EU Cloud and AI Act to be published in Official Journal on July 15
What it really says
The EU's Cloud and AI Development Act (CADA) will be published in the Official Journal of the European Union on July 15, 2026, and will formally enter into force on August 4, 2026. Adopted by the European Commission on June 3, 2026 as part of the Tech Sovereignty Package, it is the EU's most ambitious effort to reduce dependence on non-European cloud infrastructure for AI development. The centerpiece is a four-tier cloud sovereignty framework that classifies cloud providers based on security, ownership structure, operational control, and personnel requirements. Tier 1 covers basic requirements for all public sector cloud providers, Tier 2 requires independence from third countries and supply chain transparency, Tier 3 requires EU ownership and control, and Tier 4 demands full transparency with no third-country interference. Public authorities must consider 'Union added value' as a non-price criterion when procuring cloud and AI services. Member states must designate at least one data center 'acceleration zone' within six months, where permit procedures are capped at twelve months. The first tier of cloud sovereignty requirements applies from February 2028, with the highest tier becoming mandatory by August 2029.
Our assessment
The EU is creating its first binding framework against over-dependence on US cloud providers for AI infrastructure. Rather than banning foreign providers, CADA uses graduated requirements: Amazon, Google, and Microsoft can continue to serve EU clients but must offer greater transparency and local control at higher sovereignty tiers. The data center acceleration zones could address Europe's chronic compute capacity deficit. For businesses, there is no immediate disruption as the first obligations only apply from February 2028. This law is a structural response to real dependencies, not a reason for concern.
Relevance for Germany
Germany is particularly affected because federal and state administrations rely heavily on US cloud services. The Delos Cloud (based on Microsoft Azure) and the federal cloud strategy must now be aligned with the four-tier sovereignty framework. For German cloud providers like IONOS, Open Telekom Cloud, and SAP, the law represents an opportunity since they naturally meet higher sovereignty tiers more easily than US hyperscalers. The data center acceleration zones are especially relevant for Germany, where permitting processes currently often take two to three years. At the same time, Germany must designate at least one such zone within six months of the law taking effect, requiring swift action.
Fact check
The publication in the EU Official Journal on July 15, 2026 and entry into force on August 4, 2026 are confirmed by Regulations.AI and the official EU Commission page. The adoption on June 3, 2026 as part of the Tech Sovereignty Package is documented by the European Commission. The four-tier cloud sovereignty framework, acceleration zones with 12-month permit cap, and timeline (Tier 1 from February 2028, Tier 4 from August 2029) are consistently described by Inside Global Tech, Lawfare, and the HLC legal analysis. The provision on considering 'Union added value' in public procurement comes directly from the legislative text according to the EU Commission.
Source
- • https://digital-strategy.ec.europa.eu/en/policies/cloud-and-ai-development-act
- • https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
- • https://regulations.ai/news/eu-cloud-ai-act-prepare-july-2026-publication
- • https://www.insideglobaltech.com/2026/06/11/the-eu-cloud-and-ai-development-act-in-depth/