Entit
Get in touch
All insights
Data sovereignty 5 Nov 2026 · 4 min read

CADA's first Council compromise: more time, less harmonisation, and sovereignty ratings that can change

On 30 October, Ireland, which chairs the EU Council's working meetings until the end of the year, circulated its first compromise text on the Cloud and AI Development Act (CADA). It is a first draft for the member states' common position, not the final law: the European Parliament has its own process, and trilogue negotiations come after that. Even so, the direction matters for anyone who buys or runs cloud services for the public sector.

In October we argued that public bodies should start classifying their workloads against CADA's four assurance levels now, because that work does not depend on the final wording. The compromise text strengthens that case, and changes some of the details.

What stays the same

According to Agence Europe's reporting, the four-level cloud sovereignty label survives. Public administrations would still have to use services certified to at least level 1, and levels 2 to 4 for sensitive activities. The core question for buyers, "which level does each workload actually need?", is unchanged.

What the compromise changes

The reported changes fall into four groups.

More time, but not unlimited. The migration period for public administrations rises from 12 to 18 months. MLex reports that the compromise extends migration deadlines more broadly.

Less power for the Commission, more responsibility for member states and buyers. The Commission would no longer be able to impose assurance levels on member states' public-sector activities through implementing acts. It also loses the power to require risk assessments from highly critical private companies in NIS2 sectors. National security and defence are excluded from the risk-assessment scope.

A wider circle of buyers. The obligation to buy certified services is extended to contracting entities in sectors such as water and electricity.

Ratings that can change. Providers controlled from "associated" third countries could reach level 3 under conditions, including reciprocal access to public procurement markets. Three or more member states can ask the Commission to review a country's associated status, and if it is withdrawn, those providers lose their level 3 recognition. A new revocation procedure gives a transition period of at least 12 months when a service loses its recognition. Penalties get a harmonised ceiling of €1 million or 1% of worldwide annual turnover, whichever is higher.

MLex also reports that the compromise would permit certain overseas transfers of metadata and telemetry for cybersecurity purposes, and that the draft is due for discussion on 10 November.

What this means for public buyers and healthcare

Three things stand out from an architecture point of view.

First, classification lands closer to you. If the Commission cannot set assurance levels for public-sector activities by implementing act, more of that judgement will sit with member states and with each organisation. A documented, risk-based classification per workload, with the reasoning written down, becomes your evidence, not just your planning tool. In Swedish healthcare that reasoning has to cover Patientdatalagen and GDPR as well as CADA.

Second, a sovereignty level is not permanent. The associated-country mechanism and the revocation procedure mean that a service certified at a given level today can lose it later, for reasons that have nothing to do with its technical quality. A transition period of at least 12 months sounds generous until you compare it with how long it takes to move a journal-adjacent integration platform or a regional data warehouse. Design for that possibility now:

  • keep workloads portable (containers, Kubernetes, infrastructure as code, open identity and messaging standards),
  • keep an exit plan per critical service, including where backups and logs live,
  • test that you can actually rebuild an environment on another provider, at least for one representative system.

Third, ask about metadata and telemetry. If cybersecurity-related transfers of metadata and telemetry outside the EU are allowed, buyers need to know what those flows contain. Logs, traces and support diagnostics can carry personal data, including patient-related identifiers, even when the primary data never leaves the region. Put the question in procurement: which telemetry leaves the EU, to whom, how is it minimised, and can it be switched off?

The trade-off

Longer deadlines and narrower Commission powers lower the short-term cost and risk of forced migrations, which Swedish municipalities and agencies raised in their consultation responses. The price is less harmonisation: the same workload could end up classified differently in different countries, and more of the burden of proof falls on each buyer. Organisations that already have a workload inventory and a classification will be able to absorb either outcome. Those that wait for the final text will have 18 months, or whatever the trilogue settles on, to do work that is better done now.

What to do this quarter

  1. Finish or update your workload inventory, including metadata, logs, backups and support access.
  2. Give each workload a provisional assurance level and record why.
  3. For every service you would place at level 3 or above, note the provider's country of control and what you would do if its recognition changed.
  4. Add telemetry and metadata questions to your cloud procurement and contract reviews.

None of this depends on how the Council and Parliament finally settle the text.

Sources

Discuss this with us
An unhandled error has occurred. Reload 🗙

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please reload the page.