of cloud computing stack technologies built upon open hardware and software. The goal is to strengthen technological sovereignty and enhance the competitiveness of strategic European industries, reducing dependence on proprietary, non-EU technologies.
  8. Data Accessibility (Art 7(2)(h)): The strategy must include measures to ensure the accessibility of high-quality data for AI development. A key focus here is preventing data bottlenecks encountered by organisations, ensuring that data is available, interoperable, and usable for AI training and deployment.

The "AI First" Principle

The "AI first" principle, referenced in Article 7(2)(a) and derived from the Apply AI Strategy, is a central pillar of the national strategy. It requires a proactive approach where AI is considered at the outset of business process design and public service delivery, rather than as an afterthought. For Finnish public authorities and businesses, this means embedding AI considerations into strategic planning to unlock efficiency and innovation while managing risks. The principle mandates that organisations reflect on their business processes, considering the needs and opportunities offered by AI, while taking into account potential risks.

Support for SMEs and SMCs

CADA places significant emphasis on ensuring that smaller entities are not left behind in the AI transition. Article 7(2)(b) requires measures to accelerate adoption among SMEs and SMCs (Small Mid-Caps). This aligns with the broader CADA objective of fostering a competitive ecosystem where smaller EU-based providers can thrive. The strategy must outline how Finland will support these entities, potentially through the network of Centres for AI, which are tasked with helping organisations accelerate digital transformation and connect with European providers of cloud and AI technologies (Article 5(3)).

Notification and Review Obligations

The obligation does not end with the adoption of the strategy. Article 7(5) imposes strict reporting and review duties that ensure the strategy remains dynamic and effective:

  • Notification: Member States must notify the Commission of their national strategies within three months of their adoption. This ensures the Commission can monitor the adoption and revision of national strategies across the Union.
  • Review: Member States must assess their national strategies at least every three years on the basis of key performance indicators. If gaps are identified, the strategy must be updated accordingly.
  • Monitoring: The Commission shall monitor the adoption and revision of the national strategies to ensure consistency and alignment with Union objectives.

Role of the European Artificial Intelligence Board

Article 7(6) establishes the European Artificial Intelligence Board (the AI Board) as a key advisory body. The AI Board will advise and assist Finland and other Member States regarding the coordination of national strategies. It will facilitate the exchange of best practices, ensuring that Finland's approach is aligned with peer Member States and contributes to a cohesive European AI landscape.

What this means for you

For in-house counsel, compliance officers, and strategic planners in Finland, the CADA proposal signals a shift from voluntary AI guidelines to mandatory strategic alignment. Here is how this impacts your organisation:

  1. Strategic Alignment: Your organisation's AI and cloud strategy must align with Finland's national strategy. If your company operates in strategic sectors like healthcare, energy, or mobility, you must ensure your AI deployment plans support the national objectives outlined in Article 7(2)(c).
  2. Procurement and Sovereignty: As a buyer of cloud services, you will be subject to the sovereignty framework detailed in Title IV of CADA. Public sector bodies must procure services that meet specific Union assurance levels (Article 30). Private sector entities in critical sectors (under NIS2) may conduct similar impact assessments (Article 31). Ensure your procurement contracts for cloud and AI services account for these emerging sovereignty requirements.
  3. SME and SMC Opportunities: If you represent an SME or SMC, look for the measures outlined in the national strategy to accelerate your adoption of AI. The strategy must include support mechanisms, such as access to Centres for AI (Article 5). Engage with these centres to leverage testing, skills, and innovation support.
  4. Data Centre and Compute Access: For organisations requiring high-intensity computing, the national strategy's focus on AI factories, gigafactories, and quantum computers (Article 7(2)(e)) implies that Finland will invest in and facilitate access to these resources. Compliance officers should monitor how these assets are allocated and ensure their organisation is positioned to benefit from these strategic investments.
  5. Open Source and Interoperability: The strategy's emphasis on open hardware and software (Article 7(2)(g)) suggests a push towards interoperability and reduced vendor lock-in. Review your software stack for proprietary dependencies and consider open-source alternatives to align with the national strategy's sovereignty goals.

Common misconceptions

  • Misconception 1: The national strategy is just a high-level document.
    • Reality: Article 7(2) specifies eight detailed, mandatory elements. The strategy must include concrete measures for data centre deployment, high-intensity computing, and support for SMEs/SMCs. It is a binding framework that dictates national investment and policy priorities.
  • Misconception 2: Only large corporations need to worry about AI strategy.
    • Reality: Article 7(2)(b) explicitly requires measures to accelerate AI adoption among SMEs and SMCs. The national strategy must address the needs of smaller entities, and the network of Centres for AI is designed to support them.
  • Misconception 3: Data centre deployment is only about building more facilities.
    • Reality: Article 7(2)(d) and (e) require a focus on high-value data centres that adhere to high environmental and energy-efficiency standards. Furthermore, the strategy must address high-intensity computing infrastructure, including AI factories, gigafactories, and quantum computers, not just traditional data storage.
  • Misconception 4: The "AI first" principle is optional.
    • Reality: Article 7(2)(a) mandates that the national strategy includes key objectives in line with the "AI first" principle. This means AI considerations must be integrated into the core of business and public service processes, not treated as an add-on.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.