Summary As proposed in the Cloud and AI Development Act (CADA), COM(2026) 502 final, every Member State must establish a national cloud and AI strategy no later than one year after the Regulation enters into force, pursuant to Article 7(1). Once adopted, these strategies must be notified to the European Commission within three months, as mandated by Article 7(5). This dual deadline ensures that national plans are rapidly aligned with the EU's objectives for technological sovereignty, competitiveness, and the Digital Decade targets.

Detail

The Cloud and AI Development Act (CADA) establishes a harmonised framework to strengthen Europe's cloud and AI ecosystem. A critical component of this framework is the requirement for Member States to formulate and implement coherent national strategies. These strategies serve as the primary vehicle for translating Union-level objectives into national action, ensuring that capacity building, data centre deployment, and AI adoption are coordinated across the single market.

The Statutory Deadline for Adoption

The timeline for adoption is explicitly defined in Article 7(1) of the proposal. The text states: "By [same day as entry into force plus one year], Member States shall establish national cloud and AI strategies (the 'national strategies')."

This provision creates a fixed, non-negotiable deadline relative to the Regulation's entry into force. The Regulation itself, under Article 48, is proposed to enter into force on the twentieth day following its publication in the Official Journal. Consequently, the clock for national strategy adoption begins on that date. Member States are granted a one-year window to consult stakeholders, assess existing digital policies, and draft a strategy that addresses both Union objectives and specific national needs.

For instance, if the Regulation were to enter into force on 1 January 2027, the deadline for Member States to formally establish their strategies would be 1 January 2028. This period is designed to be sufficient for legislative or administrative preparation without delaying the broader implementation of the CADA framework.

The Notification Obligation

Adopting the strategy is only the first step in the compliance cycle. Article 7(5) imposes a strict subsequent obligation regarding transparency and oversight. The text mandates: "The Member States shall notify the Commission of their national strategies within three months of their adoption."

This notification requirement serves several critical functions within the CADA governance structure:

  • Monitoring: It enables the Commission to track the timely adoption of strategies across all Member States.
  • Consistency Check: It allows the Commission to verify that national strategies are consistent with the objectives of the Regulation, as required by Article 7(3).
  • Alignment Verification: It ensures that strategies contribute to the digital targets established under the Digital Decade Policy Programme (Decision (EU) 2022/2481), specifically regarding cloud adoption and edge node deployment, as noted in Article 7(4).

Failure to notify within this three-month window would constitute a breach of the Regulation's procedural requirements, potentially triggering infringement procedures or requiring the Commission to issue guidance to correct the delay.

Content Requirements and Strategic Alignment

While Article 7(1) sets the deadline, Article 7(2) outlines the mandatory content of these strategies. To be compliant, a national strategy must include at least the following elements:

  • Key objectives and priorities for cloud and AI adoption, aligned with the 'AI first' principle.
  • A governance and monitoring framework to achieve these objectives.
  • Measures to accelerate adoption at national, regional, and local levels, particularly for public sector bodies, SMEs, and small mid-caps (SMCs).
  • Measures to support the deployment of data centre capacity, with a focus on high-value, environmentally efficient facilities.
  • Measures to invest in high-intensity computing infrastructure, including AI factories and quantum computers.
  • Measures to support the development of cloud computing stack technologies built upon open hardware and software.
  • Measures to ensure the accessibility of high-quality data for AI development.

Crucially, Article 7(3) stipulates that "National strategies shall be consistent with the objectives of this Regulation." Furthermore, Article 7(4) requires that "Member States shall ensure that their national strategies are consistent with, and contribute to, the associated digital targets established under Article 4 of Decision (EU) 2022/2481." This creates a binding link between national planning and the EU's broader digital targets, such as the goal for 75% of enterprises to adopt cloud computing services.

Review and Update Cycles

National strategies under CADA are not static documents. Article 7(5) further mandates a continuous review process: "Member States shall assess their national strategies at least every three years on the basis of key performance indicators and, where necessary, update them."

This triennial review cycle ensures that strategies remain relevant in the face of rapid technological change. The Commission is tasked with monitoring both the initial adoption and these subsequent revisions. Additionally, Article 7(6) assigns a coordination role to the European Artificial Intelligence Board (established by the AI Act), which shall "advise and assist the Member States as regards the coordination of national strategies" and "facilitate exchange of best practices among Member States."

What this means for you

For legal counsel, compliance officers, and strategic planners, the Article 7 timeline represents a pivotal external milestone. The adoption of national strategies will directly influence the regulatory environment for cloud and AI services in your jurisdiction.

1. Timeline Planning and Risk Assessment

Organisations must map their internal roadmaps against the Article 7(1) deadline. Since the deadline is tied to the Regulation's entry into force (not the proposal date), you must monitor the Official Journal for the publication date. Once published, add 20 days for entry into force, then add one year to determine the national strategy deadline. This is the point at which national priorities will crystallise, potentially affecting public procurement criteria and data centre permitting processes.

2. Anticipating National Priorities

The content requirements in Article 7(2) suggest that national strategies will heavily emphasise:

  • Sovereign Cloud: Expect national strategies to prioritise the uptake of cloud services recognised under the CADA sovereignty framework (Union assurance levels).
  • Open Source: Strategies will likely include measures to promote open-source solutions, aligning with Article 41 of CADA.
  • Data Centre Acceleration: Strategies will detail plans for designating "acceleration zones" (under Article 10), which could impact real estate and infrastructure investment decisions.

3. Engagement with National Competent Authorities

The notification requirement in Article 7(5) means the Commission will have visibility into national plans shortly after adoption. Organisations should proactively engage with national competent authorities (designated under Article 25) to understand how the national strategy will be operationalised. This is particularly relevant for entities seeking to participate in the EuroCloud Federation or apply for "frontier AI priority project" status.

4. Compliance with the 'AI First' Principle

Article 7(2)(a) explicitly requires strategies to include the 'AI first' principle. For private and public sector bodies, this signals a shift in procurement and deployment logic. Organisations should prepare to demonstrate how their AI and cloud strategies align with national 'AI first' mandates, which may become a condition for accessing certain public funds or procurement opportunities.

Common misconceptions

Misconception 1: The deadline is calculated from the date the proposal was published. Reality: The deadline in Article 7(1) is strictly tied to the entry into force of the Regulation. The entry into force occurs 20 days after publication in the Official Journal (Article 48). Calculating the deadline from the proposal date (COM(2026) 502 final) would result in an incorrect timeline.

Misconception 2: National strategies are optional or non-binding. Reality: While the strategy itself is a national policy document, the obligation to establish it is mandatory under Article 7(1). Furthermore, the content must be consistent with CADA objectives (Article 7(3)) and Digital Decade targets (Article 7(4)). Failure to adopt a compliant strategy could lead to infringement proceedings by the Commission.

Misconception 3: Once adopted, the strategy remains unchanged. Reality: Article 7(5) explicitly requires Member States to assess their strategies at least every three years and update them where necessary. The strategy is a living document that must evolve with technological and market conditions.

Misconception 4: The Commission approves the strategies. Reality: The Commission does not "approve" the strategies in a legislative sense. Instead, it monitors their adoption and revision (Article 7(5)) and receives notification within three months. The European Artificial Intelligence Board advises on coordination (Article 7(6)), but the primary responsibility for drafting and adopting the strategy lies with the Member State.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.