The European Commission is moving forward with the Cloud and AI Development Act (CADA) , the legislation that, for the first time, establishes four levels of assurance to measure the sovereignty of cloud services that public administrations can contract and, by extension, sets the benchmark for the rest of the business sector. The proposal, presented on June 3, 2026, as part of the Technology Sovereignty Package, continues its parliamentary process and is once again at the center of debate following the release of details regarding its public procurement regime. At AZN Cloud we believe this is a development that every digital infrastructure manager in Spain should be paying attention to.
What is CADA and what levels of sovereignty does it establish?
The European Union is beginning to shift the concept of cloud sovereignty from the political and commercial arena to a common regulatory framework, with a proposal that establishes, for the first time, four levels of assurance to determine the extent to which a cloud service can be considered sovereign. In practice, at the lower levels, the focus is primarily on the location of the infrastructure, data, personnel, and operations, while as the level of assurance increases, additional requirements emerge regarding ownership, corporate control, and supply chain. The most stringent level reserves its conditions for the most sensitive workloads: the tiered framework reserves the highest levels of assurance for the most critical workloads: defense, national security, justice, and law enforcement.
Why does this affect companies operating in Spain?
Although the CADA was initially designed for public procurement, its influence is already extending to the private market. Title IV of the CADA and its annexes establish a new, rigid framework that precisely defines what types of cloud computing programs and services Member States can contract, aligning public sector demand with the four levels of assurance. Sectors such as banking, healthcare, and local government, which work with private providers, are beginning to extend these same requirements to their hosting, VPS, and backup contracts, demanding traceability regarding the physical location of data and who can access it.
Location, however, isn't everything. Cloud sovereignty isn't simply about keeping information within a border: effective control also depends on who manages the infrastructure, encryption keys, and access, and what legislation may affect the provider. This is an important distinction for anyone comparing cloud VPS offerings: a data center in Spain isn't enough; you need to know who actually operates the platform.
Spain, candidate to become a hub for southern Europe
The regulatory context coincides with a period of historic expansion for the sector in Spain. According to the DatacenterDynamics platform, the data center market in Spain has grown from 293 MW of operational capacity to a projected 500-600 MW by 2026, multiplying fivefold in a decade. This additional capacity is precisely what companies need if they want to migrate their workloads to infrastructure with verifiable data residency within Spain, a requirement that becomes increasingly important as the level of assurance demanded by the new European framework rises.
What can a company do to get ahead of change?
The practical recommendation, while the CADA completes its review process with the European Parliament and the Council, is to review which cloud provider you are working with and where your critical data is actually hosted. For those managing online stores, corporate applications, or internal systems, opting for a cloud VPS hosted in a data center in Spain , with operation and support also within the country, immediately reduces much of the legal uncertainty posed by the new regulation. Adding to this an independent cloud backup policy, with replicated and encrypted copies, completes the picture of compliance that an increasing number of institutional clients will demand.
At AZN Cloud we've been working on this premise for some time: infrastructure and data under Spanish jurisdiction. Anyone wishing to review their migration options can consult our VPS Cloud services hosted in our own data center in Spain.
What to watch out for in the coming months
- The timetable for processing the CADA in the European Parliament and the Council of the EU.
- If the cloud provider itself can prove what level of guarantee its service falls under.
- Do current hosting or VPS contracts allow auditing where the data resides and who has access to the keys?
- If there is a cloud backup plan independent of the main provider, with copies located in Spanish territory.
No company is currently forced to change suppliers overnight, but it is advisable to start asking these questions before the regulation comes into force and the review becomes urgent.
