EU Cloud and AI Development Act: How Europe’s Sovereign Cloud Rules Redraw Global Procurement

The EU’s €180 Million Preview: What the Sovereign Cloud Tender Revealed

Before CADA becomes law, the European Commission has already applied the SEAL framework voluntarily. In April 2026, the Commission awarded a €180 million sovereign cloud tender that required providers to meet SEAL-2 or above. Four consortia won contracts; three achieved SEAL-3. The winning providers included European-majority companies and one notable exception: S3NS, a Thales-majority joint venture that operates Google infrastructure under strict sovereignty contractual arrangements.

The S3NS case is the framework’s most important data point for non-EU cloud operators. Google’s underlying infrastructure remains technically subject to US extraterritorial law — specifically the CLOUD Act, which allows US government agencies to compel Google to produce data stored anywhere in the world, including in EU data centers. Yet S3NS qualified at an acceptable SEAL level through a combination of EU-majority corporate structure, EU-based key management, and operational independence clauses that create legal separation from Google’s US parent operations.

Critics, as CNBC’s analysis of the EU Commission’s cloud sovereignty discussions noted, argue that Google “remains subject to the US CLOUD Act regardless of operational separation arrangements” — making the sovereignty claim structurally incomplete. The Commission’s decision to award the contract anyway signals that SEAL compliance is assessed on the overall profile across eight weighted objectives, not a binary pass/fail on any single criterion.

The SEAL Framework: Five Levels and Eight Objectives

The SEAL framework documentation published by innobu.com establishes the complete architecture that CADA will convert to binding law. The five SEAL levels are:

SEAL-0: No sovereignty claim; complete dependence on non-EU technology, personnel, and governance. Standard commercial cloud from US hyperscalers without modification. Ineligible for EU public contracts under CADA.

SEAL-1: EU jurisdiction applied contractually (data processing agreements, GDPR compliance), but external technical control over infrastructure, key management, and software remains with the non-EU provider. Insufficient for public-sector procurement — the contractual layer does not protect against the CLOUD Act or equivalent non-EU legal access.

SEAL-2: Data under EU control with key management in European hands. Operating entity must maintain services independently of non-EU instructions. The minimum threshold for EU public-sector procurement. Three of four April 2026 tender winners achieved SEAL-3 or above, suggesting market competition is already above the minimum.

SEAL-3: Immunity to supply chain disruption from non-EU sources. EU personnel can independently maintain, update, and recover services without non-EU assistance. This is the de facto competitive threshold for EU public-sector contracts, given that most active bidders have positioned at this level.

SEAL-4: Complete EU supply chain from semiconductors to software, with no permitted third-country dependencies. Currently achieved only by providers that have vertically integrated EU hardware and software stacks — a category that excludes most commercial cloud operators globally.

The eight Sovereignty Objectives (SOV-1 through SOV-8) are weighted across: Supply Chain (SOV-5, 20%), Strategic Ownership (SOV-1, 15%), Operational Independence (SOV-4, 15%), Technology Standards (SOV-6, 15%), Jurisdictional Protection (SOV-2, 10%), Data and AI Sovereignty (SOV-3, 10%), Security Compliance (SOV-7, 10%), and Environmental Standards (SOV-8, 5%).

Three Signals Hidden in the CADA Architecture

Signal 1: Supply Chain Is the Structural Barrier Non-EU Operators Cannot Paper Over

SOV-5 (Supply Chain) carries the highest weight at 20% precisely because it is the hardest objective for non-EU providers to satisfy through contractual arrangements alone. A provider whose servers run Intel or AMD chips (US companies), whose hypervisor is VMware (now Broadcom, US), and whose orchestration layer is Kubernetes (Google-originated) cannot credibly claim SEAL-3 supply chain sovereignty regardless of where those components are deployed or who operates them.

The Commission’s April 2026 tender outcome — where three of four winners achieved SEAL-3 — suggests that EU-majority providers have invested in supply chain displacement strategies over the past three years in anticipation of CADA. US hyperscalers running joint ventures (the S3NS model) can reach SEAL-2 through compensating strength in operational independence and strategic ownership, but cannot reach SEAL-3 without genuinely displacing US-origin stack components.

Signal 2: The Jurisdictional Objective Is the CLOUD Act Test

SOV-2 (Legal and Jurisdictional Protection) explicitly evaluates exposure to extraterritorial laws including the US CLOUD Act and FISA Section 702. A cloud provider whose corporate structure or software dependencies leave it subject to these laws scores poorly on SOV-2. The S3NS case demonstrated that SOV-2 weakness can be partially offset by SOV-4 (operational independence) and SOV-1 (EU strategic ownership through Thales majority control). But at SEAL-3, even partial SOV-2 weakness becomes harder to compensate.

For non-EU cloud operators evaluating their CADA exposure, the SOV-2 question is the first filter: is any element of the operating entity — corporate parent, software licensor, hardware supplier, support personnel — subject to a non-EU government’s data access authority? If yes, SEAL-3 is structurally difficult without genuine component replacement.

