For organisations procuring cloud and AI, sovereignty means asking who controls the infrastructure, the provider and the software supply chain. Our Sovereign AI Innovation Tour uses CADA's four sovereignty assurance levels as a lens — connecting the framework to what delegations see at each stop.
On 4 August 2026, the EU Cloud and AI Development Act (CADA) took effect — the first European law to treat digital sovereignty not as a principle but as a procurement requirement. Part of a broader Tech Sovereignty Package, it responds to two vulnerabilities: a structural shortage of EU datacentre capacity, and dependency on a handful of non-EU cloud and AI providers. Delegations visiting in early 2027 see this ecosystem just after Europe began enforcing it — and can position their own organisation against those levels.
At its core sits a layered framework of four sovereignty assurance levels, used by public institutions when procuring cloud and AI services. On this tour, those four levels become a lens: at every stop, one question — where on this ladder does this party sit, and where should your own organisation be?
Standard commercial cloud and AI services, with no specific sovereignty guarantees beyond ordinary contractual terms.
Provider must demonstrate independence from third countries and offer transparency over the software supply chain.
Provider must be under EU ownership and control, with additional requirements such as nationality criteria for staff.
Complete transparency and control over the software supply chain, with no interference from any third country.
The EU Cloud and AI Development Act (CADA) is part of a broader Tech Sovereignty Package. It treats digital sovereignty as a procurement requirement and responds to a structural shortage of EU datacentre capacity and dependency on non-EU cloud and AI providers.
Level 1: Baseline. Standard commercial cloud and AI services, with no specific sovereignty guarantees beyond ordinary contractual terms. Level 2: Independence & transparency. Provider must demonstrate independence from third countries and offer transparency over the software supply chain. Level 3: EU ownership & control. Provider must be under EU ownership and control, with additional requirements such as nationality criteria for staff. Level 4: Full sovereignty. Complete transparency and control over the software supply chain, with no interference from any third country.
CADA is live but still evolving — provisions roll out in phases and the text remains in trilogue between Council and Parliament. We treat it as current, moving material, not a closed dossier.