EU Cloud Sovereignty Package Shifts Focus Beyond Ownership

On 3 June 2026 the European Commission unveiled the European Technological Sovereignty Package, whose centrepiece is the proposed Cloud and AI Development Act (CADA). CADA seeks to replace simplistic ownership‑based tests of cloud‑service sovereignty with a multi‑factor, evidence‑based framework that examines where data is processed and stored, the location of operational and technical support, sub‑processor chains, and contractual safeguards. The article explains that EU‑owned providers can still be exposed to foreign legal orders if they outsource support outside the EU or rely on non‑European subcontractors, while non‑EU providers may achieve sovereignty through strong technical controls such as encryption and customer‑held keys. For law‑firm counsel, the development means that due‑diligence questionnaires, vendor‑management policies, and cloud‑contract clauses must be updated to reflect the new operational criteria, and ongoing monitoring is required because corporate structures and supply chains can drift over time. Clients should watch for the final adoption of CADA, any accompanying delegated acts, and how EU courts interpret the sovereignty‑protection defences in forthcoming data‑disclosure conflicts involving the CLOUD Act or similar extraterritorial regimes.