Summary Under the proposed Cloud and AI Development Act (CADA), Poland faces a rigorous implementation schedule triggered by the regulation's entry into force. Article 10(1) mandates the designation of at least one data centre acceleration zone within six months. Article 7(1) requires the adoption of a national cloud and AI strategy within one year, with a subsequent obligation to notify the European Commission within three months of adoption (Article 7(5)). Finally, Article 25(1) requires Poland to designate its national competent authority responsible for enforcing the sovereignty framework within one year. These deadlines are conditional on the proposal becoming law.

Detail

The Cloud and AI Development Act (CADA), as proposed in COM(2026) 502 final, establishes a harmonised framework to strengthen the EU's cloud and AI ecosystem. For Member States like Poland, the proposal imposes specific, time-bound obligations designed to accelerate infrastructure deployment and ensure regulatory oversight. The timeline is calculated relative to the date the regulation enters into force, which, under Article 48, would be the twentieth day following its publication in the Official Journal of the European Union.

1. Data Centre Acceleration Zones: The 6-Month Deadline

The most immediate infrastructure obligation for Poland concerns the designation of data centre acceleration zones. These zones are intended to streamline permitting and facilitate the rapid deployment of sustainable computing capacity.

Article 10(1) explicitly states: "Where data centre capacity is being deployed within the territory of a Member State, that Member State shall designate at least one data centre acceleration zone ('acceleration zone') within its territory by [P.O. insert the date of entry into force of this Regulation plus 6 months]."

This creates a strict six-month window from the moment CADA becomes applicable. During this period, Polish authorities must:

  • Identify suitable sites or areas within Polish territory.
  • Assess critical factors including available power grid capacity, network connectivity, and the potential for waste heat reuse (Article 10(1)(b), (c), (e)).
  • Ensure the designation considers the preference for reusing brownfield sites over greenfield sites (Article 10(1)(g)).
  • Prepare an aggregated baseline permit for the zone, covering common permits required for data centre projects, excluding grid connection permits (Article 13(2)).

Failure to designate a zone within this six-month period would constitute a breach of the proposed regulation. The designation is not optional for Member States where data centre capacity is being deployed; it is a mandatory step to unlock the accelerated permitting procedures and strategic project status benefits outlined in Articles 13 and 14.

2. National Cloud and AI Strategies: The 1-Year Deadline and Notification

Parallel to infrastructure designation, Poland must formulate a comprehensive national strategy to guide its cloud and AI adoption. This strategy serves as the blueprint for aligning national policies with the Union's objectives of competitiveness, innovation, and strategic autonomy.

Article 7(1) mandates: "By [same day as entry into force plus one year], Member States shall establish national cloud and AI strategies (the 'national strategies')."

The content of this strategy is detailed in Article 7(2) and must include:

  • Key objectives and priorities aligned with the 'AI first' principle.
  • Measures to accelerate adoption among SMEs, SMCs, and public sector bodies.
  • Plans for deploying data centre capacity with high environmental standards.
  • Investments in high-intensity computing infrastructure, such as AI factories and quantum computers.
  • Measures to support the development of cloud computing stack technologies based on open hardware and software.

Once Poland adopts this strategy, a secondary deadline applies. Article 7(5) requires: "The Member States shall notify the Commission of their national strategies within three months of their adoption."

This notification is crucial for the Commission to monitor consistency across the Union. Furthermore, Article 7(5) stipulates that Poland must assess its national strategies at least every three years based on key performance indicators and update them where necessary. The European Artificial Intelligence Board, established by the AI Act, will advise and assist Poland in coordinating these strategies (Article 7(6)).

3. National Competent Authorities: The 1-Year Deadline

To enforce the sovereignty framework and supervise cloud service providers, Poland must establish a dedicated regulatory body. This authority will be the primary point of contact for recognising Union assurance levels and handling enforcement actions.

Article 25(1) states: "By [P.O. insert date of entry into force plus 1 year], Member States shall designate one or more national competent authorities responsible for enforcing this Chapter."

