Digital sovereignty: Europe needs high fences for small fields and low or no fences for everything else on the Cloud and AI Development Act

Brussels, 22 October 2026 — EU lawmakers should reserve the strictest sovereignty rules for clearly defined, highly sensitive public cloud and AI workloads. Applying them more widely would add costs without improving security in practice. 

Under the Cloud and AI Development Act (CADA), mandatory requirements should focus on sensitive public workloads, such as those in defence and justice. Some public bodies may need strong protections for data and systems, and for the continuity of critical operations, but the requirements should match the sensitivity of the work. The scope cannot meaningfully be the entire public sector. 

Cecilia Bonefeld-Dahl, Director General of DIGITALEUROPE, said: 

We need high fences when it matters, low or no fences everywhere else if we want to grow our European competitiveness and sovereignty. We cannot regulate our way to sovereignty. We need to build our sovereignty. 

DIGITALEUROPE also calls for one consistent European framework, rather than 27 national approaches. One interpretation with fewer levels, clear definitions and alignment with existing cybersecurity rules will help businesses, and not least SMEs, who want to scale in Europe. There is no way companies can handle 27 different implementations, and the Commission estimates €2 million per each single digital service in implementation costs, so a company with 20 services end up with €40 million in year one, plus up to €500,000 yearly for maintenance and audits. 

The Commission aims to triple Europe’s data-centre capacity over the next five to seven years. Reaching that goal will take investment, faster permits and procurement that gives European providers—including smaller companies—the chance to grow. DIGITALEUROPE says the next EU long-term budget should prioritise 25% for digital and crowd in private capital much better than it currently does, open 25% of public procurement to SMEs and scale-ups, and crowd in private and allied investment. 

Europe has capabilities to build on. Cecilia Bonefeld-Dahl has argued that at least a quarter of the technology stack is European and that other allied nation also depends on European technologies. This means that Europe is not merely a victim but also has strong positions to build on and expand going forward. 

Our position is set out in Towards a competitive and sovereign Europe. 

DIGITALEUROPE on CADA: 

• We support the long-term objective of achieving a larger European share of the European Cloud AI & Technology market. 

• Europe should build more AI and cloud resilience and sovereignty through incentives over restrictions. 

• Technology sovereignty means capability, security, control and choice. 

• CADA should set clear guidelines. 

• A single European framework must apply uniformly across all Member States. 

• Europe should remain open and align criteria with allies’ sovereignty. 

Sovereignty should be measured in competitive terms: increased security and resilience, but also the best innovation and value creation across European industry,” Bonefeld-Dahl said.