Cloud and AI Development Act

118 submissions in the snapshot (41 from organisations), portal total 118. Feedback list on the portal.

41 of 41 organisation submissions analysed; the model reads them as: opposes 1 supports 2 wants changes 29 9 held back for review (low confidence).

• Europeans for Safe Connections NGO, BEL; register: Non-governmental organisations, platforms and networks and similar model reads as: opposes source
  • Add a new point to Annex I regarding health impacts and independent methodologies for assessing environmental and public health impacts in accordance with the precautionary principle.

    Should the legislative process nevertheless continue, we recommend adding a new point to Annex I: 9. Grand Challenge 9: Health Impacts Development of independent methodologies for assessing environmental and public health impacts, including cumulative impacts and long-term monitoring, in accordance with the precautionary principle.

• Transparent Edge Services S.L. Company, ESP; register: Professional consultancies model reads as: wants changes source
  • Explicitly include distributed edge computing, content delivery and network security services within the sovereignty framework, assurance levels and procurement provisions.

    To ensure a comprehensive approach, CADA should explicitly include distributed edge computing, content delivery and network security services within its sovereignty framework, assurance levels and procurement provisions.

    machine translation by the Commission, original in ES
  • Incorporate a real 'evaluate once, use many times' principle by accepting existing national schemes and certifications as evidence of equivalent controls.

    To achieve this, Articles 17 and 20 and Annexes II and III would need to incorporate a real 'evaluate once, use many times' principle.

    machine translation by the Commission, original in ES
  • Extend criteria regarding Union added value to any relevant procurement of cloud, edge and AI services and give them a significant minimum weighting.

    In order for them to contribute effectively to reducing strategic dependencies, they should be extended to any relevant procurement of cloud, edge and AI services and be given a significant minimum weighting, adapted to the sensitivity and subject matter of the contract.

    machine translation by the Commission, original in ES
• Kaspersky Labs Limited Company, DEU; register: Companies & groups model reads as: supports source
  • Expand sustainable computational capacity.

    we support the European Commissions objective to expand sustainable computational capacity, strengthen Europes competitiveness in artificial intelligence, and improve the resilience and security of digital infrastructure.

  • Strengthen Europe's competitiveness in artificial intelligence.

    we support the European Commissions objective to expand sustainable computational capacity, strengthen Europes competitiveness in artificial intelligence, and improve the resilience and security of digital infrastructure.

  • Improve the resilience and security of digital infrastructure.

    we support the European Commissions objective to expand sustainable computational capacity, strengthen Europes competitiveness in artificial intelligence, and improve the resilience and security of digital infrastructure.

• The Shift Project Academic or research institution, FRA; register: Think tanks and research institutions model reads as: wants changes source
  • Make energy compatibility a core objective so that new capacity aligns with EU energy and climate goals.

    -Make energy compatibility a core objective. New capacity should align with EU energy and climate goals. Data centres should not use electricity more carbon-intensive than the local grid mix, including behind-the-meter generation.:

  • Integrate cloud, AI and data centre deployment into energy planning by aligning EU and national strategies with NECPs and grid plans.

    -Integrate cloud, AI and data centre deployment into energy planning. EU and national strategies should align with NECPs, long-term strategies, grid, water and industrial plans, including electricity budgets reflecting demand, peak load, grid capacity and competing needs.

  • Condition fast-track procedures, strategic status and public support on transparency, energy compatibility, and disclosure of physical impacts.

    - Condition fast-track procedures, strategic status and public support on transparency and energy compatibility, including grid capacity, low-carbon electricity, water constraints and competing needs. Operators should disclose physical impacts.

• OpenMined Foundation NGO, USA model reads as: wants changes source
  • Introduce an equivalence route allowing Annex II criteria to be met by verifiable technical measures.

    an equivalence route allowing Annex II criteria to be met by verifiable technical measures (Articles 1618)

  • Ensure admissibility and preference of technical evidence in audits.

    admissibility and preference of technical evidence in audits (Articles 1921)

  • Include procurement criteria rewarding non-transfer data use and verifiable control over AI outputs.

    procurement criteria rewarding non-transfer data use and verifiable control over AI outputs (Articles 2933)

• Micro company, LVA Company, LVA model reads as: wants changes source
  • Bind recognition to an identifiable service and evidence baseline.

