EU Presidency Trims Cloud Autonomy Rules
Irish Council Presidency's first compromise text on the CADA Regulation scales back obligations on Member States and Commission powers.
Updated on Nov. 2, 2026 in Data Centers
The Irish Presidency of the Council of the EU released its first compromise text on the CADA Regulation, dated 30 October, which targets the Regulation's third pillar on autonomy. The draft removes several obligations on Member States and curtails powers of the European Commission.
Why it matters
The changes alter how public administrations across the European Union must source cloud services under a four-level sovereignty label, with stricter penalties and longer migration windows. The compromise reflects ongoing negotiation over how much discretion Member States retain relative to central EU oversight.
The compromise text sets a harmonised fine ceiling of €1 million or 1% of total worldwide annual turnover, whichever is higher, and extends the public administration cloud migration window from 12 to 18 months. The draft does not yet state how many Member States will support the revised autonomy provisions.
The players
Irish Presidency of the Council of the EU
Ireland held the rotating Council Presidency and produced the first compromise text revising the CADA Regulation's autonomy provisions.
European Commission
The EU's executive body proposed the CADA Regulation and would gain or lose review powers under the compromise text.
The details
The third pillar establishes a four-level cloud sovereignty label, requiring public administrations to use services certified to at least assurance level 1 and levels 2 to 4 for sensitive activities. Under the compromise, three or more Member States may ask the Commission to review a third country's associated status, which the Commission would decide on within three months.
Timeline
June 2026: The European Commission presented the CADA proposal.
30 October 2026: The Irish Presidency's compromise text was dated.
1 November 2026: The article reporting the compromise text was published.
Big Picture
The compromise narrows the June 2026 CADA proposal by removing obligations on Member States and reducing Commission powers over cloud service recognition. It signals a shift toward greater national discretion in EU cloud sovereignty rules.
Public administrations will need to source cloud services at the required certification levels, with a longer 18-month window to migrate under the compromise text. Providers face a fine ceiling of €1 million or 1% of worldwide turnover if they fall short.
The takeaway
Organizations relying on EU cloud services should track the CADA compromise as negotiations determine final fine levels, migration timelines and review mechanisms. The draft's removal of Member State obligations means national implementation may vary considerably.
Further reading
Explore more on Data Centers to see how cloud sovereignty rules shape infrastructure decisions.
More information
Read the Irish Presidency CADA compromise text directly for the full draft.
