One of the priorities of the European Union for the coming years is to double its efforts to develop its own capabilities in Artificial Intelligence (AI). For this purpose, the digital head of the community Executive, Henna Virkkunen, presented a legislative package that includes the Cloud and AI Development Law (CADA, for its acronym in English). The goal is to triple the capacity of European data centers over the next five years to respond to the growth of this technology.
One of the main elements of the future legislation is the establishment of a four-level framework. The proposal thus introduces a unique European system to measure the "sovereignty" of cloud and AI services, especially in the public sector. To this end, different degrees of sovereignty are defined based on criteria such as the location of infrastructures, control of the software supply chain, cybersecurity, and exposure to legislations of third countries.
The Spanish industry defends an open technological sovereignty
In its institutional processing, the Spanish industry has found an ally in the European Parliament. The MEP Diego Solier, in charge of the report, is currently in the initial phases of negotiation, a moment in which the different stakeholders are conveying their proposals to influence the configuration of the future regulatory framework.
In this context, the association representing the Spanish digital industry, AMETIC, proposes a model that it has defined as "open technological sovereignty". In practice, this means that sovereignty should not be measured by the geographical origin or corporate nationality of the provider, but by the effective and verifiable capacity for control, resilience, and governance of data and infrastructures.
More specifically, the association requests the European Commission that technological dependence is not presumed exclusively by the geographical origin of the provider, but rather evaluated based on the customer's ability to control their data, migrate workloads, and resort to alternative solutions. According to the data handled by the organization, indirectly restricting access to advanced technologies could reduce the growth opportunity of AI in Europe from nearly 1.2 trillion euros to 400 billion.
Furthermore, in its document of allegations, AMETIC raises the need to carry out a prior quantified assessment that considers the financial cost to public budgets, the impact on the innovation of SMEs, international trade commitments, and the compatibility of the new requirements with the community objective of attracting 200 billion euros in private investment.
Streamlining permits and expanding beneficiary infrastructures
Although the industry positively values that Brussels is proposing a streamlining of licenses and permits, it considers it necessary to establish "clear authorization deadlines", accompanied by single windows that allow avoiding bureaucratic delays in the execution of projects.
This demand is accompanied by another request: that the support measures provided for in the future legislation are not limited exclusively to the Acceleration Zones. The association claims that other types of infrastructure, such as edge computing, micro data centers, and on-premise facilities dedicated to a single client, should also be recognized. The objective is to prevent the design of incentives from concentrating regulatory benefits in a single deployment model, leaving out other solutions that also contribute to the development of European computing capacity.
Featured story
The EU data supervisor demanded more guarantees to use sensitive information in AI training.
4 minutes
One of AMETIC's main red lines is the elimination of the European Commission's power to extend sovereignty obligations to regulated private industries through delegated acts. As an alternative, it proposes that any expansion of this type be strictly subject to the ordinary legislative procedure, with prior public consultation. Likewise, the organization proposes that the prescriptive selection of a provider belonging to a certain level of sovereignty guarantee (UAL) be considered only as a last resort.
This would allow public clients to resort to alternative or complementary mitigation measures, such as multicloud strategies, encryption systems with keys controlled by the client themselves, or additional security and governance guarantees. Essentially, what the Spanish industry is proposing is to prevent the future regulation from turning sovereignty requirements into an automatic market access restriction for certain technology operators.
In this line, AMETIC proposes to include by default strategic business partners, such as the United States, Canada, or the United Kingdom, at the UAL-3 level, under the corresponding international public procurement and free trade agreements (GPA/FTA). The proposal is articulated through an opt-out model, with which it aims to avoid the emergence of reciprocal trade barriers.
A classification proportional to the sensitivity of the data
The model conveyed by the association also develops a series of specific criteria to modulate regulatory demands.
Specifically, it distinguishes three initial tiers:
-
Level zero: free of restrictions for public or non-sensitive data.
-
First level: the residency of the data could be fulfilled by guaranteeing a fully available copy in the territory of the European Union, allowing temporary processing to avoid blocking migrations.
-
Second level: equal requirements would be demanded from European and non-European providers regarding the mitigation of risks arising from foreign jurisdictions.
AMETIC warns that restricting access to the highest levels based on the corporate nationality of the provider could deprive the European public sector of some of the most advanced frontier AI and cybersecurity tools. Therefore, it proposes to develop explicit guidelines to avoid the so-called maximum brand effect, so that a system is not entirely classified in the UAL-3 or UAL-4 levels merely for containing a fraction of sensitive data.
The association defends, consequently, a proportional application of sovereignty requirements, adjusted to the nature of the data and the actual risks of each service, instead of imposing homogeneous obligations on the entirety of an infrastructure.
The dependence on open source and the bottlenecks of computing
Another aspect that the consulted sources emphasize is the difficulty of demanding a supply chain of software that is entirely European. According to them, a 100% European software chain is unfeasible in the modern cloud due to the global dependence on open source code.
This reality, they argue, must be taken into account when designing the criteria for technological sovereignty, avoiding the introduction of requirements that may prove incompatible with the current functioning of the digital ecosystem.
Featured story
Brussels links the growth of data centers to their impact on the electrical grid
5 minutes
Finally, AMETIC warns that achieving the goal of tripling the computing capacity of the European Union will require resolving the current bottlenecks that condition the deployment of new infrastructures. Among the specific measures conveyed to Brussels is the introduction of a prioritization criterion based on the technical, administrative, and execution maturity of each project. The aim is to accelerate access to the procedures and resources necessary for those initiatives that are already prepared to begin their construction.
In this way, the Spanish industry seeks for the future Cloud and AI Development Law to combine the reinforcement of European technological autonomy with an open, proportional regulatory framework capable of mobilizing the necessary investments to expand the computing capacity of the bloc.