What must Portugal include in its national cloud and AI strategy under CADA?

Under the proposed Cloud and AI Development Act (CADA), Portugal is legally required to establish a national cloud and AI strategy within one year of the R

Summary Under the proposed Cloud and AI Development Act (CADA), Portugal is legally required to establish a national cloud and AI strategy within one year of the Regulation's entry into force, as mandated by Article 7. This strategy is not a voluntary guideline but a binding framework that must include eight specific elements, ranging from the adoption of an 'AI first' principle to concrete measures for expanding data centre capacity and supporting small and medium-sized enterprises (SMEs) and small mid-cap enterprises (SMCs). Crucially, Portugal must notify the European Commission of its adopted strategy within three months and is obligated to review and update the strategy at least every three years based on key performance indicators.

Detail

As proposed in COM(2026) 502 final, the Cloud and AI Development Act (CADA) imposes a direct obligation on Member States, including Portugal, to adopt a cohesive national strategy to align with the EU's broader objectives for technological sovereignty, industrial competitiveness, and strategic autonomy. Article 7 of the CADA proposal outlines the precise content, timeline, governance requirements, and monitoring mechanisms for these national strategies.

The Deadline and Legal Basis

According to Article 7(1), Member States must establish their national cloud and AI strategies by a date set one year after the CADA's entry into force. The Regulation itself is proposed to enter into force on the twentieth day following its publication in the Official Journal of the European Union. Consequently, Portugal would have approximately one year from that entry-into-force date to finalize, adopt, and publish its national strategy.

The strategy must be consistent with the objectives of the CADA Regulation and must contribute to the digital targets established under the Digital Decade Policy Programme 2030 (Decision (EU) 2022/2481), as explicitly required by Article 7(4). This ensures that Portugal's national ambitions are synchronized with the EU-wide target that at least 75% of enterprises adopt cloud computing services, big data, and AI for their business operations. The strategy serves as the primary vehicle for translating these Union-level targets into national action.

The Eight Mandatory Elements

Article 7(2) prescribes a mandatory list of eight specific components that Portugal's national strategy must include. These elements are designed to cover governance, adoption, infrastructure, innovation, and sovereignty. The proposal states that the national strategies shall include at least the following:

Governance and the 'AI First' Principle (Article 7(2)(a)): The strategy must define key objectives and priorities for cloud and AI adoption. Crucially, it must align with the 'AI first' principle defined in the Apply AI Strategy. This principle urges organizations to reflect on their business processes, considering the needs and opportunities offered by AI, while simultaneously taking into consideration potential risks. The strategy must also outline a governance and monitoring framework to achieve these objectives.
Accelerated Adoption for SMEs and SMCs (Article 7(2)(b)): Portugal must include measures to accelerate the development and adoption of cloud and AI at national, regional, and local levels. The proposal specifically highlights the need to support public sector bodies, small and medium-sized enterprises (SMEs), and small mid-cap enterprises (SMCs). The strategy should leverage the network of Experience and Acceleration Centres for AI (Centres for AI) as entry points to the European AI innovation ecosystem to facilitate this uptake.
Strategic Sector Deployment (Article 7(2)(c)): The strategy must contain measures to support the broad deployment and uptake of AI in strategic industrial and public sectors. The proposal explicitly names healthcare, energy, and mobility as key areas of focus where AI adoption is critical for economic and societal benefits.
Data Centre Capacity (Article 7(2)(d)): Portugal must outline measures to support the deployment of data centre capacity. The strategy must prioritize high-value data centres that deliver significant economic and societal benefits while adhering to high environmental and energy-efficiency standards. This aligns with CADA's broader goal of tripling EU data centre capacity in the next five to seven years and ensuring balanced geographic deployment.
High-Intensity Computing Infrastructure (Article 7(2)(e)): The strategy must include measures to invest in high-intensity computing infrastructure. This specifically includes AI factories, AI gigafactories, and quantum computers. These are designated as strategic national and cross-border assets intended to support research, development, and industrial AI deployment across strategic sectors.
Cloud and AI Capabilities and Procurement (Article 7(2)(f)): Portugal must plan measures to support the development of cloud and AI capabilities and promote excellence and innovation. This includes utilizing public procurement measures and the public procurement of innovation measures set out in Article 33 of the CADA. This element ensures that public spending drives market development and supports the ecosystem.
Open Source and Technological Sovereignty (Article 7(2)(g)): The strategy must support the development of cloud computing stack technologies built upon open hardware and software. The objective is to strengthen technological sovereignty and enhance the competitiveness of strategic European industries, reducing reliance on non-EU providers and proprietary lock-in.
Data Accessibility (Article 7(2)(h)): Finally, the strategy must ensure the accessibility of high-quality data for AI development. This involves preventing data bottlenecks encountered by organizations, thereby facilitating the training and operation of AI models. This element is critical for ensuring that European AI developers have the necessary fuel to compete globally.

