Executive summary
– Europe needs to reduce its technological dependencies and strengthen its own offering of sovereign cloud and AI services, while maintaining cooperation with trusted technology partners.
– The proposed Cloud and AI Development Act (CADA) seeks to boost the supply and public procurement of European sovereign cloud and AI services, with four assurance levels reflecting the sensitivity of the services, and to facilitate the deployment of the necessary infrastructure.
– Telefónica supports CADA’s objectives. Its Policy Brief sets out five priorities to translate that ambition into investment and tangible capabilities: ensure verifiable European control, explicitly include edge computing as a distributed computing model that complements cloud computing, recognise existing certifications, narrowly define public procurement exemptions, and ensure that any extension to the private sector is justified and proportionate.
– Europe needs greater digital capacity and more European alternatives.
Europe remains heavily dependent on non-European providers for cloud infrastructure. According to Synergy Research Group, in 2024 European providers accounted for around 15% of the European market, compared with close to 70% held by three major US providers.
This dependence, combined with the rapid technological and digital advances of recent years, particularly in AI, requires Europe to strengthen its computing capabilities and develop its own offering of competitive, secure and resilient cloud services that can meet the emerging needs of businesses and public administrations. Beyond expanding infrastructure, the challenge is to ensure that European industry can operate, maintain and develop these services autonomously and with effective control, offering high-quality alternatives and reducing critical technological dependencies.
Against this backdrop, the European proposal for CADA seeks to reduce Europe’s technological dependencies and foster a trusted European offering for public administrations.
To this end, CADA proposes stimulating demand for European sovereign cloud and AI services through public procurement, based on four sovereignty assurance levels with increasingly stringent requirements reflecting the sensitivity of the services. At the same time, it seeks to accelerate the deployment of the infrastructure needed to deliver them.
In this context, Telefónica is publishing its Policy Brief “Cloud and AI Development Act (CADA): from regulatory ambition to European industrial capacity”, which sets out how to translate the Regulation’s objectives into investment, competitive services and greater freedom of choice.
Five priorities to make CADA work?
To ensure that CADA tangibly strengthens European cloud and AI capabilities, Telefónica proposes five priorities that combine industrial development, effective control and legal certainty.
1. Effective and verifiable sovereignty levels
The sovereignty of a service depends on who can operate it, protect it and ensure its continuity. Data location and the provider’s place of establishment are relevant factors, but are insufficient to demonstrate sovereignty.
CADA’s assurance levels must therefore verify who controls access, encryption keys, updates and the service’s essential components.
An approach centred on effective control allows continued cooperation with trusted international technology partners, provided that European control is effective and verifiable.
2. Edge cloud: turning Europe’s extensive network footprint into a competitive advantage
Edge cloud, or distributed computing close to the user, complements large data centres. It enables information to be processed close to where it is generated, such as factories, hospitals or ports, reducing response times, known as latency, strengthening resilience and significantly improving quality of service.
Telecommunications operators contribute geographically distributed sites, connectivity, security and operational expertise. CADA should therefore explicitly include this infrastructure in its measures on permitting, financing, certification and access to the electricity grid.
European cooperation already offers examples. Telefónica participates in the pan-European federated Edge Continuum, which interconnects different operators’ capabilities and facilitates the deployment of applications across their infrastructure.
3. Recognising existing certifications to accelerate implementation
Recognising stringent national certifications would accelerate CADA’s implementation and avoid duplicate audits. Any additional assessment should focus on sovereignty safeguards not yet covered by those certifications.
In Spain, certification under the National Security Framework at the HIGH category (ENS Alto) already attests to compliance with numerous technical and organisational controls also required by CADA. Telefónica therefore proposes establishing an official mapping between ENS Alto and CADA level 3, so that only the remaining gaps need to be assessed.
This approach should extend to comparable schemes in other Member States, reducing unnecessary costs without lowering the requirements.
4. Public procurement in support of industrial policy and sovereignty
Public administrations can help drive the development of Europe’s technology offering by generating sustained and predictable demand for secure, innovative and resilient cloud and AI services.
Award criteria must take into account service continuity, operational control and contributions to European value chains. Public procurement must also offer genuine opportunities to specialist providers, with requirements proportionate to the criticality of each service.
Furthermore, exemptions from CADA’s application to public procurement must be based on objective, transparent and narrowly defined criteria. Widespread use of exemptions would undermine the substance of sovereignty safeguards and could favour providers that already dominate the market.
5. Limiting any extension of CADA’s scope to the private sector to exceptional and justified cases
CADA empowers the European Commission to extend obligations to procure sovereign cloud and AI services to critical private entities covered by the NIS2 Directive. However, any extension of CADA obligations to the private sector must be limited to third-party cloud or AI services that pose material and demonstrated sovereignty risks which existing rules cannot address, following an objective, transparent and duly justified process.
Merely falling within the scope of the EU’s NIS2 cybersecurity Directive should not automatically trigger new sovereignty requirements. Any intervention must be preceded by an impact assessment and consultation, and include realistic transition periods.
Turning Europe’s strengths into competitive services
Europe has networks, data centres and distributed capabilities on which to build a broader digital offering. Connect Europe’s State of Digital Communications 2026 report documents this evolution among European cloud, edge and AI operators.
Building on this foundation requires mobilising private investment, enabling European providers to scale up and generating demand. The Policy Brief’s proposals apply Telefónica’s vision of technological sovereignty to cloud and AI: strengthening Europe’s own capabilities, ensuring genuine alternatives and cooperating with trusted partners, while preserving freedom of choice and effective control over critical services.
Conclusion: from ambition to capacity
Europe needs to turn its technological ambition into tangible capacity. Telefónica supports CADA’s objectives and the broad direction of the proposal, but achieving them requires clarifying and adjusting certain elements so that the regulation can effectively drive investment, innovation and technological autonomy.
Ultimately, CADA’s success should be measured by its results: investment mobilised, capabilities deployed, actual uptake of services by public administrations and reductions in critical dependencies. The challenge is to ensure that Europe has the capabilities to exercise the greater technological sovereignty it seeks.
We invite readers to consult the full Policy Brief and contribute to the debate on a European framework that enables investment, innovation and competition.
