What sovereign cloud providers and options are available in Slovenia under CADA?

Under the proposed Cloud and AI Development Act (CADA), there is currently no specific list of "sovereign" cloud providers in Slovenia because the regulati

Summary Under the proposed Cloud and AI Development Act (CADA), there is currently no specific list of "sovereign" cloud providers in Slovenia because the regulation is a proposal and the central repository has not yet been established. As proposed, providers must be formally recognised by national competent authorities against four "Union assurance levels" (Article 16) to offer sovereign cloud services to public bodies. Slovenian organisations will identify these recognised providers through a central EU-wide repository maintained by the European Commission (Article 22), rather than a national Slovenian list. Providers subject to third-country control face significantly higher hurdles, particularly for Levels 3 and 4, where such control is generally prohibited unless a specific derogation under Article 18 applies.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, introduces a harmonised "Union cloud computing sovereignty framework" designed to mitigate risks associated with dependence on third-country cloud providers. For cloud service providers and data centre operators operating in or targeting the Slovenian market, understanding this framework is critical, as it will dictate eligibility for public sector contracts. The framework is not a voluntary label but a mandatory compliance regime for public procurement.

The Union Cloud Computing Sovereignty Framework (Article 16)

Article 16 of the CADA proposal establishes the core mechanism for sovereign cloud certification. It defines a framework consisting of four distinct "Union assurance levels" (Level 1, Level 2, Level 3, and Level 4). These levels are cumulative; a provider seeking Level 4 must meet all criteria for Levels 1, 2, and 3. The specific criteria are detailed in Annex II of the proposal and generally escalate in strictness regarding establishment, data localisation, personnel, cybersecurity, and supply chain transparency.

Level 1: The Baseline Level 1 serves as the minimum entry point for public procurement. Under Annex II (1.1), the provider must be established in the Union. Infrastructure and assets, including those of subcontractors, must be located in the Union unless the public sector body explicitly requires otherwise. Customer data (including metadata and telemetry) must remain exclusively within the Union, subject to the same explicit requirement exception.

Third-Country Control: A provider subject to third-country control is permitted at Level 1, provided they guarantee that no laws in that third country require the reporting of software vulnerabilities to authorities before exploitation is known.
Cybersecurity: The provider must demonstrate compliance with state-of-the-art cybersecurity standards.
Assessment: This level relies on a conformity self-assessment by the provider, documented in an EU statement of conformity (Article 19).

Level 2: Enhanced Sovereignty Level 2 introduces stricter requirements for infrastructure and personnel.

Location: Infrastructure, assets, and personnel must be located in the Union.
Data Usage: Data generated by the service cannot be used to train or fine-tune AI systems operated by a third country or a legal entity established in a third country.
Cybersecurity: The service must obtain a European cybersecurity certificate of at least assurance level 'substantial' under a scheme established under Regulation (EU) 2019/881 (e.g., the future EUCS). Until such a scheme is established, national schemes or the highest applicable Union standards apply.
Control: If the provider is subject to third-country control, they must demonstrate that such control does not restrict service delivery, access data, or disrupt continuity.
Assessment: Requires an independent third-party audit (Article 20) and a "positive" audit opinion.

Level 3: High Assurance & Personnel Citizenship Level 3 is designed for activities contributing to the preservation of public order.

Personnel: A critical distinction at this level is the requirement for Union citizenship. Under Annex II (3.1)(d), personnel (including subcontractors) involved in the provision of the service must be Union citizens. Where appropriate, they must also hold national security clearances for handling classified information.
Control: The provider and subcontractors must not be subject to the control of a third country or a legal entity established in a third country.
- Derogation: A provider subject to third-country control may still qualify for Level 3 only if the Commission has adopted an implementing act under Article 18 identifying that third country as providing sufficient assurances (e.g., an adequacy decision and no conflicting extraterritorial laws).
Cybersecurity: Requires a European cybersecurity certificate of at least assurance level 'substantial'.
Support: Technical and operational support must be initiated and performed exclusively within the Union by Union residents.

Level 4: Maximum Sovereignty Level 4 is the highest tier, intended for the most sensitive public order activities.

Personnel: Like Level 3, personnel must be Union citizens with necessary security clearances.
Control: The provider and subcontractors must not be subject to third-country control. No derogation for third-country control is available at Level 4.
Cybersecurity: Requires a European cybersecurity certificate of at least assurance level 'high'. Note that Level 3 requires 'substantial', while Level 4 requires 'high'.
Data: Sensitive data identified via risk assessment must remain exclusively within the Union.

Recognition and the Central Repository (Article 22)

A critical operational detail for providers and buyers is how recognition is communicated. Under CADA, a provider does not self-declare sovereign status in a way that is automatically binding for procurement.

The Recognition Process Under Article 17, a provider submits an application for recognition to the national competent authority of establishment. For a provider established in Slovenia, this is the Slovenian authority.

For Level 1, the provider submits an EU statement of conformity.
For Levels 2–4, the provider must submit an audit report and a "positive" audit opinion from an independent auditing organisation.

Once the evaluating authority verifies the evidence, it adopts a recognition decision. This decision is valid across the entire Union.

The Central Repository (Article 22) Article 22 mandates that the European Commission shall establish and maintain a dedicated "central repository" of cloud computing services recognised under Article 17.

