Key takeaways
- On June 3, 2026, the European Commission proposed the Cloud and AI Development Act (CADA), which would grade cloud providers on four “Union assurance” sovereignty levels and limit sensitive public-sector and critical-sector workloads to levels two to four.
- A leaked draft for the October 29-30 EU-Canada summit in Montreal points to Canada seeking associated-country status under CADA’s Article 18, conditional on an EU privacy adequacy finding and on limits to foreign government access to provider data.
- The pivot lands on your desk as vendor diligence: the sovereignty questions the EU would ask about a provider’s control, data location, staff, and government-access procedures are the ones your procurement files should answer now.
A tier list for clouds, with procurement money attached
Europe has spent two decades writing the world’s digital rulebook and buying its infrastructure from someone else. CADA is the attempt to fix the second problem. Adopted as a proposal on June 3, 2026, the Cloud and AI Development Act grades cloud and AI services on four assurance levels: the more sensitive the workload, the higher the level. Public bodies and critical-sector operators would be limited to levels two to four for sensitive workloads, and level three, which could host EU classified information, would be off-limits to providers controlled by a third country. One qualifier: it still has to pass the European Parliament and the Council, so treat the terms below as draft conditions to plan against.
It became Canadian news this morning, when Michael Geist published a pointed reading of the leaked draft joint statement for the October 29-30 EU-Canada summit in Montreal. The draft reportedly points to aligning digital regulatory frameworks “through associated country status for Canada” under CADA, alongside a completed Digital Trade Agreement and deeper AI and cybersecurity cooperation, per reporting on the draft. The substance worth your time is the conditions Europe attaches to that status.
What associated-country status actually demands
Article 18 lets the Commission designate associated third countries whose providers could still be audited at level three. The conditions read like a procurement checklist with a sovereignty spine:
- The country must hold an EU privacy adequacy decision.
- It must have no measures enabling it to control a provider in a way that conflicts with European limits on foreign government access to data.
- It must not mandate service degradation or enforce sanctions that are not legitimate under European law.
- It must place no impediments on the supply of advanced technologies and keep its cloud market open to EU providers, with equivalent public-procurement access.
Then the annex-level detail for the provider: EU-established, with infrastructure, staff, and customer data located there; EU-citizen staff; technical support in the EU by EU residents; data that never leaves the EU or trains third-country AI systems; and demonstrated measures to block third-country access to customer data, which here means Canada.
Canada gets a path for its providers into Europe’s sensitive workloads, but the path runs through privacy law and government-access law, not trade negotiation. That is why this belongs on a privacy team’s reading list.
Canada’s adequacy problem, and the lawful-access problem
Canada has held an EU adequacy finding since 2001, based on PIPEDA. The adequacy condition means the EU would assess whether Canada’s current framework meets the standard, and that review would start with Bill C-36, the proposed Protecting Privacy and Consumer Data Act. A privacy reform bill becomes a trade instrument: if the adequacy finding wobbles, the associated-country path wobbles with it.
The harder complication is Bill C-22, the Lawful Access Act heading to the Senate this fall, which would give Canadian authorities new powers to compel providers to build and maintain surveillance capabilities. CADA asks a country to show it does not wield provider-control powers that conflict with European limits on government access to data, and Canada has asserted exactly that kind of reach: the RCMP obtained a court order last year requiring OVHcloud, a French provider, to disclose data based on its presence in Canada. Justified or not, it is now part of the file Europe reads.
Then the procurement wrinkle. “Buy Canadian” cloud policies were flagged by the US as a trade barrier earlier this year, and associated-country conditions demand equivalent procurement access for EU providers. A government that wants sovereign cloud at home and European market access abroad is about to discover those two positions negotiate against each other.
Outside the communiqué, practitioner sentiment runs skeptical in a useful way: an assurance label does not by itself stop foreign legal access, so “sovereign” risks becoming branding unless the access rules hold, and Canada’s sovereignty rhetoric is moving faster than the capacity behind it. Both objections set the bar for the questions below. Ask for the documented access process, not the marketing claim.
What to ask your cloud vendors this quarter
You do not need to wait for the summit. The CADA conditions give you a ready-made vendor questionnaire that maps onto diligence you should already be doing under PIPEDA, Law 25, and the OPC’s third-party guidance. Ask in writing, keep the answers in the vendor file:
| CADA condition | Your vendor question |
|---|---|
| No third-country control | Who ultimately controls the provider, and through what corporate structure? What changes on acquisition? |
| EU location of infrastructure, staff, data | In which jurisdictions does our data rest, get processed, and get supported from? Name the regions, not the marketing. |
| EU-resident technical support | Who can touch our data in a support ticket, from where, under what access controls? |
| Data does not leave the EU or train third-country AI | Does any of our data leave the declared regions, including for training, diagnostics, or subcontractor processing? |
| No conflicting government-access powers | What is the provider’s process for foreign government access demands, and where is it documented? |
| No mandated service degradation | Can any government order the provider to degrade, filter, or hand over the service, and what would it disclose? |
| Adequacy as the floor | For EU data, which transfer mechanism applies today, and what changes if adequacy findings shift? |
Two of these are the questions most vendor files cannot answer today: who can touch the data in a support ticket, and what happens on a foreign government demand. If your file cannot answer them, the file is not done.
Actionable takeaway: Pick your five highest-risk cloud vendors (by data sensitivity, not by spend) and run the seven questions above against them before the October 29 summit. Whatever the communiqué says, you will walk into Q4 with vendor files that answer the sovereignty questions your board will start asking next year.