SkarpChapter 2 of 17
Legal Authority, Evidence, Resources, and the Article Map
What gives the Union authority to establish this framework, and why is a directly applicable regulation considered necessary? The memorandum moves from legal justification and consultation evidence to staffing, monitoring, and a consolidated map of the operative provisions.
1. Orientation: What Kind of Text Is This?
Status matters
This is a proposal, not an adopted Regulation. As of 20 July 2026, COM(2026) 502 final remained in the ordinary legislative procedure.
Read the structure
The text moves from authority and necessity, to evidence and resources, then to monitoring and the operative Article 1-48 map.
Three questions
Can the EU act? Legal basis and subsidiarity. How far? Proportionality. What would happen? The detailed provisions.
2. Legal Basis, Subsidiarity, and Proportionality
Article 114 TFEU
Article 114 is the internal-market basis: divergent rules on capacity, sustainability, permits, procurement, and sovereignty can fragment the market.
Article 173(3) TFEU
Article 173(3) supplies the industrial rationale: the proposal links compute shortages to weaker cloud and AI innovation, competitiveness, and leadership.
Cumulative basis
The proposal combines both bases because it pursues both market integration and industrial capacity-building in one legislative instrument.
Limits on action
Subsidiarity argues that EU action adds cross-border value. Proportionality says the measures should be targeted, necessary, and no more intrusive than needed.
3. Why the Proposal Chooses a Regulation
The exact choice
The source calls a Regulation the optimal instrument because it ensures uniform application and immediate effect across Member States.
Why this matters
Uniform rules are meant to prevent national divergence in sovereignty and sustainability standards from recreating internal-market barriers.
What the text does not do
It argues positively for a Regulation. It does not set out a detailed, named comparison with every possible alternative legislative instrument.
4. Evidence, Consultation, Impact Assessment, and Rights
Consultation numbers
The consultation yielded 436 responses: 243 survey responses and 193 call-for-evidence responses, alongside workshops and roundtables.
Bilateral engagement
The Commission held over 100 bilateral meetings with industry, academia, think tanks, and civil society, plus talks with third countries.
Impact assessment
The Board gave a positive opinion on 8 May 2026, but also requested further improvements. Both parts of that finding matter.
Fundamental rights
The proposal ties sovereign-cloud safeguards to Article 8 Charter protection, GDPR compliance, EU supervision, and reduced non-compliant data-handling risk.
5. Quiz: Legal Design and Evidence
Choose the answer that most closely reflects the source text.
Which statement correctly combines the proposal's legal bases and evidence findings?
- It relies only on Article 114 TFEU, and the Regulatory Scrutiny Board rejected the impact assessment.
- It uses the cumulative legal basis of Articles 114 and 173(3) TFEU, and the Board issued a positive opinion accompanied by a request for further improvements.
- It uses Article 173(3) TFEU only, and consultation consisted solely of 436 bilateral meetings.
- It relies on Article 8 of the Charter as its legal basis, and no external expertise was collected.
Show Answer
Answer: B) It uses the cumulative legal basis of Articles 114 and 173(3) TFEU, and the Board issued a positive opinion accompanied by a request for further improvements.
The source identifies a cumulative Article 114 and Article 173(3) TFEU basis. It also states that on 8 May 2026 the Board issued a positive opinion accompanied by a request for further improvements. The 436 figure refers to consultation responses, not bilateral meetings.
6. Budgetary Implications and the Review Clock
The total
25 FTEs are required: 9 establishment-plan posts and 16 contract-agent posts.
Where staff come from
The plan combines 15 reassigned existing staff with 10 additional FTEs: 6 for DG CNECT and 4 for DG DIGIT.
Fees and EuroCloud
Fee-based internal assigned revenues would mostly finance new administrative tasks, including joint procurement and EuroCloud administration.
Review timing
The Commission should review the proposed Regulation five years after entry into force and send a public report to Parliament and Council.
7. Article Map I: Titles I and II
Title I
Article 1 covers subject matter and Article 2 contains definitions. This extract names Article 2 but does not reproduce its definitions.
Articles 3-6
Title II sets goals and operational objectives, creates AI Experience and Acceleration Centres, and provides implementation mechanisms.
Article 7 deadline
Member States must adopt a national cloud and AI strategy coherent with the Regulation's objectives within one year of entry into force.
Articles 8-9
The Commission may recognise frontier AI priority projects, while Article 9 supports allocation of AI compute resources to priority and public-sector projects.
8. Worked Scenario: From National Strategy to Data-Centre Capacity
A planning pipeline
A national strategy can identify a capacity problem, but the source requires only that the strategy be coherent with the Regulation's objectives.
Acceleration zones
Articles 10-13 connect deployment zones with zone conditions, operator information points, and facilitated administrative and permit processes.
