On June 3, 2026 the European Commission presented the Tech Sovereignty Package: semiconductors, cloud, open source, energy digitalization, artificial intelligence. The piece that concerns infrastructure is the Cloud and AI Development Act, CADA.
Back in January, on this blog, we wrote that 2026 would be the year of European digital sovereignty. We did not expect the document giving it an operational definition to arrive this quickly.
1. The numbers behind the problem
CADA starts from two stated vulnerabilities.
The first is capacity: Europe does not have enough data centers for the workloads it is generating. The second is concentration: around 70% of the European cloud market sits with three American operators — Amazon Web Services, Microsoft Azure and Google Cloud — while European providers stand at roughly 15%, down from 29% in 2017.
That 29% turning into 15% over eight years is the dossier's most politically explosive number. It does not describe a market Europe has yet to enter: it describes a market Europe was progressively pushed out of while it grew.
2. The goal: tripling
CADA's declared objective is to at least triple European data center capacity over the next five to seven years. Four levers are announced, and anyone who followed the Italian debate of 2026 will recognize them:
- simplification of permitting procedures
- access to energy
- access to land and water
- access to financing
That is exactly the list of problems DL 21/2026 and Law 49/2026 began addressing in Italy six weeks before Brussels published the package. On this, for once, Italy finds itself ahead of the European calendar: the ten-month single procedure already exists and is operational.
3. The autonomy pillar: sovereignty becomes measurable
The most innovative part is not the capacity target: it is how CADA tries to make verifiable a word that until now has been pure marketing.
The pillar dedicated to autonomy introduces a sovereignty framework structured across four levels of increasing strictness:
| Level | Prevailing requirement |
|---|---|
| 1 | Data processing inside the EU |
| 2-4 | Progressively stricter requirements on third-country control, European ownership, supply-chain transparency, personnel vetting |
The conceptual jump is this: as long as "sovereign" meant "the data sits in a European data center", any hyperscaler could declare itself sovereign by opening a region in Milan or Frankfurt. The moment the criterion includes ownership, control and the supply chain, the declaration becomes a classification — and a classification can go into a contract, a tender, a procurement requirement.
This is where the political fight of the next eighteen months will happen, and it is worth saying without naivety: large non-EU operators have already launched "sovereign" offerings that satisfy level 1, and they will try to stop the ladder as low as possible.
4. What it formally is, and what it is not yet
Procedural honesty, because there is confusion on this point: CADA is a legislative proposal. It has to go through the ordinary process — European Parliament and Council, negotiation, trilogue — and the text that emerges will not be identical to June's. Anyone offering you a "CADA level 3 compliant" certification today is selling something that does not exist.
What does already exist, and counts immediately, is the direction. Three rulebooks are moving in unison: the AI Act on system conformity, NIS2 on supply-chain security, CADA on capacity and sovereignty levels. An IT lead who in 2027 has to answer to all three will ask suppliers questions nobody asked in 2024.
5. What it means for Italy, and for the South
Tripling European capacity in seven years means Europe needs sites. Not announcements: land, connectable power, manageable water, and communities willing to host.
Against that list the European map gets redrawn, and not in favour of the historic hubs. Frankfurt, Amsterdam, London, Paris and Dublin — the five markets that defined the first European cloud cycle — share the same profile: dense grids, expensive land, moratoria or constraints already in force. New capacity will go where there is headroom, and the headroom is in the South and the East.
For Southern Italy the combination is unusually favourable: surplus renewable energy, availability of disused industrial areas, a national permitting procedure already reformed, a three-year SEZ tax credit, subsea cables landing a few dozen kilometres away. Those are CADA's four criteria, plus connectivity, in a single place.
The Apulia Tech Hub project was born on this thesis two years before it became a European draft regulation. We are pleased to read it in Commission documents, but the credit is not ours: it was written in the geography.
6. Three things to do now
- Map where the data is and who controls it — not where it is hosted, but who holds corporate and effective control of the operator
- Ask your supplier which level they would fall under today, knowing the answer is preliminary: what matters is whether they can answer at all
- Write the levels into contracts up for renewal, as a future-adjustment clause rather than an immediate requirement
For eight years "digital sovereignty" was a conference word. Since June it has been a four-rung ladder with infrastructure ownership built into it. Who stands on which rung is about to become the most important commercial question in the sector.
Note: CADA is a legislative proposal under examination. The contents and levels described in this article may change during the process.