Summary Under the proposed Cloud and AI Development Act (CADA), Bulgaria faces a strict, fixed timeline anchored to the Regulation's entry into force. As proposed in COM(2026) 502 final, Bulgaria must designate at least one data centre acceleration zone within six months of entry into force. Simultaneously, the country must adopt its national cloud and AI strategy and designate its national competent authority within one year of entry into force. Finally, Bulgaria must notify the European Commission of its adopted strategy within three months of adoption. These are not optional milestones; they are mandatory procedural steps required to unlock the Regulation's benefits and ensure compliance with the Union's cloud sovereignty framework.

Detail

The Cloud and AI Development Act (CADA) is a legislative proposal designed to strengthen the EU's cloud and AI ecosystem by harmonising infrastructure deployment and sovereignty standards. If adopted, it would impose immediate, calendar-based obligations on all Member States, including Bulgaria. Unlike many EU directives that allow for long transposition periods, CADA establishes a "fast-track" timeline for foundational measures, recognising the urgency of closing the EU's compute capacity gap and reducing third-country dependencies.

The timeline is anchored to a specific legal event: the entry into force of the Regulation. According to Article 48 of the proposal, the Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union. Crucially, the Regulation would apply from one year after this entry into force. However, the clock for specific preparatory obligationsβ€”such as designating zones and authoritiesβ€”starts ticking immediately upon entry into force, not upon the application date. This means Bulgaria must have its institutional and geographic frameworks in place before the full operational rules of the Act become applicable.

1. Designation of Data Centre Acceleration Zones (Article 10(1))

Deadline: 6 months after entry into force

The most immediate and geographically specific obligation for Bulgaria is the designation of data centre acceleration zones. Article 10(1) explicitly mandates that "where data centre capacity is being deployed within the territory of a Member State, that Member State shall designate at least one data centre acceleration zone ('acceleration zone') within its territory."

The deadline is precise: this designation must occur by "[P.O. insert the date of entry into force of this Regulation plus 6 months]." This six-month window is non-negotiable. The purpose of these zones is to create a streamlined regulatory environment for data centre deployment, addressing bottlenecks in permitting and grid connection.

When designating these zones, Bulgarian authorities must consider several critical factors outlined in Article 10(1), including:

  • The location, dimension, and size of potential facilities.
  • Available and future power grid capacity and on-site clean energy generation.
  • Network connectivity capacity and the phasing out of legacy copper networks.
  • The ability to reuse waste heat and the preference for brownfield sites over greenfield sites.
  • Measures to accelerate permitting and ensure environmental sustainability.

Failure to designate a zone within this six-month period would leave Bulgaria unable to benefit from the "toolbox" of accelerated environmental assessments and permitting procedures established under Article 13, potentially stalling critical infrastructure projects.

2. Adoption of the National Cloud and AI Strategy (Article 7(1))

Deadline: 1 year after entry into force

Parallel to the infrastructure designation, Bulgaria must establish a comprehensive strategic framework. Article 7(1) requires that "By [same day as entry into force plus one year], Member States shall establish national cloud and AI strategies (the 'national strategies')."

This strategy is not a high-level vision document but a detailed operational plan. Under Article 7(2), the strategy must include:

  • Key objectives and priorities for cloud and AI adoption, aligned with the "AI first" principle.
  • A governance and monitoring framework.
  • Specific measures to accelerate adoption among SMEs, SMCs, and public sector bodies.
  • Plans for deploying data centre capacity with high environmental standards.
  • Investments in high-intensity computing infrastructure, including AI factories and quantum computers.
  • Measures to support the development of cloud computing stack technologies built on open hardware and software.
  • Strategies to ensure the accessibility of high-quality data for AI development.

The strategy must be consistent with the objectives of CADA and contribute to the digital targets established under the Digital Decade Policy Programme. While Article 7(3) notes that if a Member State has already adopted a strategy that "adequately covers the objectives," it need not adopt a new one, it must update existing strategies if gaps are identified. Given the specific focus on sovereignty and data centre acceleration in CADA, existing Bulgarian digital strategies would likely require significant amendment to comply.

3. Notification to the Commission (Article 7(5))

Deadline: 3 months after adoption of the strategy

Adoption is only the first step; transparency and EU-level alignment are the next. Article 7(5) stipulates that "Member States shall notify the Commission of their national strategies within three months of their adoption."

