Cloud and AI Development Act: Parliament’s Draft Report Puts Cloud Exit Plans Back on the Agenda

On November 11, 2026, the two European Parliament rapporteurs on the Cloud and AI Development Act (CADA) presented their joint draft report in Brussels, and their message was blunt. “Our critical systems run on someone else’s technology, and someone else can switch it off,” said Dutch MEP Reinier Van Lanschot, the rapporteur for the internal market committee. The proposal itself has been on the table since June, and its supporting impact assessment has been public since then too. What changed this week is that Parliament has started to put its own stamp on the text. For anyone who signs cloud contracts in Europe, that makes now a sensible time to ask a practical question: if a provider became unavailable, or legally unusable, for a given workload, how quickly could you move it?

What actually happened this week

Some early summaries described the event as the Commission presenting its impact analysis to MEPs. That is not quite right. The Commission’s impact assessment (staff working document SWD(2026) 502) was published alongside the proposal on June 3, 2026, as part of the European Technological Sovereignty Package, which also included a Chips Act 2.0 and an Open Source Strategy. What was presented on November 11 was Parliament’s response: a joint draft report from Spanish MEP Diego Solier, rapporteur for the industry committee (ITRE), and Van Lanschot, rapporteur for the internal market committee (IMCO).

According to Euronews’ report from the press conference, the draft calls for more investment in European cloud and AI infrastructure, common EU standards for cloud services, stronger protection for critical sectors such as healthcare, energy and transport, faster permitting for data centres, and more public purchasing from European providers. “Europe has brilliant businesses and they are not asking for subsidies, they are asking for customers,” Van Lanschot said. Solier framed it as a question of capacity rather than closure: sovereignty “consists of ensuring that Europe has the capacity to act, compete and choose.”

The newsletter version of Van Lanschot’s statistic also needs a small correction. The figure is not that three providers serve more than 70% of European organisations. The Commission’s impact assessment says the three US hyperscalers (AWS, Microsoft and Google) account for around 70% of the European cloud market, while the largest European providers each hold about 2%, and European providers’ combined share fell from 29% in 2017 to 15% in 2022.

What the proposal would require, and of whom

The proposal, COM(2026) 502 (procedure 2026/0138(COD)), is a regulation, so once adopted it would apply directly in every member state. Its draft final article sets the application date at one year after entry into force. The parts most relevant to privacy and vendor-risk teams sit in the sovereignty and procurement chapters.

• Four Union assurance levels. Cloud services could be recognised at level 1 through a provider self-assessment, or at levels 2 to 4 through a third-party audit. The audit criteria for the higher levels cover EU establishment, the location of infrastructure, assets and personnel, and keeping customer data, including metadata and telemetry, in the Union. Level 3 could also be reached by services controlled from a third country that the Commission recognises as offering sufficient assurances.
• Public-sector risk assessments. Member states and EU bodies would have to identify which public-sector activities in NIS2 sectors, and in areas such as justice, law enforcement, defence and border management, contribute to public order, and decide which assurance level each needs. Those assessments would repeat every two years.
• Procurement rules. Public bodies would need at least level 1 services, and only level 2, 3 or 4 services for activities flagged as public-order relevant. Tenders for innovative cloud and AI services would also carry non-price award criteria for “Union added value.”
• Private essential entities. Companies listed in Annex I of the NIS2 Directive “may” carry out similar assessments. The Commission could issue methodology guidance and, in duly justified cases, adopt delegated acts that make such assessments necessary for high-criticality sectors.

That last point is the one private-sector readers should watch. As proposed, the private-sector assessment is voluntary. With the rapporteurs pushing for common standards and stronger protection for critical sectors, the line between “may” and “must” could move before a final text.

Why sovereignty is also a data protection question

The impact assessment is candid about the legal exposure that drives the policy. It notes that dependence on US providers exposes EU user data to the US CLOUD Act in criminal proceedings and to Section 702 of the Foreign Intelligence Surveillance Act, and that access “can be granted unilaterally, without the involvement of EU judicial” authorities. The proposal states that it is consistent with the GDPR and the EU-US Data Privacy Framework, but adds that the framework “does not remove sovereignty concerns,” because sovereignty also covers operational autonomy, not only transfers.

For privacy teams this lines up with work many already do. A transfer impact assessment asks whether foreign law could reach personal data, and the ongoing debate about Section 702 and EU data transfers keeps that question alive. CADA adds a second axis: could foreign law, or a commercial decision, cut off a service you depend on? The debate over whether foreign governments can control your model access shows the risk is not theoretical. Data location alone does not answer it, which is why the proposal’s criteria reach into who controls the provider and the software stack. Teams familiar with data localization under the GDPR will recognise the pattern, though CADA goes further than residency.