Signal 3: Private Sector Remains Unrestricted — For Now

CADA’s mandatory SEAL requirements apply to EU public procurement and regulated industries (finance, health, energy) for sensitive data processing. The private-sector B2B cloud market — enterprises using cloud for non-sensitive workloads — remains outside CADA’s mandatory scope. The European Parliament Think Tank briefing on CADA779251) confirms that the legislation’s primary mechanism is procurement eligibility, not a general market restriction.

This distinction matters for global cloud operators’ go-to-market strategy. Private-sector EU clients — manufacturers, retailers, media companies, professional services firms — using cloud for standard business workloads face no SEAL eligibility requirement. The restriction applies to: EU government entities at national, regional, and local level; EU institutions themselves; and private entities in regulated sectors handling sensitive data (banking, insurance, healthcare, energy utilities). Non-EU providers that have not invested in SEAL compliance can continue serving non-regulated EU private-sector clients without disruption.

What Cloud Operators Should Do Before CADA Takes Effect

1. Profile Your Current SEAL Position Against All Eight SOV Objectives

The SEAL framework’s eight Sovereignty Objectives have different weights and different tractability for non-EU operators. Before CADA becomes binding law, every cloud operator with EU public-sector revenue exposure should model their current SOV profile honestly: where do you score on Supply Chain (SOV-5, 20% weight), Operational Independence (SOV-4, 15%), and Jurisdictional Protection (SOV-2, 10%)? The SEAL framework documentation at innobu.com provides the full scoring rubric. Operators that have not conducted this exercise will face procurement disqualification without knowing why. The April 2026 tender outcome — where all four winners had proactively positioned at SEAL-2 or above — demonstrates that waiting for CADA’s formal publication to begin SEAL assessment is too late for the next competitive procurement cycle.

2. Decide Whether to Pursue SEAL-2 via the Joint Venture Route or Concentrate on Private-Sector EU Clients

CADA’s mandatory SEAL requirements apply to public procurement and regulated industries — not to private-sector B2B cloud. Operators that cannot cost-effectively reach SEAL-2 have a clear strategic alternative: concentrate EU business development on non-regulated private-sector clients where no SEAL eligibility requirement exists. This is not a compliance failure; it is a deliberate market segmentation decision. Operators that do attempt SEAL-2 via the joint venture route — following the S3NS model of EU-majority corporate ownership plus EU-anchored key management — should be realistic about what SEAL-2 achieves: access to most public procurement, but not the defense and critical infrastructure sectors that require SEAL-3. Model the capital cost of the joint venture structure against the revenue opportunity in SEAL-3-required sectors before committing.

3. Engage in the CADA Legislative Process Before Implementing Regulations Are Drafted

The May 27 Commission proposal launches a 12–18 month legislative process. Implementing regulations — the technical specifications that translate SEAL levels into auditable compliance requirements — will be drafted during or after that process, and are the documents that will determine whether the S3NS model remains viable at SEAL-2, whether third-country operators can qualify via adequacy mechanisms, and how SOV-5 supply chain independence is technically assessed. The European Parliament Think Tank briefing on CADA confirms that industry engagement during the legislative process shapes implementing regulation design. Non-EU cloud operators and their trade associations should engage EU policymakers now — before the text is finalized — to influence third-country adequacy provisions and SEAL assessment methodology.

The Correction Scenario: What CADA Gets Wrong and What Happens Next

The EU’s historical record with market-creating digital regulation suggests two failure modes that CADA must navigate. First, the supply chain sovereignty objective is aspirational rather than achievable at scale: European alternatives to US cloud infrastructure exist but have not demonstrated the reliability, feature depth, or price performance of AWS, Azure, or Google Cloud at comparable scale. If SEAL-4 becomes the dominant public-sector procurement standard, EU agencies may face capability constraints that undermine the policy’s stated goals.

Second, the S3NS precedent creates a compliance arbitrage market: non-EU providers that invest in majority-EU joint ventures can access public-sector contracts without genuine supply chain displacement. If this becomes the dominant compliance pathway, CADA achieves the form of sovereignty (EU majority ownership, EU key management) without the substance (supply chain independence from US-origin components). The Commission’s willingness to award the April 2026 tender to S3NS suggests this is an accepted outcome rather than a compliance failure — but it undermines the framework’s strategic rationale.

The most likely correction scenario is a graduated implementation: SEAL-2 as the minimum for most public procurement, SEAL-3 mandatory only for defense, law enforcement, and critical infrastructure sectors, and SEAL-4 reserved for classified government workloads. This would create a tiered market that balances sovereignty ambitions against operational reality.

Frequently Asked Questions

Sources & Further Reading

• Cloud and AI Development Act — European Parliament Legislative Train
• EU SEAL Framework 2026: How Sovereign Are Europe’s Sovereign Clouds — Innobu
• EU Commission Awards €180 Million Sovereign Cloud Tender — European Commission
• EU Weighs Restricting US Cloud Platforms for Sensitive Government Data — CNBC
• Cloud and AI Development Act — European Parliament Think Tank Briefing 779251)
• EU Cloud and AI Development Act — Compliance Tracker