Summary Under the proposed Cloud and AI Development Act (CADA), Slovenia would face a compressed implementation timeline starting from the Regulation's entry into application. If adopted as proposed, Slovenia must designate at least one data centre acceleration zone within six months of entry into force. Within one year, the country must adopt a national cloud and AI strategy, designate national competent authorities to enforce the sovereignty framework, and notify the European Commission of these measures. These deadlines are binding only if the proposal becomes law; the timelines begin counting from the date the Regulation enters into application, not its publication.

Detail

The Cloud and AI Development Act (CADA), currently a legislative proposal (COM(2026) 502 final), establishes a harmonised framework to strengthen the EU's cloud and AI ecosystem. For Member States like Slovenia, the proposal introduces specific, time-bound obligations designed to accelerate infrastructure deployment and ensure regulatory consistency. It is critical to emphasise that CADA is not yet in force. The deadlines outlined below apply only if the Regulation is adopted in its current form and enter into force as proposed.

The timeline for Slovenia's obligations is anchored to the date the Regulation enters into application. According to Article 48 of the proposal, the Regulation would enter into force on the twentieth day following its publication in the Official Journal of the European Union. However, it would apply from one year after that date. This one-year gap is the "implementation window" during which Member States must prepare their administrative and strategic frameworks before the substantive obligations kick in.

1. Designation of Data Centre Acceleration Zones (6 Months)

The first major operational deadline for Slovenia concerns physical infrastructure. Under Article 10(1), Member States are required to designate at least one data centre acceleration zone within their territory where data centre capacity is being deployed.

The deadline for this designation is strict: it must be completed by the date of entry into force plus six months. This is a relatively short window, requiring Slovenia to rapidly identify suitable sites that meet specific criteria. When designating these zones, Slovenian authorities would need to consider:

  • Power and Grid Capacity: The available and future power grid capacity, including the possibility of on-site clean energy generation.
  • Connectivity: The availability of network connectivity capacity.
  • Sustainability: The ability of the site to function sustainably, minimising environmental impacts and supporting carbon emission reductions.
  • Brownfield Preference: A preference for reusing brownfield sites over greenfield sites.

This designation is not merely a planning exercise; it triggers specific legal benefits. As outlined in Article 13, data centre projects deployed within these acceleration zones would be considered "strategic projects" for the purpose of environmental assessments, benefiting from a dedicated toolbox to accelerate permit-granting processes. The permit-granting procedure for such projects would be capped at 12 months.

2. National Cloud and AI Strategy (1 Year)

Parallel to the infrastructure designation, Slovenia must develop a comprehensive strategic roadmap. Article 7(1) mandates that Member States establish national cloud and AI strategies within one year of the Regulation's entry into force.

These strategies are not optional high-level documents; they must contain specific, actionable elements. According to Article 7(2), the strategy must include:

  • Key objectives and priorities for cloud and AI adoption, aligned with the "AI first" principle.
  • A governance and monitoring framework to achieve these objectives.
  • Measures to accelerate development at national, regional, and local levels, particularly for SMEs and public sector bodies.
  • Specific measures to support the deployment of data centre capacity, adhering to high environmental standards.
  • Investment plans for high-intensity computing infrastructure, such as AI factories and quantum computers.
  • Measures to support the development of cloud computing stack technologies built on open hardware and software.

Crucially, Article 7(5) imposes a notification requirement. Slovenia must notify the European Commission of its national strategy within three months of its adoption. This ensures the Commission can monitor consistency with Union objectives and the Digital Decade targets. The strategy is not static; Member States must assess it at least every three years and update it where necessary.

3. Designation of National Competent Authorities (1 Year)

To enforce the sovereignty framework, Slovenia must establish the necessary regulatory bodies. Article 25(1) requires Member States to designate one or more national competent authorities responsible for enforcing the cloud computing sovereignty framework by the date of entry into force plus one year.

These authorities would hold exclusive competence for enforcing the sovereignty chapter (Title IV) for providers established in Slovenia. Their tasks would include:

  • Recognising cloud computing service providers as offering specific Union assurance levels (Levels 1–4).
  • Supervising compliance with the criteria set out in Annex II.
  • Exercising investigative and enforcement powers, including the ability to order the cessation of infringements and impose fines.

Slovenia may designate an existing authority or establish a new one. Under Article 25(2), the Member State must notify the Commission of the names, tasks, and powers of these authorities. The Commission is then required to maintain a public register of these authorities to facilitate cross-border cooperation and transparency. The designated authority must be equipped with sufficient technical, financial, and human resources to perform its tasks impartially and effectively.

Summary of Key Deadlines for Slovenia

Obligation Legal Basis Deadline Calculation
Designate Data Centre Acceleration Zones Article 10(1) 6 months after entry into force
Adopt National Cloud and AI Strategy Article 7(1) 1 year after entry into force
Notify Commission of National Strategy Article 7(5) 3 months after adoption of the strategy
Designate National Competent Authorities Article 25(1) 1 year after entry into force
Notify Commission of Competent Authorities Article 25(2) As soon as possible after designation

What this means for you

For Slovenian public-sector bodies, policy makers, and industry stakeholders, these deadlines signal a need for immediate preparatory work, even while the legislative process is ongoing.

  • For Infrastructure Planners and Energy Regulators: The six-month deadline for designating acceleration zones is aggressive. Slovenia must begin mapping potential sites now, assessing grid capacity and environmental constraints, to ensure a compliant designation can be made immediately upon entry into force. Early coordination with transmission system operators is essential.
  • For Public Procurement Officers: The national cloud and AI strategy will define how Slovenia aligns its procurement with the Union's sovereignty goals. Officers should prepare to integrate Union assurance levels into future tenders. Once the strategy is adopted, procurement decisions for public-order-relevant activities will be constrained by the assurance levels identified in the risk assessments required under Article 29.
  • For Cloud Service Providers: The designation of national competent authorities creates a new regulatory interface. Providers aiming to serve the Slovenian public sector must prepare for the recognition process under Article 17, which involves submitting evidence of compliance with Union assurance levels. The timeline for designating these authorities (one year) suggests that the recognition regime could be operational shortly after the strategy is adopted.
  • For Policy Makers: The one-year window to adopt the national strategy requires a cross-departmental effort involving ministries responsible for digitalisation, energy, economy, and justice. The strategy must be coherent with the Digital Decade targets and the "AI first" principle, requiring significant inter-ministerial coordination.

Common misconceptions

"These deadlines are already in effect." No. CADA is a proposal. The deadlines only start counting once the Regulation is adopted, published, and enters into application (one year after publication). The legislative procedure in the European Parliament and Council could still alter these timelines or the specific obligations.

"Slovenia can simply designate any existing data centre hub." Not necessarily. Article 10 requires specific designations of "acceleration zones" that meet strict criteria, including sustainability requirements, grid capacity analysis, and streamlined permitting potential. Existing zones may need to be upgraded or re-designated to comply with the new framework.

"The national strategy is a one-time administrative task." Incorrect. Article 7(5) explicitly requires the strategy to be assessed at least every three years and updated if necessary. It is a living document that must evolve with technological developments and market conditions.

"The competent authority can be any ministry." While Slovenia has flexibility, Article 25 requires the designated authority to have "sufficient technical, financial and human resources" and the power to enforce the sovereignty framework. This often implies a need for a dedicated regulatory body or a significant upgrade of an existing agency's mandate, rather than a simple administrative assignment.

Official sources

Related

This is general information about a draft EU regulation, not legal advice.