Summary Under the proposed Cloud and AI Development Act (CADA), Spain faces a compressed implementation timeline triggered by the Regulation's entry into force, not its later application date. Spain would be required to designate at least one data centre acceleration zone within six months of entry into force. Simultaneously, it must adopt a national cloud and AI strategy and designate national competent authorities within one year of entry into force. Crucially, once the strategy is adopted, Spain must notify the European Commission within three months. These deadlines are statutory and would apply regardless of whether the Regulation's general obligations apply a year later.

Detail

The Cloud and AI Development Act (CADA), as proposed in COM(2026) 502 final, is designed to rapidly restructure the EU's cloud and AI ecosystem. For Member States like Spain, the proposal establishes a "front-loaded" compliance schedule. While the Regulation would generally apply from the date of entry into force plus one year (Article 48), the foundational structural obligations for Member States are triggered immediately upon entry into force (Article 48).

This distinction is vital for Spanish public administration. The entry into force occurs on the twentieth day following publication in the Official Journal of the European Union. From that specific date, the clock starts ticking on the most critical infrastructure and governance milestones.

1. Data Centre Acceleration Zones: The 6-Month Deadline (Article 10)

The most immediate obligation for Spain concerns the physical deployment of computing infrastructure. Article 10(1) mandates that "where data centre capacity is being deployed within the territory of a Member State, that Member State shall designate at least one data centre acceleration zone ('acceleration zone') within its territory" by a specific deadline: [P.O. insert the date of entry into force of this Regulation plus 6 months].

This six-month window is exceptionally short for a process involving spatial planning, environmental assessment, and grid capacity analysis. When designating these zones, Spain would be legally required to consider a comprehensive set of factors under Article 10(1), including:

  • The location, dimension, and size constraints of the potential sites.
  • The availability of current and future power grid capacity, including conditions for on-site clean energy generation.
  • Network connectivity capacity and the ability to phase out legacy copper networks.
  • The capacity to reuse waste heat and the preference for brownfield sites over greenfield sites.
  • The site's ability to function sustainably, minimizing environmental impacts and carbon emissions.

Furthermore, Article 10(2) imposes a continuous duty on Spain to conduct a comprehensive analysis of the energy needs and greenhouse gas emission impacts of these zones. This analysis must be reviewed at least every three years. The results must be integrated into national network development plans to ensure "anticipatory grid investments" are made to accommodate future data centre demand.

2. National Cloud and AI Strategy: The 1-Year Deadline (Article 7)

Parallel to the infrastructure designation, Spain must establish a strategic policy framework. Article 7(1) requires Member States to establish national cloud and AI strategies "by [same day as entry into force plus one year]".

Spain is not necessarily required to draft a brand-new document if an existing strategy "adequately covers the objectives set out in this Regulation." However, if gaps are identified, the existing strategy must be updated to align with CADA's goals. The strategy must include, at a minimum:

  • Key objectives and priorities for adoption, adhering to the 'AI first' principle.
  • Measures to accelerate development at national, regional, and local levels, particularly for SMEs and public bodies.
  • Specific measures to deploy data centre capacity, focusing on high-value, energy-efficient facilities.
  • Investments in high-intensity computing infrastructure, such as AI factories, AI gigafactories, and quantum computers.
  • Support for cloud computing stack technologies built on open hardware and software to strengthen technological sovereignty.

Once the strategy is adopted, the reporting clock begins immediately. Article 7(5) states: "Member States shall notify the Commission of their national strategies within three months of their adoption." Additionally, Spain would be required to assess its strategy at least every three years based on key performance indicators and update it where necessary.

3. Designation of National Competent Authorities: The 1-Year Deadline (Article 25)

To enforce the sovereignty framework and supervise cloud providers, Spain must establish its regulatory oversight body. Article 25(1) mandates that Member States designate one or more national competent authorities responsible for enforcing the sovereignty chapter "by [P.O. insert date of entry into force plus 1 year]".

Spain may designate an existing authority or authorities for this role. Under Article 25(2), Spain must notify the Commission of the names of these authorities and their specific tasks and powers. The Commission will then maintain a public register of these authorities.

These authorities would be required to perform their tasks in an "impartial, transparent and timely manner" and must possess sufficient technical, financial, and human resources. A critical jurisdictional rule is set out in Article 25(4): the Member State where the cloud computing service provider has its main establishment (defined as the place where principal financial functions and operational control are exercised) has exclusive competence for enforcing the sovereignty framework. This means Spanish authorities would have exclusive enforcement power over providers established in Spain, even if those providers serve clients across the EU.

What this means for you

For Spanish public-sector bodies, infrastructure planners, and legal teams, the proposed CADA timeline demands immediate preparation, even before the Regulation is formally adopted.

  • Accelerated Spatial Planning: The six-month deadline for acceleration zones (Article 10) is the most critical bottleneck. Spanish regional and local authorities must pre-identify potential brownfield sites with adequate grid capacity and environmental resilience. Waiting for the Regulation to be fully adopted before starting site selection would likely make the six-month deadline impossible to meet.
  • Strategy Integration: The one-year deadline for the national strategy (Article 7) means that current Spanish digital strategies must be audited against CADA's requirements immediately. If gaps exist regarding "AI first" principles, open-source stacks, or data centre capacity, the update process must begin now to ensure adoption and notification within the statutory three-month window after the one-year mark.
  • Regulatory Clarity: The designation of competent authorities (Article 25) within one year will define the enforcement landscape. Public procurement officers must identify which Spanish body will hold exclusive competence over cloud providers established in Spain to ensure future contracts align with the correct oversight regime.
  • Reporting Readiness: The requirement to notify the Commission within three months of strategy adoption (Article 7(5)) leaves no room for administrative delay. Spain must have a streamlined internal process to finalize the strategy and transmit it to Brussels immediately upon adoption.

Common misconceptions

"The deadlines start when the law 'applies'."

  • Reality: This is the most dangerous misconception. While the Regulation would apply one year after entry into force (Article 48), the deadlines for designating acceleration zones (Article 10), adopting the national strategy (Article 7), and designating authorities (Article 25) are all calculated from the entry into force date. Spain would effectively have less than a year to complete these foundational tasks before the general application of the Regulation begins.

"Spain can ignore these deadlines if it already has a national AI strategy."

  • Reality: While Spain is not required to adopt a new strategy if an existing one "adequately covers the objectives," it must still formally notify the Commission within three months of adoption or update (Article 7(5)). Furthermore, any existing strategy must be updated to include specific CADA elements like the 'AI first' principle, open-source measures, and data centre capacity targets. Failure to update or notify would constitute an infringement.

"Acceleration zones only apply to new greenfield data centres."

  • Reality: Article 10(1) applies "where data centre capacity is being deployed." This explicitly includes the expansion, modernisation, and repurposing of existing facilities. If Spain plans to upgrade an existing data centre, it must ensure the site is within a designated acceleration zone to benefit from the streamlined permitting procedures.

"The competent authority can be chosen arbitrarily."

  • Reality: While Spain has discretion in which authority to designate, Article 25(4) strictly limits who can enforce the rules. Only the authority in the Member State where the provider has its main establishment (head office/operational control) has exclusive competence. This prevents regulatory arbitrage and ensures a single point of enforcement for each provider.

Related

This is general information about a draft EU regulation, not legal advice.