EU proposes Cloud and AI Development Act (CADA) to impose cloud sovereignty requirements

What happened

The European Commission’s Cloud and AI Development Act (CADA) proposal would require cloud service providers to locate infrastructure in the EU, enforce EU data‑residency, and restrict foreign government access and control. The proposal creates four Union Assurance Levels (UALs) with increasing restrictions. The blog compares CADA with the U.S. FOCI regime and FedRAMP, highlighting key differences in scope and obligations.

Why it matters for trust and compliance

• Its status is proposed. It is not law yet. Track it, but do not treat it as an obligation.
• CADA would introduce EU‑wide cloud sovereignty rules, affecting any provider seeking public‑sector contracts across the Union.

Who is affected

Recommended actions

1. Review the transfer mechanisms relied on for affected data flows.
2. Map the security requirements to existing controls and close gaps.