# EU Proposes Cloud Sovereignty Rules

The proposed EU Cloud and AI Development Act (CADA) would establish four sovereignty assurance levels for cloud services procured by public-sector bodies, including regional and local authorities. Its potential location, data-residency, foreign-access, and service-continuity conditions may extend beyond current U.S. FOCI and FedRAMP rules. The comparison also identifies proposed FOCI-related requirements for certain unclassified Department of War contracts and subcontracts valued above $5 million; it does not identify a specific solicitation or award.

- Contractors serving both EU and U.S. public-sector markets should assess the proposed EU sovereignty levels separately from U.S. facility-clearance and FedRAMP authorization obligations.
- Cloud providers and subcontractors may need to evaluate how data location, foreign access, and service continuity affect their ability to support EU public-sector customers if CADA is adopted.
- For relevant unclassified Department of War work, businesses should account for the proposed FOCI-related provisions applying to contracts and subcontracts above $5 million, while distinguishing these proposals from current requirements.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cloud Services, Regulatory Compliance
**Published:** October 22, 2026

### Government Entities
- European Commission (EC)
- U.S. Department of War (DoW)
- U.S. federal agencies

### Sources
- [A Comparison of the EU Cloud and AI Development Act Requirements Against the U.S. FOCI Regime and FedRAMP | Inside Privacy](https://www.insideprivacy.com/cloud-computing/a-comparison-of-the-eu-cloud-and-ai-development-act-requirementsagainst-the-u-s-foci-regime-and-fedramp) - Inside Privacy