The starting point for CADA is a structural gap that the Draghi report on European competitiveness identified clearly: Europe's digital infrastructure is not keeping pace with its digital ambitions. The deployment of AI — across industry, public services, research, and SMEs — depends on access to cloud computing and data centre capacity at scale. That capacity is currently dominated by a small number of non-European hyperscalers, and Europe's ability to build its own at comparable speed is constrained by long permitting timelines, fragmented access to energy and land, and a lack of coordinated investment signals.

The CADA's capacity objective is the most concrete: at least tripling EU data centre capacity within five to seven years. Achieving that target will require more than political commitment. It will require Member States to streamline national permitting regimes, improve grid connection timelines, and resolve the competition for land and water that large data centre facilities generate. The proposal introduces provisions to simplify and accelerate permitting and deployment, but the detail of how those provisions interact with national planning law, environmental assessment requirements, and energy infrastructure planning will determine whether the target is achievable within the stated timeframe.

The sovereignty framework is conceptually the most novel element. CADA introduces four assurance levels for cloud and AI sovereignty, to be applied by public sector bodies based on their own risk assessments. Level 1 requires only that data is processed and stored within the EU. Level 4 requires full transparency and control over the software supply chain, with no interference from a third country. Levels 2 and 3 address provider independence, ownership, and supply chain transparency in graduated steps.

This tiered approach reflects a genuine policy tension that the European Data Act and the NIS2 Directive have not fully resolved: how to give public administrations and critical sector operators a usable framework for managing dependencies on non-EU providers, without either closing the EU market or leaving procurement decisions entirely to individual organisations. The four-level model is a workable design in principle. Its value will depend on whether the audit and recognition mechanisms are rigorous enough to be credible and consistent enough across Member States to function as a genuine single framework rather than 27 parallel ones.

The research and innovation strand — supporting next-generation cloud and AI technologies through 'grand challenges' and national cloud and AI strategies — is less immediately operational but strategically important. The Apply AI strategy and the Experience and Acceleration Centres for AI that CADA builds on are designed to close the adoption gap between frontier AI capability and actual deployment in industry and the public sector. For sectors where AI adoption has been slower — construction, textiles, logistics, food processing — these mechanisms matter as much as the headline infrastructure targets.

Two implementation risks are worth naming directly. The first is energy. Tripling data centre capacity in five to seven years implies a very significant increase in electricity demand at a time when EU grids are already under pressure from electrification in transport, buildings, and industry. The CADA's provisions on improving access to energy for data centre deployment will need to be read alongside the Energy Union governance framework and the grid investment commitments Member States have made in their National Energy and Climate Plans — commitments that, as the Commission's own 2024 evaluation noted, are not uniformly on track.

The second risk is fragmentation. The sovereignty framework and the permitting simplification measures both require meaningful coordination across Member States to deliver their stated objectives. The EU Open Source Strategy, published alongside CADA as part of the Tech Sovereignty package, reinforces the same direction of travel. But coherence across this cluster of initiatives — CADA, Chips Act 2.0, Apply AI, Open Source Strategy — will require active management as each moves through its own legislative and implementation process. Europe has the architecture. The test, as with much EU digital policy, is in the execution.