Summary Under the proposed Cloud and AI Development Act (CADA), Spain is legally required to establish a national cloud and AI strategy within one year of the regulation's entry into force. This is not a voluntary policy paper; Article 7 mandates that the strategy include eight specific, cumulative elements, ranging from the adoption of the 'AI first' principle to concrete measures for SMEs/SMCs and the deployment of high-intensity compute infrastructure (AI factories, gigafactories, and quantum computers). Spain must notify the European Commission of the adopted strategy within three months and review it at least every three years based on key performance indicators. Failure to comply would trigger standard EU infringement procedures, as the obligation is binding under EU law.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, represents a structural shift in EU digital policy, moving from passive market regulation to active ecosystem building. For Spain, as for all Member States, the cornerstone of this new framework is Article 7, titled "National cloud and AI strategies." This article imposes a direct legal obligation on Spain to align its domestic policy with the Union's objectives of technological autonomy, competitiveness, and strategic resilience.

The Deadline and Legal Obligation

The timeline for compliance is strict and calculated from the regulation's entry into force. Article 7(1) states: "By [same day as entry into force plus one year], Member States shall establish national cloud and AI strategies (the 'national strategies')."

Since Article 48 stipulates that the Regulation shall apply from one year after its entry into force, Spain effectively has a two-year window from the date of publication in the Official Journal to have a fully operational strategy in place. However, the legislative obligation to establish the strategy crystallizes at the one-year mark post-entry into force.

This is a mandatory requirement. The text uses the imperative "shall establish." Furthermore, Article 7(3) requires that these national strategies be "consistent with the objectives of this Regulation," and Article 7(4) mandates that they "contribute to, the associated digital targets established under Article 4 of Decision (EU) 2022/2481" (the Digital Decade Policy Programme).

The Eight Mandatory Elements of the Strategy

The core of Spain's obligation lies in Article 7(2), which enumerates eight specific elements that the national strategy must include. These are cumulative; omitting any one would render the strategy non-compliant with the proposed Regulation.

1. 'AI First' Principle and Governance Framework

Article 7(2)(a) requires the strategy to include "key objectives and priorities for cloud and AI adoption, in line with the 'AI first' principle, as well as a governance and monitoring framework." The 'AI first' principle, as defined in the Apply AI Strategy and referenced here, urges organisations to "reflect on their business processes, considering the needs and opportunities offered by AI, while taking into consideration the potential risks." Spain's strategy must not only adopt this principle but also establish the specific governance structures and monitoring mechanisms required to achieve the set objectives.

2. Acceleration Measures for SMEs, SMCs, and Public Bodies

Article 7(2)(b) mandates measures to "accelerate the development and adoption of cloud and AI at national, regional and local level, particularly among public sector bodies, SMEs and SMCs." Crucially, the strategy must include specific support for the Experience and Acceleration Centres for AI ('Centres for AI') referred to in Article 5. These Centres are designated as the primary "entry points to the European AI innovation ecosystem." Spain must ensure its strategy leverages these Centres to facilitate digital transformation for smaller enterprises and public administrations.

3. Strategic Sector Deployment

Article 7(2)(c) requires measures to "support the broad deployment and uptake of AI in strategic industrial and public sectors." The text explicitly identifies healthcare, energy and mobility as priority areas. Spain's strategy must detail how it will foster AI adoption in these specific sectors, ensuring that the technology serves critical public and industrial functions.

4. Data Centre Capacity and Sustainability

Article 7(2)(d) obliges Spain to include "measures to support the deployment of data centre capacity." The Regulation clarifies that this focus must be on "high-value data centres delivering significant economic and societal benefits while adhering to high environmental and energy-efficiency standards." The strategy cannot merely aim for volume; it must prioritize quality, sustainability, and economic impact, aligning with the broader goals of the Digital Decade.

5. High-Intensity Computing Infrastructure

Article 7(2)(e) is perhaps the most technically specific requirement. It mandates measures to "invest in high-intensity computing infrastructure, including AI factories, AI gigafactories and quantum computers as strategic national and cross-border assets." These assets are to be supported for "research, development and industrial AI deployment across strategic sectors." Spain's strategy must outline how it will fund, locate, and integrate these advanced computing resources into its national infrastructure.

6. Public Procurement and Innovation

Article 7(2)(f) requires measures to "support the development of cloud and AI capabilities and promote excellence and innovation, including through public procurement measures, and public procurement of innovation measures set out in Article 33." This links the national strategy directly to the procurement obligations in Title IV. Spain must ensure its strategy includes mechanisms to use public purchasing power to drive innovation and support the development of domestic cloud and AI capabilities.

7. Open Hardware and Software Stacks

Article 7(2)(g) mandates measures to "support the development of cloud computing stack technologies built upon open hardware and software to strengthen technological sovereignty and enhance the competitiveness of strategic European industries." This element reflects the Act's broader emphasis on open source (Title V) as a lever for sovereignty. Spain's strategy must actively promote the development and adoption of open standards and open-source components to reduce dependency on proprietary, non-EU technologies.

8. Data Accessibility

Article 7(2)(h) requires "measures to ensure the accessibility of high-quality data for AI development, notably by preventing data bottlenecks encountered by organisations." The strategy must address the data supply chain, ensuring that organisations have access to the high-quality datasets necessary to train and deploy AI models, thereby preventing the "data bottlenecks" that could stifle innovation.