Strategic projects
Article 14 provides an expression-of-interest route and Commission designation conditions. Designation is not described as automatic.
Monitoring the gap
Article 15 tracks available compute capacity, demand for data-centre capacity, and the size of the capacity gap across the Union.
9. Article Map II: Sovereignty, Assurance, and Procurement
Four assurance levels
Article 16 establishes four Union assurance levels. Annex II sets the requirements that cloud services must meet for levels 1-4.
Recognition and evidence
Article 17 covers recognition applications. Level 1 uses self-assessment; levels 2-4 use third-party auditing and audit evidence.
Accountability system
Articles 22-28 provide a central repository, material-change reporting, penalties, national authorities, and cross-border cooperation.
Procurement threshold
Cloud procurement has a minimum of Union assurance level 1. Public-order relevance found in risk assessment raises the permitted choice to levels 2-4.
10. Article Map III: EuroCloud, Common Procurement, Open Source, and Final Provisions
EuroCloud
Article 34 establishes the EuroCloud Federation. Articles 35-36 govern service sharing and Commission cost recovery for the Federation and platform.
Common procurement
Articles 37-40 cover Commission procurement activity, framework governance, applicable procurement rules, and fees from participating authorities.
Open-source architecture
Articles 41-44 promote open source, require sharing and reuse rules, establish a catalogue, and create a network of national programme offices.
The final provisions
Articles 45-48 concern delegated acts, implementing acts, review, and entry into force/application dates. This extract does not give Article 48's dates.
11. Quiz: Apply the Assurance Framework
Use the article map, not general assumptions about cloud security.
A contracting authority procures cloud services. Its Article 29 risk assessment finds that the relevant activity has public-order relevance. What does the source say it must do?
- It may use any non-recognised service, provided the provider makes a self-assessment.
- It must procure at least Union assurance level 1, but may choose any level after that.
- It must only procure and use services recognised as offering Union assurance levels 2, 3, or 4.
- It must join the EuroCloud Federation before procuring any service.
Show Answer
Answer: C) It must only procure and use services recognised as offering Union assurance levels 2, 3, or 4.
Article 30 sets a general minimum of Union assurance level 1. However, where the Article 29 risk assessment determines public-order relevance, the authority must only procure and use services recognised at Union assurance level 2, 3, or 4. The source does not make EuroCloud membership a universal procurement condition.
12. Flashcards: Recall the Framework
Flip each card, state the answer aloud, then check the precise wording.
- What is the internal-market legal basis?
- The legal basis for this proposal is Article 114 of the Treaty on the Functioning of the European Union (TFEU).
- What is the industrial legal basis?
- The proposal draws on Article 173(3) TFEU.
- How many consultation responses were received?
- 436 total: 243 for the consultation survey and 193 for the call for evidence.
- What was the impact assessment opinion?
- On 8 May 2026, the Board issued a positive opinion accompanied by a request for further improvements.
- What is the total staffing requirement?
- 25 FTEs: 9 establishment plan posts and 16 contract agent posts.
- When must Member States adopt national cloud and AI strategies?
- Within one year of the Regulation's entry into force, under Article 7.
- What does Article 16 establish?
- A Union cloud computing sovereignty framework consisting of four assurance levels.
- What is the basic public-procurement assurance threshold?
- Contracting authorities procuring cloud computing services must procure, as a minimum requirement, Union assurance level 1.
- What does Article 34 establish?
- The European public sector cloud federation, the EuroCloud Federation.
Key Terms
- FTE
- Full-time equivalent, a staffing measure representing the workload of one full-time worker.
- Subsidiarity
- The principle used here to argue that the objectives are better achieved at Union level than by Member States acting separately.
- Proportionality
- The principle that proposed measures should not go beyond what is necessary to achieve their objectives.
- Article 114 TFEU
- The internal-market legal basis used in the proposal to address barriers caused by divergent national provisions.
- Article 173(3) TFEU
- The industrial-competitiveness legal basis used in the proposal for measures supporting EU industrial capacity and innovation.
- EuroCloud Federation
- The proposed European public sector cloud federation established by Article 34 to facilitate sharing of public-sector data-centre and cloud services.
- Union assurance level
- One of four levels in the proposed Union cloud computing sovereignty framework under Article 16.
- Cumulative legal basis
- Use of Articles 114 and 173(3) TFEU together because the proposal pursues both internal-market and industrial objectives.
- Internal assigned revenues
- Fee-based revenues intended in the source to finance specified Commission activities, including EuroCloud administration and joint procurement support.
- National competent authority
- The authority designated by a Member State under Article 25, with powers addressed in Article 26.
- Data centre acceleration zone
- A zone that Member States must designate under Article 10 where data-centre capacity is being deployed.