Summary As proposed in COM(2026) 502 final, the Cloud and AI Development Act (CADA) imposes a synchronized, non-negotiable timeline for France to align its infrastructure and governance with EU sovereignty goals. France must designate at least one data centre acceleration zone within six months of the Regulation's entry into force. Furthermore, France must establish its national cloud and AI strategy and designate its national competent authority for enforcement within one year of entry into force. Crucially, the national strategy must be notified to the European Commission within three months of its adoption. These deadlines are calculated from the date of entry into force (20 days after publication), not the date of application.

Detail

The proposed Cloud and AI Development Act (CADA) establishes a harmonized framework to strengthen Europe's cloud and AI ecosystem. For France, as for all Member States, the timeline for compliance is rigidly structured around the Regulation's entry into force. CADA is currently a proposal; if adopted in its current form, the deadlines below would become binding legal obligations.

The timeline is anchored by Article 48, which states that the Regulation shall enter into force on the twentieth day following its publication in the Official Journal of the European Union. While the Regulation generally applies from one year after entry into force, specific operational obligations for Member States have earlier, distinct deadlines to ensure the ecosystem is prepared before the full regime applies.

1. Data Centre Acceleration Zones (6 Months After Entry Into Force)

The most immediate operational task for France is the physical designation of infrastructure zones. Under Article 10(1), Member States must designate at least one "data centre acceleration zone" within their territory by six months after the entry into force of the Regulation.

This deadline is notably earlier than the general application date of the Regulation. It requires France to identify sites where data centre capacity is being deployed, considering factors such as power grid availability, network connectivity, and environmental sustainability. The goal is to accelerate permitting and ensure balanced geographic deployment of compute capacity across the Union.

The designation is mandatory "where data centre capacity is being deployed within the territory of a Member State." France must consider specific aspects when designating these zones, including the location and dimension of the site, available power grid capacity, network connectivity, and the ability to reuse waste heat. The designation must also prioritize the reuse of brownfield sites over greenfield sites and ensure the site can function sustainably.

2. National Cloud and AI Strategy (1 Year After Entry Into Force)

Under Article 7(1), France must establish a national cloud and AI strategy by one year after the entry into force of the Regulation. This strategy must be coherent with the Regulation's objectives, including the "AI first" principle and measures to accelerate cloud and AI adoption at national, regional, and local levels.

The strategy must include specific measures to:

  • Support the deployment of data centre capacity, with a focus on high-value data centres adhering to high environmental and energy-efficiency standards.
  • Invest in high-intensity computing infrastructure, including AI factories, AI gigafactories, and quantum computers.
  • Support the development of cloud computing stack technologies built upon open hardware and software to strengthen technological sovereignty.
  • Ensure the accessibility of high-quality data for AI development.

Once adopted, Article 7(5) requires France to notify the Commission of its national strategy within three months of adoption. This notification allows the Commission to monitor the adoption and revision of national strategies across the Union. France must also assess its strategy at least every three years based on key performance indicators and update it if necessary. The European Artificial Intelligence Board (established by the AI Act) shall advise and assist France regarding the coordination of these strategies.

3. Designation of National Competent Authorities (1 Year After Entry Into Force)

To enforce the cloud computing sovereignty framework, Article 25(1) requires France to designate one or more national competent authorities by one year after the entry into force of the Regulation. These authorities are responsible for recognizing cloud computing service providers that meet the Union assurance levels and for supervising compliance.

France may designate an existing authority or establish a new one. Article 25(2) requires France to notify the Commission of the names of these competent authorities, their tasks, and their powers. The Commission will then maintain a public register of these authorities.

The designated authority will have exclusive competence for enforcing the sovereignty chapter in the Member State where the cloud provider has its main establishment. This authority will be responsible for evaluating applications for recognition, collaborating with other Member States' authorities, and ensuring that cloud providers comply with the Union assurance levels set out in Annex II.

Summary Timeline

Obligation Deadline (Relative to Entry Into Force) Legal Basis
Designate Data Centre Acceleration Zones 6 months Article 10(1)
Adopt National Cloud and AI Strategy 1 year Article 7(1)
Notify Commission of National Strategy 3 months after adoption Article 7(5)
Designate National Competent Authority 1 year Article 25(1)
Notify Commission of Competent Authority As soon as possible (after designation) Article 25(2)

What this means for you

For public-sector bodies, procurement officers, and infrastructure investors in France, these deadlines create a clear roadmap for upcoming regulatory changes.

  1. Infrastructure Planning: The six-month deadline for acceleration zones means that site selection and permitting processes must be accelerated immediately upon the Regulation's entry into force. Developers should monitor the designation of these zones to understand where streamlined permitting and potential support measures will be available.
  2. Strategic Alignment: The national cloud and AI strategy will likely define the specific goals and priorities for public sector cloud adoption. Procurement officers should monitor the development of this strategy, as it will inform the "EU added value" criteria and innovation procurement targets set out in CADA. The strategy will also guide the allocation of computing resources to frontier AI priority projects.
  3. Engagement with Authorities: As the competent authority is established, public bodies should engage with it to understand the recognition process for cloud providers. This is crucial for ensuring that the services procured are compliant with the sovereignty framework and can be used for sensitive public sector activities. The authority will manage the recognition of services at Union assurance levels 1 through 4.

Common misconceptions

  • "The deadlines start when the law is published." Incorrect. The key deadlines are calculated from the entry into force (20 days after publication), not the publication date itself. Furthermore, the general application of the Regulation is delayed by one year after entry into force, though specific tasks like acceleration zone designation have earlier, specific deadlines.
  • "France can choose not to designate an acceleration zone if it already has data centres." Incorrect. Article 10(1) mandates that where data centre capacity is being deployed, the Member State shall designate at least one acceleration zone. It is not optional if deployment is occurring.
  • "The national strategy is a one-time submission." Incorrect. Article 7(5) requires France to assess its national strategy at least every three years and update it if necessary. It is a living document that must evolve with technological and market developments.
  • "The competent authority can be appointed after the strategy is adopted." Incorrect. Both the strategy and the competent authority must be established by the same deadline: one year after entry into force. The authority is needed to enforce the framework that the strategy supports.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.