Notification, Monitoring, and Review

Once adopted, Portugal cannot keep the strategy internal. Article 7(5) requires Member States to notify the European Commission of their national strategies within three months of their adoption. This notification allows the Commission to monitor the adoption and revision of national strategies across the Union, ensuring consistency and identifying gaps.

Furthermore, the strategy is not a static document. Article 7(5) mandates that Member States assess their national strategies at least every three years. This assessment must be based on key performance indicators (KPIs). If the assessment reveals gaps or changes in the technological landscape, Portugal must update the strategy accordingly. The European Artificial Intelligence Board (AI Board), established under the AI Act, will advise and assist Member States in coordinating these national strategies and facilitating the exchange of best practices, as per Article 7(6).

What this means for you

For in-house counsel, compliance officers, and strategic planners in Portugal, Article 7 of the CADA proposal signals a shift from voluntary digital transformation guidelines to mandatory, monitored national strategic planning. While the obligation to create the strategy lies with the Portuguese government, the content of that strategy will directly impact corporate compliance, investment planning, and public procurement opportunities.

1. Alignment with National KPIs Once Portugal publishes its strategy and notifies the Commission, the defined KPIs will likely influence regulatory expectations and public procurement criteria. Companies operating in sectors highlighted in Article 7(2)(c)—such as healthcare, energy, and mobility—should prepare for increased regulatory scrutiny and potential incentives tied to AI adoption. Compliance teams should monitor the official publication of Portugal's national strategy to understand the specific metrics the government will use to measure success.

2. Opportunities in High-Intensity Compute Article 7(2)(e) explicitly mentions AI factories, AI gigafactories, and quantum computers as strategic assets. Companies involved in infrastructure development, data centre operations, or advanced computing hardware should anticipate a supportive regulatory environment and potential state aid or public-private partnership opportunities in these areas. However, this also implies that projects not aligned with these strategic national assets may face higher hurdles for public funding or streamlined permitting.

3. SME and SMC Support Mechanisms Article 7(2)(b) mandates measures to support SMEs and SMCs. Larger enterprises may need to adapt their supply chain compliance requirements to align with these national support structures. Conversely, smaller firms should look for government-backed programs emerging from the strategy, particularly those leveraging the Centres for AI, to access technical expertise and cloud resources.

4. Data Bottleneck Mitigation The requirement in Article 7(2)(h) to prevent data bottlenecks suggests that the Portuguese government may introduce new data governance frameworks or incentives for data sharing. Compliance officers should review current data management practices to ensure they are adaptable to potential national data accessibility initiatives, ensuring that high-quality data remains available for AI development without compromising GDPR compliance.

5. Procurement and Innovation As the strategy must include measures for public procurement of innovation (Article 7(2)(f)), companies bidding for public contracts should prepare to demonstrate how their solutions contribute to the national cloud and AI ecosystem. This may involve proving the use of open-source components, EU-designed hardware, or contributions to technological sovereignty, as detailed in other parts of the CADA (such as Article 32).

Common misconceptions

Misconception 1: The national strategy is optional if a previous digital strategy exists. While Article 7(3) states that if a Member State has already adopted a national strategy that adequately covers the CADA's objectives, it is not required to adopt a new strategy, it must still update any existing strategy to fill gaps. Portugal cannot simply ignore the CADA requirements if its current digital strategy lacks the specific elements mandated in Article 7(2), such as the explicit inclusion of AI gigafactories or the 'AI first' principle.

Misconception 2: The strategy only affects the public sector. Although Article 7 imposes the obligation on the Member State, the strategy's measures—particularly those regarding data centre deployment, open-source adoption, and SME support—have significant downstream effects on the private sector. The strategy will shape the regulatory landscape, public procurement rules, and infrastructure availability that private companies rely on.

Misconception 3: 'AI first' means AI must be used in all decisions. The 'AI first' principle, referenced in Article 7(2)(a), does not mandate the blind application of AI to every business process. As defined in the Apply AI Strategy, it urges organizations to reflect on their processes and consider the opportunities and risks of AI. It is a framework for strategic consideration, not a blanket requirement for automation.

Misconception 4: The three-month notification deadline starts from the Regulation's entry into force. No. Article 7(5) specifies that Member States must notify the Commission within three months of the adoption of their national strategies. Since the strategy must be adopted within one year of the Regulation's entry into force, the notification deadline is effectively 15 months after the Regulation enters into force, provided the strategy is adopted on the final day of the one-year window.

Official sources

This is general information about a draft EU regulation, not legal advice.