Reading the EU Cloud and AI Development Act

COM(2026) 502 final

The Commission document number for the proposed Cloud and AI Development Act; it is not a final regulation number.

2026/0138(COD)

The procedure number. COD indicates the ordinary legislative procedure.

Recital

A numbered statement explaining context, reasons, and legislative logic. It is distinct from the operative articles.

Operative provision

An article or annex provision that would set legal rules if the proposed regulation were adopted and applicable.

Delegated act

A later Commission act that may supplement or amend specified non-essential elements, subject to Parliament and Council control.

Implementing act

A later Commission act setting uniform conditions for implementing an adopted EU act, typically through a committee procedure.

Cloud and AI Leadership Initiatives

The proposed Article 3 to 6 framework for building EU cloud and AI research, infrastructure, technology, and adoption capability.

Operational objective

A specific proposed capability target. Article 3 lists eight, including efficient data centres, open cloud stacks, frontier AI, physical AI, industrial AI, agents, public-sector AI, and adoption.

Grand challenge

A proposed large-scale, cross-sector initiative that implements operational objectives. Annex I contains eight grand challenges.

Centre for AI

A proposed Experience and Acceleration Centre for AI that supports adoption, skills, infrastructure access, regional knowledge transfer, and links between organisations and providers.

Open cloud stack

An interoperable set of layers spanning hardware, edge, connectivity, compute, storage, middleware, data and AI tools, backend systems, and services.

Physical AI

AI models and systems that perceive and act in the physical world, such as robots, autonomous vehicles, and drones.

Data centre acceleration zone

A proposed designated area where a Member State prepares planning, infrastructure, sustainability, and administrative conditions to facilitate data-centre deployment.

Brownfield preference

The Article 10 preference for reusing previously developed land rather than using greenfield land when designating a zone.

Anticipatory grid investment

Planning or investing in grid infrastructure ahead of fully materialised demand where evidence indicates that future system needs will require it.

Single information point

A proposed lifecycle coordination and guidance channel for operators seeking authorisations in an acceleration zone; it does not automatically replace permit authorities.

Aggregated baseline permit

A proposed zone-level permit covering commonly required authorisations after zone-level procedures and assessments, excluding installation-specific and grid-connection permits.

Installation-specific permit

An approval still needed for a condition or activity unique to an individual data-centre project and not covered by the zone's baseline permit.

Data centre strategic project

A project the Commission may designate under proposed Article 14 through an open call, if it fulfils at least two of five strategic criteria.

Acceleration zone

A Member State-designated area intended to facilitate data-centre deployment through coordinated planning and permitting arrangements.

Capacity gap

The difference between demand for suitable data-centre capacity and the capacity available to meet that demand.

Underserved area

An area identified through Commission and Member State monitoring as lacking sufficient compute capacity; it could subsequently be used as an acceleration zone.

Essential public-sector functions

Functions directly supported by infrastructure, including research and education, healthcare, public safety, and security.

Grid contribution

A contribution to electricity-grid security, safety, stability, or identified system needs, assessed by the relevant system operator.

Union assurance level

One of four proposed levels in the Union cloud computing sovereignty framework. The criteria would be set out in Annex II.

Conformity self-assessment

The Level 1 pathway in which a provider assesses compliance and issues a public EU statement of conformity.

EU statement of conformity

A provider declaration that Level 1 compliance has been demonstrated; issuing it makes the provider responsible for that claim.

Independent third-party audit

The required pathway for Levels 2, 3, and 4, producing an audit report and a positive or negative audit opinion.

National competent authority of establishment

The authority in the Member State of the provider's main establishment that evaluates recognition and has exclusive competence for enforcement under the proposed chapter.

Central repository

The proposed public Commission-maintained repository of recognised cloud services, including published revocations.

Cumulative criteria

Requirements that must all be met. A higher Union assurance level includes applicable lower-level requirements; one failed criterion can prevent conformity.

Metadata and telemetry

Service-derived information such as logs of users, times, functions, identities, configurations, and usage. The proposed framework treats it as customer data.

SBOM

Software bill of materials: an up-to-date inventory of software components. Annex II also expects a documented list of relevant dependencies.

Third-country control

Control that may arise through ownership, voting rights, vetoes, board appointments, commercial dependency, financial links, or other durable influence over management and resources.

Level 2 cybersecurity threshold

At least substantial assurance under a relevant European cloud cybersecurity scheme when available; interim national or highest-applicable-Union-law evidence may apply under the proposal.

Level 3 personnel rule

Relevant personnel, including relevant subcontractor personnel, must be Union citizens. Necessary Member State security clearance is also required where classified information is handled.

Public-order risk assessment

A proposed Article 29 assessment that identifies relevant public activities and determines whether Union assurance level 2, 3, or 4 is appropriate.

Union assurance level 1

The proposed minimum for in-scope public-sector activities that have not been identified as contributing to preservation of public order.

Exceptional derogation

A narrowly available, duly justified departure where specified conditions such as lack of a suitable recognised service, failed prior procurement, or disproportionate cost apply.

Union added value

Non-price quality evaluation of a tenderer's contribution to the European cloud and AI ecosystem in innovative cloud and AI procurement.

EuroCloud Federation

A proposed voluntary federation through which Union entities and public-sector bodies could share eligible public-sector cloud and data-centre services.

Common procurement

Commission-led purchasing that could use framework contracts, dynamic purchasing systems, a common platform, and central purchasing support.

No-regret action

A reversible or broadly useful action, such as building inventories, preserving evidence, or improving change notifications, that does not depend on one draft rule surviving.

Evidence register

A controlled list linking each claim to a document or system record, scope, owner, version, date, retention period, and refresh trigger.

Data-flow inventory

A map of where data, metadata, logs, telemetry, backups, prompts, outputs, and administrator access travel across services and organisations.

Delegated act

A non-legislative act that the Commission may adopt only if the final Regulation grants that power, subject to the controls specified by EU law.

Implementing act

An act used to establish uniform conditions for implementing EU law where the final Regulation gives the Commission that authority.

Decision gate

A defined point at which an organisation decides whether to make a costly or irreversible investment after new legal, technical, or procurement information becomes available.