The Role of SMEs and SMCs

CADA places a distinct emphasis on smaller entities. Article 2(9) defines 'small mid-cap' (SMC) by reference to Commission Recommendation (EU) 2025/1099. Article 7(2)(b) explicitly requires the national strategy to address SMEs and SMCs alongside public bodies.

This reflects the EU's recognition that while large incumbents drive scale, innovation often stems from smaller players who face higher barriers to entry in cloud and AI adoption. Spain's strategy cannot be limited to large-scale infrastructure projects; it must provide accessible pathways for smaller businesses to integrate AI and cloud technologies, specifically through the network of Centres for AI.

Monitoring, Notification, and Review Cycles

Adopting the strategy is only the initial step. Article 7(5) imposes strict ongoing procedural obligations on Spain:

  • Notification: "The Member States shall notify the Commission of their national strategies within three months of their adoption." This creates a tight feedback loop between national adoption and EU oversight.
  • Review Cycle: "Member States shall assess their national strategies at least every three years on the basis of key performance indicators."
  • Updates: "and, where necessary, update them." The strategy is a living document, not a static policy.
  • Commission Monitoring: "The Commission shall monitor the adoption and revision of the national strategies."

Additionally, Article 7(6) assigns a coordination role to the European Artificial Intelligence Board (established by the AI Act), which "shall advise and assist the Member States as regards the coordination of national strategies" and facilitate the exchange of best practices.

Consequences of Non-Compliance

While Article 7 does not specify direct financial fines for Member States that fail to adopt a strategy, the legal consequences are severe. CADA is a Regulation, meaning it is directly applicable and binding in its entirety. Failure to establish the required strategy within the one-year deadline constitutes a failure to fulfil obligations under EU law.

This triggers the standard infringement procedure under Article 258 TFEU. The European Commission can initiate proceedings against Spain, which can ultimately lead to financial penalties imposed by the Court of Justice of the European Union. For in-house counsel and public administrators, this means the strategy is a binding legal deliverable, not a political statement.

What this means for you

For in-house counsel, compliance officers, and public administrators in Spain, Article 7 is a directive that will fundamentally shape the regulatory environment for the next decade. Here is how to prepare:

  1. Monitor the National Strategy Drafting: As Spanish authorities draft their national strategy to meet Article 7, closely monitor how they interpret the 'AI first' principle and the specific support measures for SMEs/SMCs. Your organisation's access to future funding, Centres for AI, and public procurement opportunities will depend on these national measures.
  2. Align Internal AI Roadmaps with 'AI First': The 'AI first' principle requires organisations to reflect on business processes through an AI lens. Begin internal assessments now. Document how AI can be integrated into your operations, identifying both opportunities and risks. This documentation will be valuable when engaging with public procurement processes that will increasingly require evidence of such strategic alignment.
  3. Prepare for Data Centre and Compute Requirements: If your organisation is involved in infrastructure, pay attention to the emphasis on AI factories, gigafactories, and quantum computing in Article 7(2)(e). The national strategy will likely include specific incentives or regulatory frameworks for these assets. Ensure your compliance frameworks are ready to handle the high environmental and energy-efficiency standards mandated for data centres.
  4. Leverage Open Source and Open Standards: Article 7(2)(g) mandates support for open hardware and software stacks. Compliance officers should review their current software licensing and procurement policies. Moving towards open-source solutions may not only reduce vendor lock-in but also align with the strategic priorities that will influence future public and private sector partnerships in Spain.
  5. Engage with Centres for AI: As Spain establishes its network of Experience and Acceleration Centres for AI, proactively engage with them. These centres will be the primary vehicles for delivering the SME/SMC support mandated by the strategy. Early engagement can provide access to testing facilities, skills training, and innovation support.

Common misconceptions

"The national strategy is a voluntary guideline." No. Article 7 uses mandatory language ("shall establish"). It is a binding legal obligation under EU law. Failure to comply constitutes an infringement of the Regulation, potentially leading to infringement proceedings by the Commission.

"The strategy only concerns large tech companies." Incorrect. Article 7(2)(b) explicitly requires measures for SMEs and SMCs. The strategy must ensure these smaller entities have access to the AI ecosystem, including through the Centres for AI. Ignoring this element would render the strategy non-compliant.

"'AI first' means adopting AI in every possible process without caution." No. The 'AI first' principle, as referenced in Article 7(2)(a) and the Apply AI Strategy, involves a balanced approach. It requires organisations to consider the needs and opportunities offered by AI while taking into consideration the potential risks. It is a strategic reflection tool, not a reckless adoption mandate.

"Spain can ignore the three-year review cycle." No. Article 7(5) mandates an assessment at least every three years based on key performance indicators. This is a continuous obligation, not a one-time task. The strategy must be dynamic and updated if gaps are identified.

"Data centre deployment is only about physical space." No. Article 7(2)(d) and (e) link data centre deployment to high-value economic benefits, environmental sustainability, and high-intensity computing (AI factories, quantum). The strategy must address the technical and strategic quality of compute, not just the square footage of facilities.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.