EU cloud and AI regulatory proposal draws criticism

Proposal would build European digital sovereignty around public procurement

The European Union has set a political goal of using public procurement to reduce dependence on a handful of non-EU cloud providers and open the market to a wider range of suppliers. The European Commission presents its proposed Cloud and AI Development Act, or CADA, as a way to reduce excessive reliance on certain providers.

In a report published on November 3, Open Future researchers Zuzanna Warso and Kristina Irion, associate professors at the University of Amsterdam's Institute for Information Law, examined Title IV of the proposal. This section covers autonomy, the sovereignty framework for cloud services, the four EU assurance levels, risk assessment and public-sector cloud procurement.

The authors say that in its current form, CADA is more likely to preserve the status quo than help expand open-source and interoperable European digital infrastructure.

Assurance levels leave several restrictions in place

According to the report, the proposal treats dependence on third-country cloud providers as a sovereignty issue, but mainly seeks to address it through information-security risk regulation. Because of the legal threshold of contributing to the “preservation of public order”, around 70 percent of public-sector activities, those covered by EU assurance level 1, could be excluded from assessment under the risk criteria set out in Article 29(2).

Open Future says that instead of establishing a minimum requirement, the framework could create an upper limit for sovereignty expectations. At assurance level 2, “sovereign cloud” solutions involving US hyperscalers could still be permitted.

Assurance level 3 generally excludes third-country control, but an exception for so-called associated third countries leaves open the possibility that the Commission could recognise such a country after the legislation is adopted.

Data, hardware and oversight

The report also identifies as a problem the fact that Annex II of the proposal restricts third-country entities from using data generated by a service to train AI systems. However, the text does not clearly extend the restriction to all customer data, nor does it explicitly prohibit providers from using customer data within the European Union for their own AI training purposes.

When examining technological dependencies, CADA focuses on software but explicitly excludes hardware from the sovereignty assessment. The authors say this is problematic because software and hardware dependencies are closely interconnected.

The EU-wide consistency mechanism would be placed under the Commission rather than a body made up of independent national regulatory authorities. According to the report, this raises questions about the institutional independence of oversight, the concentration of powers in the Commission and its exposure to geopolitical pressure.

What would Open Future change?

Among other things, the report recommends removing the contribution to the “preservation of public order” as the threshold for higher sovereignty levels, or at least defining it more broadly. The authors would allow higher assurance levels beyond public-order activities.

Open Future would make the designation of associated third countries subject to public consultation and would require the Commission to publish its assessment of whether each cumulative condition has been met. Its proposals also include banning the use of customer data processed, stored or generated through an audited service to train or fine-tune AI systems, unless the public-sector organisation has given its explicit consent.

The authors would extend the assessment of technological dependencies to hardware components and supply chains. They would place EU coordination in the hands of a body made up of independent national competent authorities, make a multi-provider or multicloud strategy the default, and turn the promotion of open source into an “open source first” rule. According to the report, these changes would allow public institutions not only to manage but also reduce their dependence on a handful of non-EU providers.