The EU’s proposed Cloud and AI Development Act (CADA) is intended to strengthen Europe’s cloud and AI sectors and reduce its dependence on providers from outside Europe. But according to researchers at the Institute for Information Law (IViR) at the University of Amsterdam, the proposal falls short of its goal. They are also concerned about the rapid expansion of data centres and the limited attention paid to sustainability and social impact.
The European cloud market is highly dependent on three US tech giants, which together control more than 70% of the market. The EU also spends €264 billion a year on predominantly US IT products and services.
To reduce this dependence, the European Commission has proposed the CADA. The proposal aims to make investment in large-scale data centre expansion more attractive, including by reducing administrative red tape and simplifying permit requirements. It also introduces rules for public sector procurement of cloud services.
Not ambitious enough
The researchers analysed the proposed EU legislation and conclude that it is not ambitious enough to strengthen Europe’s digital autonomy. Kristina Irion, one of the researchers, says the proposal could undermine Dutch ambitions to achieve greater digital sovereignty and reduce dependence on Big Tech, at a time when the Netherlands is taking steps in that direction.
The researchers argue that the proposal would limit public authorities’ ability to set additional requirements for many services and thereby reduce their dependence on a handful ofthird country providers. ‘As currently drafted, the EU proposal could even prevent public sector organisations from consciously choosing a European alternative,’ says Irion.
The proposed large-scale expansion of data centre capacity also does not guarantee greater digital autonomy, the researchers argue. ‘Under the proposal providers and developers from outside the EU would retain a strong foothold’, adds co-author Plixavra Vogiatzoglou. The researchers also say it gives too little attention to sustainability and the interests of local communities.
Assessment of five areas
The researchers assessed the proposal across five areas:
1. Cloud and AI leadership : The CADA aims to encourage the development and use of cloud and AI. The researchers say it focuses too heavily on growth and AI’s potential benefits. The effects on fundamental rights, employment, local communities and the environment receive too little attention. They also call for stronger safeguards for transparency, participation and local involvement.
2. Expanding data centre capacity : The proposal aims to speed up data centre construction, including by creating special zones where permits can be issued more quickly. The researchers say sustainability and social impacts are not adequately safeguarded. They also question whether the proposal explains convincingly why data centres should take priority over other demands for energy, water, land and electricity grid capacity.
3. Digital sovereignty and public procurement : The CADA links stricter requirements for cloud services to the risk level of public sector activities. Many public services, however, would be assigned the lowest Union assurance level. The researchers say this limits public authorities’ ability to set additional procurement requirements for many services and reduce their dependence on a single provider.
4. Union assurance levels: The proposal introduces four Union assurance levels, with increasingly strict requirements for cloud services. The researchers say the criteria do not automatically exclude large US providers, which may be able to meet many of the requirements at the two lower levels. The European Commission estimates that only 10% of use cases would require the highest levels of which third country providers are excluded.
5. Open source and cloud federations : The CADA aims to promote open source software and enable public sector organisations to share cloud services and digital resources. The researchers say that support for open source is limited and largely optional. They also question how organisations can share cloud services when they rent the infrastructure from a provider rather than owning it themselves.
Digital autonomy requires more than additional data centres
The researchers say the EU’s dependence on a small number of non-European providers is a serious problem. But, in their view, the CADA focuses too heavily on expanding data centre capacity and encouraging the use of cloud and AI. ‘Greater digital autonomy also requires clear sustainability rules, democratic participation, stronger public procurement requirements and more support for European and open alternatives,’ says Irion.
Details publication
Plixavra Vogiatzoglou, Kristina Irion, Anushka Mittal, Laurens Naudts en Charis Papaevangelou, 2026, Position Paper ‘ The EU’s Proposal for a Cloud and AI Development Act: Not the Industrial Policy the EU Needs ', Amsterdam: The Institute for information Law, 2026
Content analysis
5-Nov-2026