What must Netherlands include in its national cloud and AI strategy under CADA?

Under the proposed Cloud and AI Development Act (CADA), the Netherlands must adopt a national cloud and AI strategy within one year of the Regulation's ent

Summary Under the proposed Cloud and AI Development Act (CADA), the Netherlands must adopt a national cloud and AI strategy within one year of the Regulation's entry into force. As proposed in Article 7, this strategy is not optional; it must contain eight mandatory elements ranging from the integration of the "AI first" principle to specific measures for data centre capacity and high-intensity computing infrastructure (AI factories, gigafactories, and quantum computers). The Netherlands is required to notify the European Commission of its strategy within three months of adoption and must review the strategy at least every three years to ensure alignment with EU objectives. Failure to adequately cover these elements in an existing strategy would trigger a mandatory update.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, represents a structural shift in the EU's approach to technological sovereignty. It moves from fragmented national policies to a harmonised, ecosystem-wide framework. For the Netherlands, a pivotal node in European digital infrastructure, CADA introduces binding obligations to align national policy with Union priorities. Central to this alignment is Article 7, which mandates the creation, maintenance, and periodic review of national cloud and AI strategies.

The Legal Obligation and Timeline

Article 7(1) of the CADA proposal establishes a strict deadline: Member States, including the Netherlands, must establish national cloud and AI strategies by the same day and month as the entry into force of the Regulation plus one year. This strategy is a legal instrument designed to operationalise the Union's broader goals of competitiveness, innovation, and strategic autonomy.

Crucially, Article 7(3) provides a limited derogation: if the Netherlands has already adopted a national strategy that "adequately covers the objectives set out in this Regulation," it is not required to adopt a new strategy. However, this is a high bar. If the Netherlands identifies "gaps in its existing strategy in light of those objectives," it "should update it accordingly." This ensures that legacy policies are brought into full compliance without creating unnecessary administrative duplication, provided the substance meets the new standard.

The Eight Mandatory Elements

The core of the obligation lies in Article 7(2), which prescribes the minimum content of the national strategy. The Netherlands must ensure its strategy includes at least the following eight cumulative elements:

Key Objectives, Priorities, and Governance (Art 7(2)(a)) The strategy must define key objectives and priorities for cloud and AI adoption. Crucially, these must be in line with the "AI first" principle defined in the Apply AI Strategy. This principle urges organisations to "reflect on their business processes, considering the needs and opportunities offered by AI, while taking into consideration the potential risks." The strategy must also outline a governance and monitoring framework to achieve these objectives.
Acceleration Measures for All Levels (Art 7(2)(b)) The Netherlands must include measures to accelerate the development and adoption of cloud and AI at national, regional, and local levels. This specifically targets public sector bodies, small and medium-sized enterprises (SMEs), and small mid-cap enterprises (SMCs). The strategy must support the "Centres for AI" (Experience and Acceleration Centres for AI) as entry points to the European AI innovation ecosystem.
Strategic Sector Deployment (Art 7(2)(c)) Measures must be included to support the broad deployment and uptake of AI in strategic industrial and public sectors. The proposal explicitly highlights healthcare, energy, and mobility as priority areas, requiring the Netherlands to tailor its strategy to these high-impact domains.
Data Centre Capacity (Art 7(2)(d)) The strategy must address the deployment of data centre capacity. This is not a generic infrastructure plan; it must focus on "high-value data centres delivering significant economic and societal benefits." Furthermore, these deployments must adhere to "high environmental and energy-efficiency standards," linking digital infrastructure goals with the EU's green transition.
High-Intensity Computing Infrastructure (Art 7(2)(e)) This is a critical requirement for the Netherlands, given its existing infrastructure ambitions. The strategy must include measures to invest in "high-intensity computing infrastructure." This explicitly includes AI factories, AI gigafactories, and quantum computers. These are to be treated as "strategic national and cross-border assets supporting research, development and industrial AI deployment across strategic sectors."
Capabilities, Excellence, and Procurement (Art 7(2)(f)) The strategy must support the development of cloud and AI capabilities and promote excellence and innovation. This includes specific measures related to public procurement, leveraging the "public procurement of innovation measures set out in Article 33" to drive market demand for sovereign and innovative solutions.
Open Hardware and Software Stacks (Art 7(2)(g)) To strengthen technological sovereignty, the strategy must support the development of "cloud computing stack technologies built upon open hardware and software." This aims to "strengthen technological sovereignty and enhance the competitiveness of strategic European industries."
Data Accessibility (Art 7(2)(h)) Finally, the strategy must ensure the accessibility of high-quality data for AI development. This involves "preventing data bottlenecks encountered by organisations," ensuring that data availability does not become a limiting factor for AI innovation in the Netherlands.

