Contents6
On 3 June 2026, the European Commission presented the Cloud and AI Development Act, a proposal for a regulation that aims to at least triple the EU’s data centre capacity in five to seven years. As of 20 October 2026, the text is being examined article by article in the Council, and nothing has been adopted. Meanwhile, two French announcements in October are a reminder that the “sovereign” cloud question is already being settled in contracts.
This article in our Infrastructure and cloud section summarises the proposal from the Commission’s pages and the European Parliament’s procedure file. It is not legal advice: the text can still change significantly during negotiations.
In short
The Cloud and AI Development Act is a proposal for a regulation dated 3 June 2026: it has not been adopted and creates no obligation yet.
It aims to at least triple European data centre capacity in five to seven years, by speeding up permits.
It proposes a four-level sovereignty scale, from simply locating data in the EU to no outside dependency at all, starting with public procurement.
To choose a hosting provider today, the French reference remains the SecNumCloud qualification from ANSSI, the national cybersecurity agency, offer by offer.
What does the Cloud and AI Development Act propose?
The text, referenced COM(2026) 502, is part of the technological sovereignty package presented alongside a new version of the Chips Act. According to the Commission’s page on the act, it rests on three pillars: research and innovation in cloud and AI, data centre capacity, and EU autonomy. The orders of magnitude are as follows:
at least: the EU data centre capacity targeted within five to seven years
the horizon by which the needed capacity should be reached
of assurance to assess the sovereignty of a cloud offer
To get there, the proposal simplifies and harmonises data centre permits, with facilitated procedures in “acceleration zones”, and aims to ease access to energy, land, water and financing. It also creates a common cloud procurement framework for public administrations, so they can pool their purchasing power, and supports open source solutions.
The four proposed sovereignty levels
This is the part that will interest a cloud buyer most. The proposal defines four assurance levels, which public bodies would choose based on their own risk assessment. According to the Commission’s page:
- Level 1: data is processed and stored in infrastructure located in the EU.
- Level 2: the provider demonstrates independence from third countries and transparency over its software supply chain.
- Level 3: the provider is owned and controlled from the EU, with extra criteria such as the citizenship of its staff; the Commission can recognise third-country providers.
- Level 4: the provider has full transparency and control over its software supply chain, with no third-country interference.
Member States could recognise a provider at a given level, after an audit. The scale is aimed first at the public sector; nothing requires a private business to use it, but it provides a common vocabulary to put the question to a hosting provider.
Key takeaway
Level 1, keeping data in the EU, does not protect against another country’s extraterritorial laws if the provider is subject to them. That is the whole gap between a server in Europe and a European provider, which we detail in sovereign cloud: can you do without the American giants?.
Where do negotiations stand?
The text follows the ordinary legislative procedure: both the European Parliament and the Council must adopt it.
- 3 June 2026
The Commission presents the proposal and its impact assessment.
- 16 June 2026
First review in the Council’s telecommunications and information society working party.
- 8, 22 and 29 September 2026
Article-by-article review in the Council, from public procurement to each of the three pillars.
- 6 October 2026
The working party hears the Council Legal Service on the text.
The Council dates come from the provisional agendas published by the Council of the European Union; the procedure is referenced 2026/0138(COD) in the Parliament’s Legislative Observatory. Neither the Parliament nor the Council had adopted a position as of 20 October 2026, so no application date is set.
What October’s news is a reminder of
Two French announcements this month show that businesses are not waiting for the European text:
- The taxi company G7 made official on 8 October 2026 a partnership with S3NS, the joint venture controlled by Thales that relies on Google Cloud technology, to host part of its data on the PREMI3NS offer, qualified SecNumCloud 3.2 in December 2025, according to Le Monde Informatique. The rest of its data stays in its own data centres in France.
- A consortium led by Cloud Temple, with Thales, Bull, Vates and the CEA, received €20 million from the French State under France 2030, for a €47 million project that should deliver by the end of 2028 a French cloud and AI offer for sensitive data, according to Clubic.