Single Source of Truth: This repository is the definitive list for buyers. It will be publicly available and regularly updated.
No National Lists: While Slovenia will have a national competent authority, it will not maintain a separate public list of sovereign providers. Slovenian buyers must consult the EU-wide central repository to verify a provider's status.
Transparency: The repository will publish recognitions and any revocations, which must remain available for five years.

Distinguishing Sovereign from Non-Sovereign Offerings

The framework explicitly distinguishes between providers subject to Union law and those exposed to non-EU law. The sovereignty framework is designed to address specific risks identified in the proposal's recitals:

Extraterritorial Access: The risk that third-country laws (such as the US CLOUD Act) could compel a provider to hand over data stored in the EU.
Operational Disruption: The risk that a third country could disrupt service continuity or degrade quality as a form of economic or political coercion.
Vendor Lock-in: Dependencies on proprietary technologies or hardware controlled by non-EU entities.

The "Third-Country Control" Barrier The most significant differentiator between sovereign and non-sovereign offerings is the control structure.

Levels 1 & 2: Providers subject to third-country control are permitted if they can prove that such control does not compromise service delivery, data access, or continuity, and that no laws require premature vulnerability reporting.
Level 3: Generally prohibits third-country control. The only exception is if the Commission has specifically recognised that third country under Article 18 (associated third countries). This is a high bar, requiring an adequacy decision and specific safeguards against extraterritorial laws.
Level 4: Strictly prohibits third-country control. No derogation exists.

For Slovenian buyers, this means that a provider with significant US or other non-EU ownership may be eligible for Level 1 or 2, but would likely be ineligible for Level 3 or 4 unless the Commission has issued a specific decision for that third country.

What this means for you

For cloud service providers and data centre operators, the CADA proposal represents a shift from voluntary trust frameworks to mandatory, audited assurance levels for public sector business.

1. Prepare for Formal Recognition You cannot simply market your service as "sovereign." You must undergo a formal recognition process. If you are established in Slovenia, you will apply to the Slovenian national competent authority. If you are established in another Member State, you apply there, but your recognition will be valid across the Union, including for Slovenian buyers. Ensure your internal controls, audit trails, and documentation are ready for independent third-party audits (for Levels 2–4) or conformity self-assessments (for Level 1).

2. Target the Right Assurance Level Understand the risk assessments that Slovenian public bodies will conduct. Article 29 requires Member States to assess which of their activities require which assurance level.

Level 1 will likely be the minimum for general administrative tasks.
Levels 2–4 will be required for activities contributing to public order, national security, defence, or justice. If your service cannot meet the strict data localisation and personnel requirements of Level 3 or 4, you may be excluded from high-value, critical public sector contracts in Slovenia and the wider EU.

3. Monitor the Central Repository As a buyer or a competitor, you will rely on the Commission's central repository (Article 22). As a provider, ensure your information in this repository is up-to-date. Article 23 imposes transparency obligations on providers to report material changes that could affect their assurance level status. Failure to report such changes could lead to the revocation of your recognition.

4. Address Third-Country Exposure If your corporate structure involves significant ownership or control by non-EU entities, or if you rely on hardware/software with remote features controlled by third-country manufacturers, you must implement robust legal, technical, and organisational measures to demonstrate separation and control. This includes documenting Software Bills of Materials (SBOMs) and ensuring no remote tampering capabilities exist. For Levels 3 and 4, you must generally demonstrate that you are not subject to third-country control at all.

Common misconceptions

Misconception 1: "Slovenia will have its own list of sovereign cloud providers." While Slovenia will have a national competent authority responsible for the recognition process, the definitive list of recognised services is the EU-wide central repository maintained by the Commission (Article 22). A Slovenian buyer will check this EU register, not a separate Slovenian government website, to verify a provider's status.

Misconception 2: "Any EU-based provider is automatically 'sovereign' under CADA." Being established in the EU is a necessary but not sufficient condition. A provider must be formally recognised against a specific Union assurance level. A provider established in Slovenia but heavily dependent on third-country-controlled hardware or subject to third-country extraterritorial laws may not qualify for higher assurance levels (3 or 4) without demonstrating specific safeguards.

Misconception 3: "CADA replaces the GDPR or EUCS." CADA complements existing laws. It does not replace data protection rules under the GDPR. Furthermore, for Levels 2, 3, and 4, providers must obtain a European cybersecurity certificate (e.g., under EUCS) or demonstrate compliance with the highest cybersecurity standards. CADA adds a layer of sovereignty and operational autonomy requirements on top of these cybersecurity and data protection baselines.

Misconception 4: "Private companies are banned from using non-sovereign clouds." CADA primarily mandates the use of recognised sovereign clouds for public sector bodies (Article 30). Private sector entities, particularly those in high-criticality sectors (Annex I of NIS2), are encouraged to conduct impact assessments (Article 31) but are not strictly mandated to use only sovereign clouds in the same way public bodies are. However, public procurement trends often influence private sector choices.

Misconception 5: "Level 3 and Level 4 have the same cybersecurity requirements." This is incorrect. Under Annex II, Level 3 requires a European cybersecurity certificate of at least assurance level 'substantial', whereas Level 4 requires a certificate of at least assurance level 'high'. The distinction is critical for providers aiming for the highest tier of sovereignty.

Official sources

This is general information about a draft EU regulation, not legal advice.