A Report Series by FOTI

Right Diagnosis, Wrong Dose: Strengthening the EU's Cloud & AI Development Act

The European Commission’s Cloud and AI Development Act (CADA) represents a historic window of opportunity for Europe to secure its digital infrastructure. It correctly identifies the critical levers of industrial policy needed to do this - formalising a sovereign cloud framework, leveraging public procurement, and building domestic compute capacity. However, our close reading shows that at nearly every step, CADA sets limits that stop short of the structural change Europe needs to weather storms and thrive in the digital era.

If passed in its current form, we argue that CADA creates loopholes that will easily allow foreign monopolies to co-opt the "sovereign" label. This would perpetuate the continent's dependency, and continue to extract European value directly to entities outside Europe.

But all is not lost. To transform CADA into an engine for strategic autonomy and European growth, policymakers must close these loopholes. CADA’s main limitations include:

Our finding: CADA names the problem correctly, but does not go far enough to solve it.

CADA addresses almost every problem experts observe on the European cloud and AI market. At each of the four steps, however, it stops short of what would make the measure work.

It evaluates, behind closed doors: The strategies, assessments and monitoring it creates stay between Member States and the Commission. Nothing is published, no elected body sees the results, industry gets no signal on where to invest, and the private sector assesses its dependencies only if it wishes to.
It defines sovereignty hazardously, and the recognition lacks transparency and independence. Level 1 is self-declared with almost no guarantee of sovereignty, while the other levels have clear shortcomings that need to be addressed and a national recognition mechanism with no independence requirements
It builds capacity without a sovereignty condition. Across all provisions concerning funding, compute, zones, permits, strategic projects sovereignty never appears. The Act requires skills that are scarce and is not planning to support their production, and its one sustainability clause excludes renewable energy and cap national ambition.
It buys recognised services, not European ones. The only European preference is required by law to be "ancillary and not decisive". Derogations are open-ended, private operators of essential services are exempt, and a public buyer has no exit when a service loses its recognition.

None of this requires changing the architecture of the proposal. The four reports set out how to close each gap, article by article.

Each report answers one question that the CADA proposal is attempting to address. Each can be read on its own and includes an analysis of the current market and how the proposal attempts to address it, the remaining challenges with the proposal, and our recommendations.

Report 1 - Map the Risks

Where are our dependencies, and who and what do we depend on?

This report covers national cloud and AI strategies (Article 7), monitoring of the cloud computing capacity gap (Article 15), public sector risk assessments (Article 29), private sector assessments (Article 31) and union added value procurement monitoring (Article 33).

What we recommend:

Continuous monitoring of public cloud procurement, reported to a central register.
Publication by default of strategies, capacity reports and non-confidential summaries of risk assessments.
Protection for whistleblowers who report infringements to the sovereignty framework.
Mandatory dependency assessments for private operators in critical sectors, with an enforceable right to obtain supply chain information.

Download Report 1

Report 2 - Define Strong Standards

What must we verify to be free of unhealthy dependencies?

This report covers the Union cloud computing sovereignty framework and its four assurance levels (Article 16, Annexes II and III), associated third countries (Article 18), recognition and self-assessment of assurance levels (Articles 17 and 19), transparency and penalties (Articles 23 and 24), and national competent authorities (Articles 25 to 28).

What we recommend:

Independent national authorities, so that recognition is a technical decision rather than a political one.
Transparency on the hardware and software components behind a service, including at level 1.
An open review and amendment process for the assurance levels, with mandatory consultation of industry and civil society.
Closed loopholes in Annex II: subcontractors and resellers, the location derogation, source code audits, undefined terms, open source.

Download Report 2

Report 3 - Build Domestic Capacity

How do we build what we need to be sovereign and reduce our dependencies?

This report covers skills needs to build and evaluate sovereign (Articles 4, 5, 6, 7 and 20), frontier AI priority projects and compute (Articles 8 and 9), acceleration zones and permitting (Articles 10 to 13), strategic projects (Article 14) and the sustainability clause for acceleration zones and permitting (Article 11(1)).

What we ask:

Define, fund and deliver the competences needed to build, operate, audit and procure sovereign cloud and AI.
Condition Union and Member State compute, and frontier AI projects, on EU-controlled operators and recognised services.
Make acceleration-zone benefits conditional to service continuity under third-country pressure, a cap concentration, and a ”use it or lose it” principle.
Fix the sustainability clause so that it covers renewable energy and sets a floor, rather than a ceiling, for Member States.

Download Report 3

Report 4 - Buy European

How do we buy strategically, to invest in and build more sovereign solutions?

Covers the public procurement obligation and its derogations (Article 30), private sector entities (Article 31), Union added value (Article 32) and open source in the public sector (Articles 41 to 44).

What we ask:

Mandatory contract terms: knowledge transfer to the buyer, exit and reversibility at every assurance level, upstream contribution to the open source projects used.
A Union added value criterion that can decide an award.
Disciplined derogations: reasoned, notified, defined, time-limited and reported.
The same purchase obligation for private operators of essential services.

Download Report 4

Annex 1 - Recommendations at a Glance

Twenty-seven recommendations, numbered by report.

For each one, this document explains in one sentence, the ask and the parts that need to be modified, deleted or added in order to address the challenge the reports identified.

Download Annex 1

Summary Findings & Recommendations

Download Summary

A Report Series by FOTI

Right Diagnosis, Wrong Dose: Strengthening the EU's Cloud & AI Development Act

Our finding: CADA names the problem correctly, but does not go far enough to solve it.

None of this requires changing the architecture of the proposal. The four reports set out how to close each gap, article by article.

We are independent, not-for-profit, and take no corporate funding.