This deadline aligns with the strategy adoption date, ensuring that the regulatory body is in place to oversee the implementation of the national strategy. The designated authority must:

  • Possess the necessary resources, including technical, financial, and human resources (Article 25(3)).
  • Perform tasks in an impartial, transparent, and timely manner.
  • Have exclusive competence for enforcing the sovereignty chapter in the Member State where a cloud computing service provider has its main establishment (Article 25(4)).

Poland must also notify the Commission of the names of these authorities and their specific tasks and powers (Article 25(2)). The Commission will maintain a public register of these authorities.

4. Additional Critical Deadlines

Beyond the three primary milestones, the proposal sets other deadlines that impact Poland's public sector and procurement landscape:

  • Risk Assessments (Article 29(1)): By one year after entry into force, Poland and its Union entities must carry out risk assessments to identify public sector activities contributing to the preservation of public order (e.g., defence, law enforcement, national security). These assessments determine the required Union assurance level (2, 3, or 4) for procuring cloud services.
  • Single Information Points (Article 12): While Article 12 does not specify a distinct deadline separate from the acceleration zone designation, the designation of single information points to assist data centre operators is a prerequisite for the functioning of the acceleration zones. Therefore, these should be operational by the six-month mark.
  • Review Clause (Article 47(1)): The Commission is required to evaluate the functioning of the Regulation five years after its entry into force and submit a report to the European Parliament and the Council.

What this means for you

For Polish public administrators, infrastructure developers, and legal counsel, the proposed CADA timeline demands proactive preparation. Although the regulation is currently a proposal, the relative deadlines (6 months and 1 year) are tight once the law is adopted.

  1. Accelerate Site Identification: Infrastructure ministries and spatial planning authorities should immediately begin identifying potential sites for data centre acceleration zones. The six-month window leaves little room for prolonged environmental impact assessments or political negotiation. Early engagement with grid operators and energy providers is essential to meet the power capacity requirements of Article 10(1).
  2. Draft the National Strategy Now: The one-year deadline for the national cloud and AI strategy is a significant policy undertaking. Polish authorities should start drafting the strategy to ensure it covers all mandatory elements of Article 7(2), particularly the 'AI first' principle and plans for data centre deployment. The three-month notification window after adoption requires that the final text be ready for immediate submission to the Commission.
  3. Designate the Authority Early: The national competent authority must be designated within one year. This body will have significant powers, including the ability to impose penalties and revoke recognitions. Poland should consider whether to designate an existing authority (e.g., within the Ministry of Digital Affairs or a cybersecurity agency) or create a new entity, ensuring it has the resources mandated by Article 25(3).
  4. Prepare for Procurement Shifts: Once the risk assessment is completed (due at the one-year mark), public procurement rules will change. Contracting authorities in Poland will be required to procure cloud services at Union assurance levels 2, 3, or 4 for activities identified as contributing to public order (Article 30(3)). Procurement teams must begin mapping current contracts against these future requirements.

Common misconceptions

  • "The deadlines are flexible." No. The proposal uses mandatory language ("shall designate", "shall establish"). The six-month and one-year deadlines are strict legal obligations relative to the entry into force.
  • "Poland can wait until the law is fully adopted to start planning." Waiting is risky. The six-month deadline for acceleration zones is extremely short. Preparing site data and conducting preliminary energy analyses now will be critical to meeting the deadline once the regulation enters into force.
  • "The national strategy is just a document." The strategy is a binding framework. It must include specific measures for data centre deployment, AI adoption, and open-source technologies. It will be monitored by the Commission and the AI Board.
  • "Only the central government is involved." While the central government designates the zones and the authority, local and regional authorities are crucial for spatial planning and permitting within the acceleration zones. Local bodies must align their plans with the national strategy.
  • "CADA is already law." CADA is a proposal (COM(2026) 502 final). The deadlines described are conditional on the European Parliament and Council adopting the text. However, the timeline is fixed in the proposal text.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.