What must Poland include in its national cloud and AI strategy under CADA?

Under Article 7 of the proposed Cloud and AI Development Act (CADA), Poland is legally required to establish a national cloud and AI strategy within one ye

Summary Under Article 7 of the proposed Cloud and AI Development Act (CADA), Poland is legally required to establish a national cloud and AI strategy within one year of the Regulation's entry into force. This strategy is not a voluntary policy paper but a binding instrument that must contain eight specific mandatory elements, ranging from the adoption of the 'AI first' principle to concrete measures for SMEs and small mid-caps (SMCs), the deployment of data centre capacity, and investment in high-intensity computing infrastructure such as AI factories, gigafactories, and quantum computers. Once adopted, Poland must notify the European Commission within three months and conduct a formal review of the strategy at least every three years to ensure continued alignment with Union objectives.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, represents a significant shift in the EU's approach to digital sovereignty. While previous instruments like the Data Act focused on switching and interoperability, CADA aims to actively shape the market by mandating coordinated national action. For Poland, as a Member State, this means the obligation to translate Union-level ambitions into a concrete, actionable national roadmap. Article 7 of the proposal serves as the primary legal vehicle for this requirement, establishing a rigorous framework for national strategies that must be consistent with the Regulation's objectives, the AI Continent Action Plan, and the Apply AI Strategy.

The Statutory Deadline for Adoption

The timeline for compliance is strict and non-negotiable. Article 7(1) explicitly states that Member States "shall establish national cloud and AI strategies" by a specific deadline: one year after the date of entry into force of the Regulation.

For Poland, this creates a fixed window for legislative and administrative preparation. The strategy must be formally adopted by the competent Polish authorities before this one-year mark expires. This deadline is critical for legal teams and public administrators to track, as failure to adopt a compliant strategy could result in infringement proceedings or the inability to access certain Union funding mechanisms that rely on the existence of a coherent national strategy. Furthermore, Article 7(4) mandates that these national strategies must be consistent with the digital targets established under Decision (EU) 2022/2481 (the Digital Decade Policy Programme 2030), ensuring that Poland's national plans do not diverge from the Union's broader digital transformation goals.

The Eight Mandatory Elements of the Strategy

The core of the obligation lies in Article 7(2), which enumerates eight specific components that Poland's strategy must include. These are not suggestions; they are cumulative requirements. A strategy missing even one of these elements would be non-compliant with the proposed Regulation.

Objectives, Priorities, and Governance (Article 7(2)(a)) The strategy must define the key objectives and priorities for cloud and AI adoption. Crucially, these objectives must align with the 'AI first' principle. As defined in the proposal, this principle "urges organisations to reflect on their business processes, considering the needs and opportunities offered by AI, while taking into consideration the potential risks." The strategy must also establish a robust governance and monitoring framework to ensure these objectives are actually achieved. This moves beyond high-level rhetoric to require a structural mechanism for oversight.
Acceleration Measures for SMEs and SMCs (Article 7(2)(b)) Poland must include specific measures to accelerate the development and adoption of cloud and AI at the national, regional, and local levels. The proposal explicitly targets small and medium-sized enterprises (SMEs) and small mid-cap enterprises (SMCs). The strategy must support the network of Experience and Acceleration Centres for AI (referred to in Article 5 of CADA), designating them as the primary entry points for these smaller entities to access the European AI innovation ecosystem. This ensures that the benefits of the cloud and AI transition are not limited to large hyperscalers or major corporations.
Strategic Sector Deployment (Article 7(2)(c)) The strategy must outline measures to support the broad deployment and uptake of AI in strategic industrial and public sectors. The text of the proposal specifically highlights healthcare, energy, and mobility as priority areas. For Poland, this implies that the national strategy must detail how AI will be integrated into these critical sectors to enhance efficiency, safety, and innovation, rather than leaving such deployment to market forces alone.
Data Centre Capacity (Article 7(2)(d)) A central pillar of CADA is the physical infrastructure of the cloud. Poland's strategy must include measures to support the deployment of data centre capacity. The proposal emphasizes a focus on high-value data centres that deliver significant economic and societal benefits. Crucially, these measures must ensure that new deployments adhere to high environmental and energy-efficiency standards, aligning with the Union's green transition goals.
High-Intensity Computing Infrastructure (Article 7(2)(e)) Perhaps the most technologically specific requirement is the mandate to invest in high-intensity computing infrastructure. The strategy must include measures to support AI factories, AI gigafactories, and quantum computers. These are defined in the proposal as "strategic national and cross-border assets" that are essential for supporting research, development, and industrial AI deployment across strategic sectors. For Poland, this signals a requirement to plan for and facilitate the construction of these advanced facilities, which are critical for maintaining competitiveness in frontier AI.
Capabilities, Innovation, and Procurement (Article 7(2)(f)) The strategy must include measures to support the development of cloud and AI capabilities and to promote excellence and innovation. This explicitly includes the use of public procurement measures and public procurement of innovation measures as set out in Article 33 of CADA. This links the national strategy directly to the purchasing power of the Polish public sector, requiring the government to use its procurement leverage to drive innovation and support the domestic cloud and AI ecosystem.
Open Hardware and Software (Article 7(2)(g)) To strengthen technological sovereignty, Poland must include measures to support the development of cloud computing stack technologies built upon open hardware and software. This requirement is designed to reduce dependency on proprietary, non-European technologies and to enhance the competitiveness of strategic European industries. The strategy must detail how Poland will foster an ecosystem where open standards and open-source components are the default for critical infrastructure.
Data Accessibility (Article 7(2)(h)) Finally, the strategy must ensure the accessibility of high-quality data for AI development. This includes specific measures to prevent data bottlenecks encountered by organisations. Without access to high-quality, diverse data, AI models cannot be trained effectively. The strategy must therefore address the legal, technical, and administrative barriers that might prevent data from being available for training and validation purposes.

