Europe’s Cloud Sovereignty Fight Gets a Hearing: What the EPP’s CADA and Chips Act Session Means for Data

The European People’s Party group in the European Parliament will hold a hearing in Brussels on November 18, 2026, on two files that will shape where Europe’s data is stored and processed for the next decade: the Cloud and AI Development Act (CADA) and the Chips Act 2.0. The EPP Group’s announcement frames the session around technological sovereignty and competitiveness in semiconductors, cloud computing and AI.

A party-group hearing is not a vote, and it will not change the text of either proposal on the day. But the EPP is the largest group in Parliament, its MEPs hold key rapporteur and shadow rapporteur roles on both files, and the speaker list shows which companies are trying to shape the result. For privacy and procurement teams, CADA is the file to watch, because its sovereignty rules will decide which cloud providers public bodies can use for which data.

Who is speaking

MEP Oliver Schenk, the EPP’s rapporteur on the Chips Act 2.0 in the industry committee (ITRE), opens the hearing and is listed again with the first panel. MEP Pilar del Castillo, the EPP’s ITRE shadow rapporteur on CADA, is listed with the second. MEP Andreas Schwab, EPP shadow rapporteur on CADA in the internal market committee (IMCO), gives the closing remarks.

• Panel I, Chips Act 2.0: representatives of ASML, imec, Silicon Saxony and STMicroelectronics, on turning Europe’s semiconductor strengths into investment, scale and resilience.
• Panel II, CADA: representatives of SAP, Mistral AI, Microsoft and Iberdrola, on scaling up European cloud and AI infrastructure.

The second panel is the interesting one. A European cloud provider, a European AI model developer, a US hyperscaler and an energy company will share a stage on a law that partly decides how much of the public sector market each of them can serve. Registration for the hearing closes on November 13.

What CADA would do

The European Commission proposed CADA in 2026 as part of its plan to strengthen Europe’s cloud and AI base. According to the Commission’s CADA page, the proposal aims to make it faster to deploy data centres, support next-generation cloud and AI technologies, and push adoption of cloud and AI in strategic sectors through national strategies. The headline measures include:

• Faster permitting and deployment for sustainable cloud and data centre infrastructure, with measures to monitor computing capacity gaps.
• Support for frontier, industrial and physical AI, with “grand challenges” to direct research.
• National cloud and AI strategies in each member state, and Experience and Acceleration Centres for AI.
• A single EU-wide framework to assess cloud and AI sovereignty, with four assurance levels for public sector bodies to use based on their risk assessments.
• A common EU-level procurement framework for public administrations.

The Commission says most of the market will remain open to partners outside the EU. The sovereignty levels are the exception. At the higher levels, providers must show independence from third countries and transparency over their software supply chain, or be owned and controlled from the EU and meet additional criteria such as personnel requirements. Member states would recognize providers after an audit.

Why sovereignty levels are a data protection issue

Sovereignty in this debate is mostly about control: who can be compelled to hand over data, who can switch a service off, and whose law applies to the operator. Those are the same questions privacy teams ask in a transfer impact assessment. A provider that is owned and operated in the EU, with no third-country access, removes several of the risks that make transfers to the US and elsewhere complex under the GDPR.

CADA would turn that analysis into a formal label. Public bodies would choose a sovereignty level for each workload based on risk, and procure accordingly. Private companies would not be bound by those levels, but many will adopt them as a benchmark, much as Germany’s BSI criteria have been used, which we covered in our report on the BSI C3A cloud sovereignty criteria. Our earlier look at CADA and business strategy and our guide to the EU cloud sovereignty framework go further into the commercial effects.

Where Chips Act 2.0 fits

The Chips Act 2.0 is the hardware half of the same strategy. The first Chips Act, adopted in 2023, aimed to raise Europe’s share of global semiconductor production. The revision focuses on investment, scale and resilience in the supply chain. It matters to privacy professionals indirectly: trusted execution environments, secure enclaves and confidential computing all depend on chips, and a supply chain that Europe controls is one where hardware security claims are easier to verify.

How CADA interacts with other EU rules

CADA will not replace existing law. Cloud contracts in the EU already have to work with the GDPR, the Data Act’s switching and interoperability rules, the AI Act, NIS2 and, for financial firms, DORA. The Commission’s separate digital omnibus proposals would change parts of the GDPR and the AI Act, as we explained in our piece on the digital omnibus. Companies dealing with several of these at once may find our guide to cross-regulatory compliance in the EU and our note on the Data Act legal helpdesk useful.

Five things to watch at and after the hearing

1. Whether the sovereignty levels survive intact. US providers will argue for recognition routes; European providers will argue for strict ownership tests.
2. Who can recognize third-country providers. The Commission’s text allows it in some cases. Parliament may tighten or loosen that.
3. How procurement rules apply. A common EU procurement framework could make sovereignty levels a de facto market standard.
4. Energy and permitting. Iberdrola’s presence is a reminder that data centres are an energy policy question as much as a digital one.
5. Links to data protection. Watch for amendments that tie sovereignty levels to GDPR transfer analysis or to sensitive data categories.

What organizations can do now

Most companies do not need to act on CADA until its text is settled. But it is worth knowing, for each major cloud workload, who the provider is, where data is stored, which third countries could compel access, and what your exit plan is. That inventory supports GDPR transfer assessments today and will make it easier to map workloads to sovereignty levels later. Captain Compliance helps teams keep that kind of record of systems and data flows; it does not certify any provider’s sovereignty status.

Frequently asked questions

Is CADA law?

No. It is a Commission proposal going through the European Parliament and the Council. The EPP hearing contributes to Parliament’s work on it.

Will CADA ban non-EU cloud providers?

No. The Commission says most of the market will stay open. The stricter sovereignty levels would apply to public sector workloads chosen on a risk basis.

Can anyone attend the hearing?

The EPP Group invites registration by November 13. The hearing is in the European Parliament in Brussels.

Does CADA affect private companies?

Directly, mainly cloud and data centre providers. Indirectly, its sovereignty levels are likely to influence private procurement and contract terms.

The EPP has put a chipmaker, a hyperscaler, a European model builder and a utility in one room to talk about sovereignty. They will not agree on what it means. The version of the word that ends up in CADA will decide which of them gets the public sector’s most sensitive data, and on what terms.