What must Slovenia include in its national cloud and AI strategy under CADA?

Under the proposed Cloud and AI Development Act (CADA), Slovenia is legally required to adopt a national cloud and AI strategy within one year of the Regul

Summary Under the proposed Cloud and AI Development Act (CADA), Slovenia is legally required to adopt a national cloud and AI strategy within one year of the Regulation's entry into force. As set out in Article 7 of the proposal (COM(2026) 502 final), this strategy is not a voluntary guideline but a binding framework containing eight specific mandatory elements. These range from embedding the 'AI first' principle to concrete measures for SMEs and small mid-caps (SMCs), and investments in AI factories, gigafactories, and quantum computers. Slovenia must notify the European Commission of the adopted strategy within three months and conduct a formal review at least every three years based on key performance indicators.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a harmonised framework to strengthen Europe's cloud and AI ecosystem. For Member States like Slovenia, this translates into a direct legislative obligation to create a coherent national roadmap. Article 7 of the proposal is the central provision governing these national cloud and AI strategies.

The Deadline and Adoption Timeline

Article 7(1) imposes a strict deadline on all Member States. Slovenia must establish its national cloud and AI strategy by the date that is one year after the Regulation enters into force. The text specifies this as [same day as entry into force plus one year].

Given that the proposal states the Regulation shall enter into force on the twentieth day following its publication in the Official Journal and apply one year later, Slovenia faces a compressed timeline to draft, adopt, and formalise its strategy once the legislative process concludes. This is not a suggestion but a mandatory requirement to ensure the Union's objectives are met coherently across the single market.

The Eight Mandatory Elements of the Strategy

Article 7(2) explicitly enumerates the minimum content requirements. Slovenia's strategy cannot be generic; it must include at least the following eight specific components:

Key Objectives, Priorities, and Governance (Article 7(2)(a)) The strategy must define clear key objectives and priorities for cloud and AI adoption. Crucially, these objectives must be in line with the 'AI first' principle. The strategy must also establish a governance and monitoring framework to ensure these objectives are actually achieved. This creates a structural requirement for accountability within the Slovenian administration.
Acceleration Measures for All Levels (Article 7(2)(b)) Slovenia must include measures to accelerate the development and adoption of cloud and AI at national, regional, and local levels. The text explicitly targets public sector bodies, SMEs (small and medium-sized enterprises), and SMCs (small mid-caps). Furthermore, the strategy must support the Centres for AI (Experience and Acceleration Centres for AI) as the primary entry points for organisations to access the European AI innovation ecosystem.
Strategic Sector Deployment (Article 7(2)(c)) The strategy must outline measures to support the broad deployment and uptake of AI in strategic industrial and public sectors. The proposal specifically highlights healthcare, energy, and mobility as priority areas where AI adoption is critical for national competitiveness and public service delivery.
Data Centre Capacity (Article 7(2)(d)) Slovenia must include measures to support the deployment of data centre capacity. The strategy must focus on high-value data centres that deliver significant economic and societal benefits. Critically, these measures must ensure adherence to high environmental and energy-efficiency standards, aligning with the Union's broader climate goals.
High-Intensity Computing Infrastructure (Article 7(2)(e)) This is a distinct requirement for advanced infrastructure. Slovenia must include measures to invest in high-intensity computing infrastructure. The text explicitly lists AI factories, AI gigafactories, and quantum computers. These are to be treated as strategic national and cross-border assets that support research, development, and industrial AI deployment across strategic sectors.
Cloud and AI Capabilities via Procurement (Article 7(2)(f)) The strategy must support the development of cloud and AI capabilities and promote excellence and innovation. This includes specific measures related to public procurement and public procurement of innovation as set out in Article 33 of CADA. This links the national strategy directly to the Union's procurement framework, ensuring public spending drives market innovation.
Open Hardware and Software (Article 7(2)(g)) Measures must support the development of cloud computing stack technologies built upon open hardware and software. The explicit goal is to strengthen technological sovereignty and enhance the competitiveness of strategic European industries, reducing reliance on non-EU proprietary stacks.
Data Accessibility (Article 7(2)(h)) The strategy must ensure the accessibility of high-quality data for AI development. A specific focus is placed on preventing data bottlenecks encountered by organisations, ensuring that data flows do not stifle innovation or deployment.

The 'AI First' Principle

The 'AI first' principle, referenced in Article 7(2)(a), is a foundational concept for the strategy. As defined in Recital 32 of the proposal, this principle urges organisations to reflect on their business processes, considering the needs and opportunities offered by AI, while taking into consideration the potential risks.

Slovenia's strategy must embed this mindset into its national objectives. It is not merely about adopting AI tools but about a fundamental re-evaluation of how public and private sector processes are designed, ensuring AI is considered as a primary solution while rigorously managing associated risks.

Consistency and Alignment with Union Targets

Article 7(3) requires that national strategies be consistent with the objectives of this Regulation. Furthermore, Article 7(4) mandates that Slovenia ensure its national strategies are consistent with, and contribute to, the associated digital targets established under Article 4 of Decision (EU) 2022/2481 (the Digital Decade Policy Programme 2030).

