The European Union (EU) is offering its allies a foothold in its cloud market—with little room to move. They could own a cloud business, provided EU citizens do the work and the operations and data stay inside the bloc. And even that permission could be revoked. Europe and its allies would both do better with a true digital trade deal.
Canada is heading to a summit with the EU in Montreal, reportedly seeking this “associated country” status under the proposed EU Cloud and AI Development Act (CADA). United Kingdom ministers are reportedly lobbying for the same. Neither government has made clear what it wants, but the status on offer falls well short of a trade deal.
The proposal’s Article 18 would allow businesses from recognized countries to own cloud operations located entirely within the bloc and walled off from operations elsewhere. That’s hardly an enticing offer for the EU’s allies. It’s also a poor bargain for the EU itself, which would unnecessarily restrict access to cloud services it needs.
The European Commission introduced CADA earlier this year, proposing four “assurance levels” for cloud services—computing resources accessed over the internet—purchased by public bodies. These levels set increasingly strict requirements for where providers operate, where they store data, and who can own or help run the service. The higher the level, the more the provider must keep its operations within the EU and limit outside involvement.
Even Level 1—the default unless a public buyer opts out—requires a provider established in the EU, with infrastructure and data located there. Level 2 requires the provider to deliver the service entirely within the EU and guarantee that no one will access the data from outside the bloc.
Level 3 goes further: Only EU citizens may participate in providing the service, and the provider must be free of control from outside the EU. This is where associated-country status comes in. The commission can recognize non-EU countries, allowing businesses from those countries to own cloud operations located and run entirely within the EU.
At Level 4, even that opening disappears. The ban on outside control admits no associated-country exception.
A Very Conditional Welcome
Article 18 offers a poor bargain for countries like Canada, the United Kingdom, and the United States. All they stand to gain is permission to own an EU business staffed by EU citizens working within the EU, with no data processing or reuse allowed outside it.
Even that very limited permission is precarious. The commission could revoke it unilaterally, and it depends on “adequacy” decisions under the General Data Protection Regulation (GDPR)—EU findings that another country provides sufficient protection for personal data. EU courts can strike down those decisions, as the Schrems cases demonstrated when they dismantled earlier EU-U.S. data-transfer frameworks. The mechanism also faces political threats: An amendment proposed in the European Parliament would delete Article 18 altogether.
The recognition criteria make the offer shakier still. They treat export controls, economic sanctions, and laws authorizing government access to data as grounds for disqualification—even though nearly all countries, including EU members, use such measures. Applied strictly, the criteria would leave virtually no jurisdiction eligible, including the EU itself. Recognizing a country would therefore require some creative interpretation, barely disguising a fundamentally political choice and potentially inviting a court challenge.
Keeping the Best Tools Out
Europe’s public sector needs cutting-edge technology, especially for sensitive work such as intelligence and cyber defense. Only non-EU companies currently provide these tools, and they deliver them through cloud services.
Some government functions—such as safeguarding nuclear launch authorization or records identifying intelligence sources—may justify keeping the relevant systems entirely within national borders and excluding even allies. Taken seriously, though, that logic would also mean excluding other EU countries, which proves to be an awkward wrinkle for an EU-wide policy.
Meanwhile, CADA would extend those restrictions to public services that need access to the best available technology, wherever it comes from. Localization may make sense for sensitive government functions that can get by with basic or older technology. But for work like cyber defense, denying access to the best available tools amounts to unilateral disarmament.
Safeguards Over Passports
A fair digital trade deal would address real risks with effective safeguards, rather than checking passports—especially when some EU countries are willing to sell theirs or permit businesses under de facto control from adversary countries. For data security, procurement rules should focus chiefly on technical protections: preventing providers from retaining customer data, keeping encryption keys in customers’ hands, and using computing environments that verifiably shield data even during processing.
Those protections still depend on trust, so there’s a sensible case for recognizing allies. But recognition should rest on an explicit political judgment that weighs the benefits of trade, the risks a country poses, and the strength of its safeguards—including the rule of law and independent courts. Criteria the EU itself couldn’t meet offer little assurance of anything.
A cloud policy should protect Europe’s data without putting its capabilities out of reach.