The 'AI First' Principle in Practice

The 'AI first' principle, referenced in Article 7(2)(a) and elaborated in Recital 32, is a foundational concept of the proposed Regulation. It is not merely a slogan but a directive for operational change. It requires organisations to proactively consider AI in their business processes before defaulting to non-AI solutions. For Poland, this means the national strategy must be a driver for cultural and operational transformation. It implies that public bodies and private enterprises alike will be expected to demonstrate that they have considered AI solutions as a primary option, while simultaneously managing the associated risks. This principle will likely influence future procurement decisions, regulatory guidance, and funding allocations.

Notification and Review Obligations

The adoption of the strategy is only the beginning of Poland's obligations. Article 7(5) imposes two critical ongoing duties to ensure transparency and continuous improvement:

Notification: Poland must notify the European Commission of its national strategy within three months of its adoption. This deadline is strict. The notification allows the Commission to monitor the adoption and revision of strategies across the Union, ensuring a level playing field and identifying any gaps or inconsistencies early.
Periodic Review: The strategy is not a static document. Poland must assess its national strategy at least every three years based on key performance indicators (KPIs). If the assessment reveals gaps or if the strategy is no longer aligned with Union objectives, it must be updated accordingly. The Commission is tasked with monitoring these adoptions and revisions, ensuring that Poland's strategy evolves alongside technological developments and Union priorities.

The Role of the European Artificial Intelligence Board

Article 7(6) clarifies the supervisory and advisory role of the European Artificial Intelligence Board (the 'AI Board'). Established under the AI Act, the AI Board will "advise and assist the Member States as regards the coordination of national strategies." For Poland, this means there is a dedicated EU-level body to facilitate the exchange of best practices, provide guidance on complex technical or legal issues, and ensure that the Polish strategy remains consistent with the broader European approach. The AI Board will serve as a crucial resource for Polish authorities to learn from the experiences of other Member States and to avoid common pitfalls in strategy implementation.

What this means for you

For in-house counsel, compliance officers, and strategic planners in Poland, the requirements of Article 7 have profound implications for business planning and regulatory compliance.

Strategic Alignment and Procurement: Once Poland's national strategy is published, all public procurement and major private sector investments in cloud and AI should be evaluated for alignment with its objectives. The 'AI first' principle suggests that future public tenders will explicitly favour bidders who can demonstrate that AI has been integrated into their core business processes and risk management frameworks.
Opportunities for SMEs and SMCs: If your organisation is an SME or SMC, the measures outlined in Article 7(2)(b) are critical. The national strategy will likely detail specific support mechanisms, grants, or access to the 'Centres for AI'. Engaging with these centres early could provide access to testing facilities, skills training, and innovation support that would otherwise be out of reach.
Infrastructure Investment: For companies involved in data centre construction, energy, or hardware manufacturing, the focus on AI factories, gigafactories, and quantum computers (Article 7(2)(e)) indicates a significant shift in public investment priorities. Aligning your business plans with these national priorities may unlock state aid, streamlined permitting, or public-private partnership opportunities.
Open Source and Sovereignty: The emphasis on open hardware and software (Article 7(2)(g)) suggests that future public sector contracts will increasingly require transparency and interoperability. Compliance officers should assess their current technology stacks for proprietary lock-in and consider how to pivot towards open-source solutions to remain competitive in the Polish market.
Data Strategy: The requirement to prevent data bottlenecks (Article 7(2)(h)) means that data governance will become a central part of national policy. Organisations holding high-quality data may face new expectations to share or make it accessible for AI training, potentially under new legal frameworks that balance data protection with AI development needs.
Monitoring and Reporting: Be prepared for increased reporting requirements. As Poland monitors the implementation of its strategy using KPIs, companies may be asked to provide data on their AI adoption rates, data usage, and procurement practices to help the government meet its national targets.

Common misconceptions

"The strategy is optional or merely aspirational." Reality: Article 7(1) uses the mandatory term "shall establish." Poland is legally required to adopt a national cloud and AI strategy under CADA if the Regulation is adopted. Failure to do so would be a breach of Union law.

"The 'AI first' principle is just a slogan with no legal weight." Reality: It is a defined requirement in Article 7(2)(a) that must be explicitly reflected in the strategy's objectives and governance framework. It implies a proactive, legally grounded approach to AI integration and risk assessment that will likely influence future regulatory interpretations.

"Only large tech companies and hyperscalers are affected." Reality: Article 7(2)(b) specifically mandates measures for SMEs and SMCs. The strategy must address their specific needs, meaning support mechanisms, funding, and regulatory guidance will extend to smaller entities.

"The strategy is a one-time document that never changes." Reality: Article 7(5) requires a formal review at least every three years. The strategy is a living document that must be updated to reflect rapid technological developments, changes in the EU's strategic priorities, and the results of the KPI-based assessments.

"Poland can ignore the 'AI first' principle if it conflicts with national interests." Reality: The principle is a core component of the Union's objectives. Article 7(3) requires national strategies to be "consistent with the objectives of this Regulation." Deviating from the 'AI first' principle would likely render the strategy non-compliant with the Regulation.

Official sources

This is general information about a draft EU regulation, not legal advice.