The EU’s Fair-Weather Cloud Partnership
The European Union (EU) is offering its allies a foothold in its cloud market—with little room to move. They could own a cloud business, provided EU citizens do the work and the operations and data stay inside the bloc. And even that permission could be revoked. Europe and its allies would both do better with a true digital trade deal.
Canada is heading to a summit with the EU in Montreal, reportedly seeking this “associated country” status under the proposed EU Cloud and AI Development Act (CADA). United Kingdom ministers are reportedly lobbying for the same. Neither government has made clear what it wants, but the status on offer falls well short of a trade deal.
The proposal’s Article 18 would allow businesses from recognized countries to own cloud operations located entirely within the bloc and walled off from operations elsewhere. That’s hardly an enticing offer for the EU’s allies. It’s also a poor bargain for the EU itself, which would unnecessarily restrict access to cloud services it needs.
The European Commission introduced CADA earlier this year, proposing four “assurance levels” for cloud services—computing resources accessed over the internet—purchased by public bodies. These levels set increasingly strict requirements for where providers operate, where they store data, and who can own or help run the service. The higher the level, the more the provider must keep its operations within the EU and limit outside involvement.
Even Level 1—the default unless a public buyer opts out—requires a provider established in the EU, with infrastructure and data located there. Level 2 requires the provider to deliver the service entirely within the EU and guarantee that no one will access the data from outside the bloc.
Level 3 goes further: Only EU citizens may participate in providing the service, and the provider must be free of control from outside the EU. This is where associated-country status comes in. The commission can recognize non-EU countries, allowing businesses from those countries to own cloud operations located and run entirely within the EU.
At Level 4, even that opening disappears. The ban on outside control admits no associated-country exception.