ZetrixwebWhat was proposed
The European Commission published the proposal for a Cloud and AI Development Act, COM(2026) 502, on 3 June 2026. Summaries describe three pillars: supporting research and innovation projects, simplifying and harmonizing the deployment of data centres across the EU, and creating a single EU-wide framework for cloud sovereignty that deals with reliance on providers from outside the Union. It covers remotely hosted and operated AI systems as well as cloud.
The sovereignty framework sets four Union assurance levels for cloud services, assessed through self-assessment or independent audit. Public bodies would have to run risk assessments before using cloud services and apply minimum assurance levels in procurement, with weight given to EU added value. Member states would be asked to designate data centre acceleration zones. It sits alongside a proposed revision of the Cybersecurity Act and the EUCS cloud certification scheme.
Questions vendors should be ready to answer
Whatever the final levels look like, buyers will probe the same dimensions: who owns and controls the provider, which jurisdictions' laws can compel access to data, where data and keys are held, where support and operations staff are located, and which sub-processors are involved.
If you sell SaaS or AI services to EU public bodies or regulated industries, assemble honest answers now. You may find that the answer for some customers is a different deployment option rather than a different message.
| Dimension | Question a buyer may ask | What to prepare |
|---|---|---|
| Control | Who ultimately owns and controls the provider? | Corporate structure summary |
| Jurisdiction | Can non-EU authorities compel access? | Legal analysis and transparency practices |
| Data and keys | Where are data and encryption keys held? | Architecture diagram with key management |
| Operations | Where is support and admin access located? | Staffing and access model |
| Supply chain | Which sub-processors do you rely on? | Maintained sub-processor list |
Architecture choices that keep options open
Design so that data residency, key management, and operations can vary by region without forking the product. Keep infrastructure reproducible, avoid hard dependencies on a single provider's proprietary services, and document your sovereignty posture in a form you can hand to a procurement team.
Our guides on cloud switching under the Data Act and on hosting AI features describe the practical options.
Selling cloud or AI services to EU public bodies? Talk to us about a sovereignty-ready architecture.
Key takeaways
- The Cloud and AI Development Act was proposed on 3 June 2026 and has not been adopted.
- It proposes four Union assurance levels for sovereign cloud, public-sector risk assessments, and procurement weight for EU added value.
- Be ready to answer questions on control, jurisdiction, data and keys, operations location, and sub-processors.
- Keep deployment options flexible by region and document your posture.