CADA Sovereign Cloud in Austria: Assurance Levels, Providers & the Central Repository

Summary Under the proposed Cloud and AI Development Act (CADA), Austria does not maintain a separate national list of sovereign cloud providers. Instead, it relies on a harmonised EU-wide framework of four "Union assurance levels" (Article 16) to classify cloud services by their sovereignty and security guarantees. Austrian public bodies and critical private entities must procure services that meet specific assurance levels determined by national risk assessments, identifying recognised providers exclusively through the European Commission's central repository (Article 22). This system distinguishes between providers fully controlled within the EU and those subject to third-country laws, such as the US CLOUD Act, which may pose risks to data autonomy and operational continuity. As proposed, providers subject to third-country control are generally restricted to lower assurance levels unless specific derogations apply.

This is general information about a draft EU regulation, not legal advice.

Detail

The Cloud and AI Development Act (CADA), as proposed in COM(2026) 502 final, establishes a unified European approach to cloud sovereignty. It moves away from fragmented national definitions of "sovereign cloud" toward a standardized, auditable framework. For cloud service providers and data centre operators in Austria, this means compliance with a tiered system of assurance levels that dictate eligibility for public sector contracts and critical infrastructure roles.

The Union Cloud Computing Sovereignty Framework

At the core of CADA's autonomy measures is the Union cloud computing sovereignty framework, established under Article 16. This framework defines four distinct "Union assurance levels" (Level 1 to Level 4). These levels are cumulative; a provider seeking recognition at Level 4 must meet all criteria for Levels 1, 2, and 3. The criteria are detailed in Annex II of the proposal and focus on three main pillars:

Jurisdiction and Control: Where the provider is established, where data is stored, and who controls the provider.
Personnel and Infrastructure: The location of staff, hardware, and support teams.
Cybersecurity and Supply Chain: Compliance with cybersecurity standards and transparency in software supply chains.

Level 1: Basic Union Assurance This is the baseline for all public sector procurement. Providers must be established in the Union, with infrastructure and data remaining exclusively within the Union unless the public sector body explicitly requires otherwise. Providers must demonstrate compliance with state-of-the-art cybersecurity standards and provide full transparency regarding subcontractors. Crucially, if a provider is subject to third-country control, it must guarantee that no third-country laws require reporting software vulnerabilities to foreign authorities before they are exploited. Recognition at this level is achieved through a conformity self-assessment and an EU statement of conformity (Article 19).

Level 2: Enhanced Union Assurance Level 2 introduces stricter controls. Both the provider and its subcontractors must be established in the Union. Infrastructure, assets, and personnel involved in service provision must be located in the Union. Data generated by the service cannot be used to train or fine-tune AI systems operated by third countries. Providers must obtain a European cybersecurity certificate of at least "substantial" assurance level (under the Cybersecurity Act) or demonstrate equivalent high standards. Importantly, providers must implement measures to block remote features that could tamper with or disrupt services and must maintain a complete Software Bill of Materials (SBOM). If the provider is controlled by a third country, it must prove that such control does not restrict service delivery, grant access to customer data, or allow disruption of service continuity.

Level 3: High Union Assurance Level 3 is designed for more sensitive public sector activities. All personnel involved in service provision must be Union citizens, and where appropriate, hold national security clearances for handling classified information. The provider and its subcontractors must not be subject to the control of a third country, unless the Commission has adopted a specific implementing act recognizing a third country as providing sufficient assurances under Article 18. Technical and operational support must be performed exclusively within the Union by Union residents. The same strict SBOM and remote-feature-blocking requirements as Level 2 apply.

Level 4: Highest Union Assurance Level 4 is reserved for the most critical activities, such as those involving classified information or high-risk national security interests. Similar to Level 3, personnel must be Union citizens with appropriate security clearances. The provider and subcontractors must not be subject to third-country control. Additionally, the provider must demonstrate effective control over software components, ensuring that no third country holds effective control over their design, development, or evolution. The cybersecurity certification must be at least "high" assurance level.

Recognition and the Central Repository

Austrian organizations cannot simply trust a provider's claim of sovereignty. Under Article 17, cloud computing service providers must submit an application for recognition to the national competent authority of their establishment. For providers seeking Level 1, this involves submitting an EU statement of conformity. For Levels 2, 3, and 4, providers must undergo independent third-party audits by accredited auditing organizations, which issue an audit report and a "positive" audit opinion.