This notification is a critical compliance checkpoint. It triggers the Commission's monitoring role, allowing it to assess whether the national strategy is consistent with the Regulation's objectives. The Commission is empowered to monitor the adoption and revision of these strategies. Furthermore, Article 7(6) establishes that the European Artificial Intelligence Board (AI Board) shall advise and assist Member States in coordinating these strategies, facilitating the exchange of best practices.

Failure to notify within this three-month window could delay the Commission's ability to provide guidance or support, and potentially impact the alignment of national measures with EU-wide funding mechanisms linked to the Digital Decade targets.

4. Designation of National Competent Authorities (Article 25(1))

Deadline: 1 year after entry into force

To enforce the cloud computing sovereignty framework, Bulgaria must designate the institutional body responsible for oversight. Article 25(1) mandates that "By [P.O. insert date of entry into force plus 1 year], Member States shall designate one or more national competent authorities responsible for enforcing this Chapter."

This deadline coincides with the deadline for the national strategy, creating a critical "one-year mark" for Bulgaria's institutional readiness. The designated authority (or authorities) will be responsible for:

  • Receiving and assessing applications for recognition of cloud computing service providers under Article 17.
  • Conducting investigations and enforcing compliance with the sovereignty framework.
  • Cooperating with other Member States' authorities and the Commission.

Article 25(2) requires that Member States notify the Commission of the names, tasks, and powers of these authorities. The Commission will then maintain a public register of them. The proposal allows Member States to designate existing authorities to fulfil this role, which may streamline the process, but the legal designation must be complete within the one-year window. Without a designated authority, Bulgaria cannot formally recognise providers as meeting Union assurance levels, effectively blocking public sector procurement of sovereign cloud services under Article 30.

Summary of Key Deadlines

Obligation Legal Basis Deadline Relative to Entry into Force
Designate Data Centre Acceleration Zones Article 10(1) 6 months
Adopt National Cloud and AI Strategy Article 7(1) 1 year
Designate National Competent Authority Article 25(1) 1 year
Notify Commission of National Strategy Article 7(5) 3 months after adoption

What this means for you

For public-sector bodies, procurement officers, and infrastructure planners in Bulgaria, these deadlines represent a hard timeline for institutional preparation. The six-month window for acceleration zones is particularly tight. Local and regional authorities must coordinate immediately with national bodies to identify suitable sites, assess energy grid capacity, and initiate the legal designation process. Waiting for the Regulation to be fully applicable (one year later) would result in a missed deadline, leaving Bulgaria without the streamlined permitting tools necessary to attract data centre investment.

The one-year deadline for the national strategy and competent authority designation means that procurement planning must anticipate the existence of these frameworks. Once the national competent authority is designated, it will begin recognising cloud providers that meet Union assurance levels. Procurement officers should prepare to shift their sourcing strategies toward these recognised providers, especially for activities identified as contributing to public order (which require assurance levels 2–4 under Article 30(3)).

Furthermore, the requirement to notify the Commission within three months of adopting the national strategy implies that the strategy cannot be a static document. It must be ready for review and alignment with EU standards shortly after adoption. Procurement officers should monitor the progress of the national strategy's development, as it will dictate the specific measures and priorities for cloud and AI adoption in Bulgaria, including public procurement measures set out in Article 33.

Common misconceptions

Misconception 1: The deadlines start when the Regulation is published. The deadlines are tied to the entry into force, which is 20 days after publication. While the application date is one year after entry into force, the clock for designations (like acceleration zones and authorities) starts ticking the moment the Regulation enters into force. Confusing these dates can lead to premature or delayed action.

Misconception 2: Bulgaria can delay the acceleration zone designation until it has actual data centre projects. Article 10(1) requires the designation of at least one acceleration zone "where data centre capacity is being deployed." The obligation is to designate the zone within six months to enable deployment, not to wait for projects to be fully underway. The zone designation is a preparatory step to facilitate future deployment. Waiting for projects to be fully underway before designating the zone would miss the deadline.

Misconception 3: The national strategy is optional if Bulgaria already has a digital strategy. While Article 7(3) notes that if a Member State has already adopted a national strategy that "adequately covers the objectives," it need not adopt another, it must update existing strategies if gaps are identified. Given the specific focus on cloud sovereignty, AI adoption, and data centre deployment in CADA, existing strategies will likely need significant updates to meet the new criteria. The notification to the Commission is mandatory regardless.

Misconception 4: The competent authority can be designated later if needed. The one-year deadline for designating the competent authority (Article 25(1)) is strict. This authority is essential for the recognition of cloud providers under the sovereignty framework. Without a designated authority, Bulgaria cannot formally recognise providers as meeting Union assurance levels, which could block public sector procurement of sovereign cloud services.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.