The first choice is hybrid, the second is an offer still to come: sovereignty is being built today through contracts and architecture, not through a single label.
What still holds when choosing a hosting provider today
Until the text is adopted, three guidelines hold for a team of 20 to 500 people:
- Classify your data before choosing. Not all data needs the same level: sensitive or regulated data justifies a qualified offer, the rest can stay with a large provider. The method is in our cloud infrastructure foundation guide, and its equivalent for AI models in the four levels of private AI.
- Check the offer, not the provider. In France, the ANSSI SecNumCloud qualification applies to a specific offer: that is what you check in the agency’s catalogue, with its validity dates.
- Keep an exit door. The Data Act removes cloud switching charges on 12 January 2027, as noted in our digital regulation calendar; the migration work remains, as described in cloud migration without breaking everything.
If your data goes through AI tools, the AI Act obligations come on top, whatever the hosting provider: they are gathered in our AI Act and GDPR guide for small businesses.
From the field
We apply this scale to our own choices. Our Twenty CRM has been running since early 2025 (internal record as of 20 October 2026, on our own tools) on a server we administer ourselves, alongside our n8n automation and our audience measurement. This site, on the other hand, has been served since 18 October 2026 by a US provider, and contact requests are stored in a storage space whose jurisdiction is set to the European Union: that is level 1 of the scale, a deliberate location choice for low-sensitivity data, with a written rollback procedure.
Date to remember: none for now; the next step is the adoption of a position by the Council and then by the Parliament. To set up your own foundation, with classified data and an exit door, see our self-hosted stack offer.
Frequently asked questions
What is the Cloud and AI Development Act?
A proposal for a European regulation presented on 3 June 2026 by the Commission. It aims to at least triple EU data centre capacity in five to seven years, speed up their permits, and create a common cloud procurement framework for public administrations along with a four-level sovereignty scale.
Does the Cloud and AI Development Act already apply?
No. It is a proposal, under review in the Council since June 2026, which the European Parliament and the Council still have to adopt, each on its own and then together. No application date is set, and the content can change during negotiations, including the sovereignty scale and the capacity target.
Will the four sovereignty levels be imposed on private businesses?
The proposal intends them first for public bodies, which would choose a level based on their risk assessment. A private business would not have to comply with them, but the scale gives it clear criteria to question a hosting provider: location, independence, control and software supply chain.
Should you wait for this text before choosing a sovereign cloud?
No. In France, the ANSSI SecNumCloud qualification already serves as the reference for sensitive data, offer by offer. The future European text may add to it once adopted, but the classification of your data, the choice of offer and your exit door are decided today.
Sources
- The Commission’s page on the act (new tab)digital-strategy.ec.europa.eu
- Provisional agendas published by the Council of the European Union (new tab)data.consilium.europa.eu
- Parliament’s Legislative Observatory (new tab)oeil.europarl.europa.eu
- Le Monde Informatique (new tab)lemondeinformatique.fr
- Clubic (new tab)clubic.com
Provisional agendas published by the Council of the European Union
Read on data.consilium.europa.eu(new tab)Jim · founder of Brain Plus AI
Also in infrastructure and cloud
Stepping back11 min
Sovereign cloud: can you do without the American giants?
European providers now hold only 15% of their own cloud market. Full sovereignty is out of reach; selective sovereignty starts with sorting your data and planning an exit.
Practical guide13 min The topic guide
Cloud infrastructure: the foundation for all your projects
Before the first project, a cloud infrastructure foundation settles accounts, access, backups and budget once and for all, and every later project inherits it. What it contains, where to put it, what it costs and why running it matters more than installing it.
Understand9 min
AI Act and digital rules calendar: deadlines 2026 to 2028
AI Act, Data Act, Cyber Resilience Act, NIS2, e-invoicing in France and the first US state laws: every date that matters for a business, from autumn 2026 to August 2028, on one page kept up to date. For each deadline, who is covered and what to prepare.