Once recognized, the provider's service is registered in the central repository of cloud computing services, established and maintained by the European Commission under Article 22. This repository is publicly available and serves as the single source of truth for recognized sovereign cloud services. Austrian contracting authorities must consult this repository to verify that a provider holds the necessary assurance level for their specific use case. The repository includes details on the assurance level, the auditing organization, and any revocations of recognition.

Distinguishing EU/EEA-Controlled Offerings from Third-Country Exposure

A key distinction in CADA is between providers that are genuinely autonomous within the EU and those that, while operating in the EU, remain subject to extraterritorial laws like the US CLOUD Act.

EU/EEA-Controlled Sovereign Offerings: Providers meeting Levels 3 and 4 must generally not be subject to the control of a third country. This means no significant ownership or strategic decision-making power lies with entities established outside the EU. This ensures that European data and infrastructure are not vulnerable to foreign government access requests or sanctions that could disrupt service.
Providers Exposed to Non-EU Law: Many global hyperscalers are incorporated in the US or other third countries. Under CADA, these providers can only offer Level 1 or Level 2 services unless the Commission adopts a specific decision under Article 18 recognizing the third country as providing sufficient safeguards. Even then, they must prove that third-country laws do not enable unauthorized access to EU data or disruption of service. For Level 3 and 4, providers subject to third-country control are generally excluded, unless a derogation applies. This creates a clear market signal: Austrian public bodies handling sensitive data cannot rely on providers whose ultimate control lies outside the EU's legal jurisdiction.

What this means for you

For cloud service providers and data centre operators in Austria, CADA introduces a new compliance and certification pathway that will determine your eligibility for public sector contracts and critical private sector deals.

Assess Your Current Posture: Evaluate your provider against the four assurance levels. If you are a US-based hyperscaler with EU subsidiaries, you may be limited to Level 1 or 2 unless you can demonstrate structural separation and compliance with Article 18 criteria. If you are an EU-based provider, aim for Level 3 or 4 to access the most lucrative public sector contracts.
Prepare for Audits: Levels 2, 3, and 4 require independent third-party audits. Start preparing your documentation, including SBOMs, personnel records, and cybersecurity certifications. Ensure your subcontractors also meet the relevant criteria, as their compliance is part of your assessment.
Engage with the Competent Authority: Identify the Austrian national competent authority designated under Article 25. Engage early in the process to understand the specific evidence required for recognition.
Update Your Supply Chain: Review your software supply chain for third-country dependencies. Implement measures to block remote tampering features and maintain detailed records of software components. This is critical for Levels 2–4.
Market Your Assurance Level: Once recognized, ensure your service is listed in the central repository. Austrian buyers will rely on this list. Highlight your assurance level in marketing materials to differentiate yourself from non-compliant competitors.

For Austrian public sector bodies, the obligation is to conduct risk assessments (under Article 29) to determine the required assurance level for each cloud use case. You must then procure only from providers listed in the central repository with the appropriate level. This shifts the burden of verification from individual due diligence to a standardized, EU-wide certification process.

Common misconceptions

"Sovereign cloud means data must stay in Austria." CADA does not mandate data localization within a single Member State. Instead, it requires data to remain within the Union (EU/EEA) unless explicitly permitted otherwise. The focus is on jurisdictional control and legal protection, not just physical location. A provider in Germany can serve an Austrian body if it meets the assurance levels.
"US providers are banned." US providers are not banned, but their options are restricted. They can offer Level 1 and potentially Level 2 services if they meet the strict criteria regarding third-country control and data access. However, they are generally excluded from Level 3 and 4 services unless the Commission adopts a specific derogation under Article 18, which requires robust safeguards against extraterritorial access.
"Self-certification is enough for all levels." Only Level 1 allows for self-assessment and an EU statement of conformity. Levels 2, 3, and 4 require rigorous independent third-party audits by accredited auditing organizations. The audit report and opinion are mandatory for recognition.
"CADA replaces the AI Act." CADA and the AI Act are complementary. The AI Act regulates AI systems based on risk, while CADA regulates cloud services based on sovereignty and security assurance levels. A cloud provider may need to comply with both regulations depending on the services offered.

Official sources