IViR Position Paper: The EU’s Proposal for a Cloud and AI Development Act: Not the Industrial Policy the EU Needs

In 2025, the European Commission decided to address European Union (EU)’s stark dependence “on a limited pool of third-country providers”, where “three non-EU hyperscalers control over 70% of the European cloud market.” The Commission’s proposal for the Cloud and AI Development Act (CADA) states that it seeks “to address the limited and geographically concentrated availability of computing capacity in the EU and the risks associated with dependence on cloud and AI supplied by non-European providers.” To ensure this increase in EU-based compute and AI uptake, the CADA proposal would set more attractive investment conditions by lowering administrative red tape and simplifying permit standards for a massive build-out of data centre capacity. At the same time, the CADA proposal would introduce a risk-based framework for public sector uses of cloud computing which would reduce reliance on non-European cloud computing services for public sector activities that contribute to the public order. The proposal aims to realise these ambitions by A) promoting cloud and AI leadership strategies, B) expanding data centre capacities, C) establishing a cloud sovereignty framework with demand-side measures and D) Union assurance levels, and finally E) supporting open source. This position paper examines this five-pronged approach to identify current gaps and ways to address them, as CADA is in the legislative proposal phase.