EU proposes Cloud and AI Development Act to limit US hyperscalers

The proposed Cloud and AI Development Act (CADA) aims at reinforcing the EU’s digital sovereignty and reducing critical tech dependencies. Nonetheless, this thrust for autonomy also has the possibility of slowly opening a rift with the United States, which is also classified as a “third country” to move away from. Washington is unlikely to appreciate this divergence, especially as the current administration is pushing to export a US-built AI stack to its allies. What to know: CADA is a comprehensive act of regulation targeting both supply and demand issues to attempt to create a concrete European data ecosystem. It was tabled on 3 June 2026 as part of a tech sovereignty package, together with a Chips Act 2.0 published the same day. Its main target is to at least triple EU data-centre capacity within 5 to 7 years, but its objectives stretch from R&D and innovation to capacity and autonomy. The latter is where the assurance levels which are causing tensions with Washington can be found alongside the common procurement frameworks. The act would establish a hierarchy of assurance levels, based on how sensitive the public function is. Levels 1 and 2 cover 90% of EU public cloud contracts, and would remain accessible to US companies and hyperscalers subject to conditions Level 3 (comprising circa 9% of contracts) would be open to US firms mainly through EU joint ventures, or via Article 18 if the US were recognised as an ‘associated third country’, which is unlikely given concerns over government access to data, US sanctions powers and chip export controls. The last 1% at Level 4 would then, if the act were to pass, be ultimately cut off completely from US companies, as it requires full EU control of software and offers no possible derogation This legislation is of interest to the USA, since Amazon, Microsoft and Google hold about 70% of the EU cloud market. Additionally, under this legislation, the US would probably sit in the same “third country” category as China, with Article 18 or EU joint ventures offering the only routes to the higher levels. This would most likely undermine transatlantic relations and also hinder business ties with major US software companies. The stake for this legislation as a whole is nonetheless not only simply market share and access, but who controls the state’s digital infrastructure, a factor increasingly important in today’s modern world and the wake of the new hybrid threats faced by the union. The real test for the EU will essentially thus be public procurement, where the proposal ties the required assurance level to how sensitive a function is. Under Article 29, each member state and EU institution must run risk assessments deciding which of its activities are sensitive. Article 30 expands this, as under it every public cloud contract needs at least Level 1. In defence, internal security, justice, law enforcement and the sensitive parts of NIS2 sectors (energy, health, transport, water), only Levels 2 to 4 are allowed. CADA runs directly counter to Washington’s AI tech export strategy. The United States has been prioritizing the sale of hardware, models, software, applications and even standards to its allies across the globe, and could thus potentially see its efforts hindered from European initiatives for tech sovereignty. This US initiative is articulated precisely by the current administration in its US AI action plan and in the Executive Order 14320, and is a cornerstone of Donald Trump’s foreign policy, which is why a rift on this issue could potentially arise if CADA were to pass on terms deemed unfavourable or unfair by Washington. The potential divergence essentially emerges from the US drive for a US-led AI ecosystem embraced by all allies colliding with Brussels’ willingness to keep autonomy for its most sensitive functions. This has led to the Computer and Communications Industry Association (CCIA) labelling the act as potentially discriminatory, but this is unlikely to deter the EU. As seen by European Tech Commissioner Henna Virkkunen’s assertion in the parallel fight over the Digital Markets Act that the EU has the sovereign right to regulate tech platforms, officials in Brussels see potential restrictions in the name of strategic autonomy as not only legitimate, but also as potentially necessary and even inevitable. CADA therefore raises a more fundamental question about where Europe draws the boundaries of technological sovereignty. Reducing exposure to technologies controlled by strategic competitors such as China is one thing; applying the same logic, even selectively, to the United States is another. Washington is not simply a foreign technology provider but Europe’s principal security ally and its most important technological partner. Treating American technology as a dependency from which Europe must insulate its most sensitive functions risks blurring the distinction between de-risking from a competitor and seeking autonomy from an ally. That distinction matters because cloud infrastructure and AI are rapidly becoming part of the strategic architecture underpinning economic security, defence and state capacity. If European sovereignty comes to mean limiting American participation in precisely those areas Washington considers central to a shared Western technological ecosystem, a regulatory debate could develop into a broader transatlantic fault line. The bottom line: As CADA moves through the European Parliament and Council, the issue is therefore not simply how much technological dependence Europe is willing to accept, but whether strategic autonomy can be pursued without weakening the technological interdependence on which the transatlantic alliance increasingly relies. The post How Brussels wants to kick the U.S. out of the EU Cloud appeared first on Decode39.