Consistency, Monitoring, and Reporting

The national strategy cannot exist in a vacuum. Article 7(4) requires that the Netherlands' strategy be "consistent with, and contribute to, the associated digital targets established under Article 4 of Decision (EU) 2022/2481" (the Digital Decade Policy Programme 2030). This includes targets such as the adoption of cloud computing services, big data, and AI by at least 75% of Union enterprises, and the deployment of at least 10,000 climate-neutral, highly secure edge nodes.

Notification and Review Obligations Once adopted, the Netherlands must notify the Commission of its national strategies within three months of their adoption (Article 7(5)). This notification allows the Commission to monitor adoption and ensure consistency across the Union.

Furthermore, the strategy is not a static document. Article 7(5) mandates that the Netherlands "assess their national strategies at least every three years on the basis of key performance indicators and, where necessary, update them." The Commission shall monitor the adoption and revision of the national strategies.

The Role of the AI Board Article 7(6) introduces the European Artificial Intelligence Board (AI Board), established under the AI Act, as a key advisory body. The AI Board "shall advise and assist the Member States as regards the coordination of national strategies." It will also "facilitate exchange of best practices among Member States," allowing the Netherlands to learn from other jurisdictions and share its own expertise, particularly in areas like data centre deployment and open-source software promotion.

What this means for you

For in-house counsel, compliance officers, and strategic planners in the Netherlands, the CADA proposal signals that national policy will become a direct lever for corporate compliance, procurement strategy, and infrastructure investment.

Strategic Alignment and the "AI First" Mandate: Your organisation's cloud and AI adoption plans must be evaluated against the Dutch national strategy as it is developed under Article 7. Public sector bodies and regulated private entities will be expected to align with its priorities, particularly regarding the "AI first" principle. This principle is not merely rhetorical; it requires a fundamental re-evaluation of business processes to prioritise AI solutions where appropriate, while managing risks.
Procurement Implications: Article 7(2)(f) links national strategy directly to public procurement of innovation. If your company operates in sectors targeted by the strategy (e.g., healthcare, energy, mobility), be prepared for procurement processes that prioritise innovation, SMEs, and EU-developed technologies. Compliance officers should monitor the Dutch implementation of Article 32 (Union added value criteria) and Article 33, which will likely be operationalised through the national strategy to drive demand for sovereign solutions.
Infrastructure and Data Centres: For organisations involved in or affected by data centre deployment, the emphasis on high-intensity compute (AI factories, gigafactories) and sustainability (Article 7(2)(d) and (e)) means that future infrastructure projects will face stricter scrutiny regarding energy efficiency and strategic value. Ensure your internal projects align with the "high-value" and "energy-efficient" criteria that will likely be embedded in Dutch permitting and support frameworks. The strategy will likely influence where and how data centres are permitted, potentially favouring "acceleration zones" that meet these high standards.
Monitoring and Reporting Cycles: Compliance teams should establish internal monitoring mechanisms to track changes in the Dutch national strategy. Since the strategy must be reviewed at least every three years, regulatory requirements may shift. Early engagement with the AI Board's guidance and the Dutch national competent authorities will help anticipate these changes and ensure continuous alignment.
SME and SMC Support: If your organisation is an SME or SMC, the strategy's mandate to support these entities (Article 7(2)(b)) suggests that new funding, technical support, or simplified procurement processes may become available. Compliance officers should identify and leverage these opportunities to accelerate AI adoption, as the strategy explicitly aims to support these entities as entry points to the European AI innovation ecosystem.

Common misconceptions

"The national strategy is optional if one already exists." Reality: While Article 7(3) allows Member States to avoid adopting a new strategy if an existing one "adequately covers the objectives set out in this Regulation," this is a high bar. If any gaps are identified in the existing strategy when measured against the eight mandatory elements of Article 7(2), the Netherlands "should update it accordingly." The "adequacy" test is strict; a legacy strategy that lacks specific measures for AI factories, open stacks, or the "AI first" principle would not be considered adequate.

"The strategy only affects the public sector." Reality: Article 7(2) explicitly includes measures for SMEs, SMCs, and strategic industrial sectors. The strategy is designed to shape the entire national ecosystem, including private sector adoption. Furthermore, the "AI first" principle and data accessibility measures (Article 7(2)(h)) have direct implications for private enterprise operations, as the strategy aims to prevent data bottlenecks for all organisations.

"The Netherlands can ignore the 'AI first' principle." Reality: Article 7(2)(a) explicitly requires the strategy to be in line with the "AI first" principle. This is not a suggestion but a mandatory component of the national strategy. Organisations should expect this principle to influence regulatory guidance, public sector expectations, and potentially future procurement criteria.

"Data centre deployment is only about physical space." Reality: Article 7(2)(d) and (e) link data centre deployment to high-intensity computing (AI factories, gigafactories, quantum computers) and strict environmental and energy-efficiency standards. The strategy is about capacity, innovation, and sustainability, not just real estate. Compliance involves meeting energy efficiency and strategic value criteria, which will likely influence permitting and support measures.

Official sources

This is general information about a draft EU regulation, not legal advice.