National schemes already point the same way. France’s SecNumCloud qualification, for example, became newsworthy when a Google-backed cloud secured France’s top sovereignty certification, showing that ownership and operating structures can be designed to meet such tests. The proposal also expects higher assurance levels to rely on cybersecurity certification under the EUCS scheme, which ENISA has worked on for years and which the proposal notes has not yet been adopted. That links CADA to the EU’s wider push to strengthen cybersecurity certification for software and cloud services.

Rules that already apply: the Data Act’s switching provisions

CADA is still a proposal, but cloud customers are not waiting on a blank page. The Data Act, which has applied since September 12, 2025, already gives customers of data processing services contractual rights designed to make switching realistic. In broad terms, contracts must let customers switch or port their data after a notice period of no more than two months, with a transition period that normally runs no longer than 30 calendar days. Providers may only charge reduced, cost-based switching fees until January 12, 2027; after that date, switching charges are prohibited.

The proposal itself says the Data Act removes key sources of lock-in but “does not build the road” to a more sovereign European cloud sector. Put simply, the Data Act gives you the right to leave, and CADA is about having somewhere to go.

A five-step cloud exit and sovereignty review

These steps fit inside an existing vendor-risk or DPIA cycle.

1. Tier your workloads. List cloud-hosted systems and mark which would cause legal, safety or service harm if they were unavailable for a week. Public bodies will have to do this under CADA. Private NIS2 entities that do it now will be ready if guidance or delegated acts follow.
2. Map control, not just location. For each critical workload, record where data, backups, logs and telemetry sit, where administrators and support staff are located, and which legal entity ultimately controls the provider. Include each data subprocessor in the chain, because a European front end can sit on a non-EU platform.
3. Read your contracts against the Data Act. Check notice periods, the transition period, data export formats, egress fees and any charges that would still apply after January 12, 2027. Flag terms that conflict with the switching chapter for renegotiation.
4. Write and test an exit plan. A credible plan names a target environment, the data and configuration to be exported, who does the work and how long it takes. Financial entities already need exit strategies for ICT providers supporting critical functions under DORA; other sectors can borrow that discipline.
5. Fold sovereignty into transfer assessments. When you update transfer impact assessments, add a short section on continuity risk: could a foreign order, sanction or commercial decision suspend the service, and what is the fallback?

The legislative road ahead

According to Euronews, the draft report was due to be published on November 12 and discussed in committee on December 1, with a committee vote provisionally scheduled for mid-March 2027 and a plenary vote in April. The Council must also agree its own position before trilogue negotiations can begin. Several points look likely to be contested: how strict the sovereignty criteria should be, whether third-country-controlled services can reach higher levels, whether public procurement preferences extend further, and whether private-sector assessments stay voluntary.

The impact assessment estimates that EU-based providers could face personnel-related adjustment costs of roughly €233 million to €484 million to meet levels 2 to 4, and it models porting costs for public authorities that move systems to sovereign services. Those figures matter to buyers too, since some of that cost may show up in pricing.

Frequently asked questions

Does the Cloud and AI Development Act apply to private companies today?

No. It is a Commission proposal under negotiation. Even as proposed, the binding procurement rules target public bodies and EU institutions. Private entities in NIS2 Annex I sectors would be able to run similar assessments, and could be required to only if the Commission later adopts delegated acts for high-criticality sectors.

Would using a non-EU cloud provider become unlawful?

Not as a general rule. The proposal sets levels and procurement conditions for public-order workloads in the public sector. A non-EU-controlled service could still qualify for level 1, and for level 3 if its home country is recognised under the proposal’s mechanism.

How is a Union assurance level different from GDPR transfer compliance?

GDPR transfer rules ask whether personal data leaving the EU stays adequately protected. Assurance levels ask a broader question about establishment, control, staff, infrastructure and data location for the whole service, including non-personal data and service continuity.

What should procurement teams change first?

Start with the contract terms the Data Act already governs, especially notice periods, export formats and switching charges after January 12, 2027, and pair them with a tested exit plan for the most critical workloads.

Van Lanschot’s warning was aimed at governments, but the question behind it applies to any organisation that runs on rented infrastructure. Whatever the final text says about assurance levels, the organisations best placed for it will be those that already know which systems they could move, how long it would take, and who would have to say yes.