This alignment is critical. Slovenia's strategy must contribute to Union-wide targets, such as the adoption of cloud computing services by at least 75% of Union enterprises and the deployment of at least 10,000 climate-neutral highly secure edge nodes. The national strategy serves as the vehicle through which Slovenia contributes to these collective goals.

Notification and Review Obligations

Article 7(5) imposes strict administrative duties on Slovenia to ensure transparency and continuous improvement:

Notification: Slovenia must notify the Commission of its national strategies within three months of their adoption. This ensures the Commission can monitor compliance and provide guidance if necessary.
Review: Slovenia must assess its national strategies at least every three years on the basis of key performance indicators.
Updates: Where necessary, the strategy must be updated to reflect changes in technology, market conditions, or Union objectives.
Monitoring: The Commission shall monitor the adoption and revision of the national strategies, ensuring a consistent approach across the Union.

Role of the European Artificial Intelligence Board

Article 7(6) establishes a governance link with the existing AI regulatory framework. The European Artificial Intelligence Board (AI Board), established by the AI Act (Regulation (EU) 2024/1689), shall advise and assist the Member States as regards the coordination of national strategies. The AI Board will facilitate exchange of best practices among Member States, ensuring that Slovenia's strategy benefits from the collective experience of the Union.

What this means for you

For legal counsel, policy advisors, and compliance officers in Slovenia, Article 7 of the proposed CADA is a pivotal provision that will shape the national digital landscape. The strategy is not a static document; it is a dynamic framework that will drive public procurement, infrastructure investment, and regulatory focus for the next decade.

1. Strategic Alignment for Private Sector

Organisations operating in Slovenia should anticipate that the national strategy will heavily influence public procurement criteria. As the strategy implements Article 32 and 33 (Union added value and innovation procurement), public tenders will likely prioritise solutions that align with the 'AI first' principle, open-source stacks, and EU-developed technologies. Companies should align their roadmaps with these anticipated priorities to remain competitive in the B2G (Business-to-Government) market.

2. Leveraging SME and SMC Support

Article 7(2)(b) explicitly mandates support for SMEs and SMCs. Slovenia will likely expand or establish Centres for AI to serve as entry points for these entities. These centres will provide access to expertise, testing facilities, and potentially compute resources. SMEs and SMCs should proactively engage with these centres to access support mechanisms and ensure they are positioned to benefit from the national strategy's acceleration measures.

3. Infrastructure and Investment Planning

For companies involved in data centre operations or those requiring high-intensity compute, the strategy will be a critical planning document. Article 7(2)(d) and (e) highlight the focus on AI factories, gigafactories, and quantum computers. Investments in these areas will likely be prioritised for permitting and funding. Compliance with high environmental and energy-efficiency standards will be a non-negotiable prerequisite for any new infrastructure projects supported by the state.

4. Data Governance and Accessibility

Article 7(2)(h) requires measures to prevent data bottlenecks. Companies should anticipate new national frameworks for data sharing and reuse, particularly in strategic sectors like healthcare and mobility. Organisations should review their data governance policies to ensure they are robust enough to participate in these emerging data ecosystems and comply with future data accessibility mandates.

5. Monitoring the Three-Year Cycle

The mandatory three-year review cycle (Article 7(5)) means the regulatory environment will evolve. Compliance teams should establish mechanisms to track updates to the Slovenian national strategy and associated KPIs. Changes in the strategy could trigger new reporting requirements, alter eligibility for public funding, or shift procurement priorities.

Common misconceptions

Misconception 1: The national strategy is optional or non-binding. Correction: Article 7(1) uses the mandatory language "shall establish." Failure to adopt a compliant strategy within the one-year deadline could lead to infringement proceedings by the European Commission. The requirement to notify the Commission within three months (Article 7(5)) further underscores its binding nature.

Misconception 2: 'AI First' means adopting AI at all costs. Correction: As defined in Recital 32, the 'AI first' principle requires organisations to consider both the opportunities and the potential risks of AI. It is about proactive integration into business processes, not reckless deployment. The strategy must also align with the risk-based approach of the AI Act.

Misconception 3: Only large corporations are affected by the data centre provisions. Correction: While Article 7(2)(d) and (e) focus on national infrastructure, the resulting capacity and standards will affect all users. Moreover, Article 7(2)(b) explicitly ensures that SMEs and SMCs are central to the national AI ecosystem, particularly through the Centres for AI.

Misconception 4: Slovenia can adopt an existing strategy without updates. Correction: Article 7(3) and Recital 33 clarify that if a Member State already has a strategy, it must be updated if it does not adequately cover the objectives of CADA. Given that CADA introduces new concepts like AI factories, quantum computers, and Union assurance levels, existing strategies will almost certainly require significant revision to remain compliant.

Official sources

This is general information about a draft EU regulation, not legal advice.