    1. Bind recognition to an identifiable service and evidence baseline.

  • Define objective material-change triggers for reassessment.

    2. Define objective material-change triggers.

  • Make assurance status machine-readable and time-aware.

    3. Make assurance status machine-readable and time-aware.

• Bündnis F5 NGO, DEU model reads as: wants changes source
  • Establish clear and measurable criteria to ensure that investments in Cloud and AI technologies contribute to the common good.

    Instead, the CADA should establish clear and measurable criteria to ensure that investments in Cloud and AI technologies contribute to the common good.

    machine translation by the Commission, original in DE
  • Strengthen provisions on open source with binding targets and stronger incentives.

    We therefore propose strengthening the provisions on open source, including binding targets in national Cloud and AI strategies, stronger incentives for the development and maintenance of open technologies, and a broader Commons Added Value criterion in public procurement.

    machine translation by the Commission, original in DE
  • Make sustainability a binding condition for the designation of Data Center Acceleration Zones.

    Sustainability should be a binding condition for the designation of Data Center Acceleration Zones, rather than merely one factor to be weighed against other considerations.

    machine translation by the Commission, original in DE
• Open Markets Institute Europe NGO, GRC; register: Think tanks and research institutions model reads as: wants changes source
  • Ban generic sovereignty claims that are not backed by audited compliance with the framework.

    To address this, generic sovereignty claims that are not backed by audited compliance with the framework should be banned, ensuring procurement authorities have accurate information to work with.

  • Have the European Commission directly evaluate cloud providers that meet certain size thresholds.

    It would be preferable for the European Commission to directly evaluate cloud providers that meet certain size thresholds, based on turnover, market capitalization, and overall economic weight, and for the Commission to set a minimum, EU-wide list of public-sector activities requiring stronger assurance levels, preventing divergence between Member States.

  • Make a multi-cloud strategy mandatory by default for Member States.

    Rather than merely asking Member States to consider a multi-cloud strategy, such an approach should become mandatory by default, with single-vendor strategies requiring explicit justification.

• The Future Society Other, BEL model reads as: wants changes source
  • Require cloud infrastructure to support the generation of manipulation-proof evidence trails of AI activities to assess compliance with applicable laws.

    1. Requiring cloud infrastructure to support the generation of manipulation-proof evidence trails of AI activities, for example via confidential-computing-based methods, to feed into the assessment of compliance with applicable laws;

  • Add technologies for AI workload verification and new measures for data-centre security to the objectives of the Cloud and AI Leadership Initiative and create a dedicated Grand Challenge.

    2. Adding technologies for AI workload verification and new measures for data-centre security to the objectives of the Cloud and AI Leadership Initiative (Articles 3 and 4), and creating a dedicated Grand Challenge.

  • Condition frontier AI priority projects on GPAI Code of Practice aligned development.

    1. Conditioning frontier AI priority projects on GPAI Code of Practice aligned development;

• Micro company, GBR Company, GBR model reads as: wants changes source
  • Include the oversight of third-party AI systems and platforms in the common cloud and AI curriculum.

    Include in the common cloud and AI curriculum the oversight of AI systems an organisation already uses through third-party platforms.

  • Ensure national strategies measure the actual results AI delivers to SMEs alongside adoption rates.

    National strategies should measure the results AI delivers to SMEs as well as the share of SMEs that use AI.

  • Empower Centres for AI to help SMEs access their campaign data and store copies in EU-hosted storage to prevent vendor lock-in.

    Centres for AI should help them use it and keep their own copy in EU-hosted storage.

• Japan Business Council in Europe (JBCE) Business association, BEL; register: Trade and business associations model reads as: wants changes source
  • The Commission should assess third countries under Article 18 in parallel with the legislative procedure so that an implementing act is adopted by the date of application.

    The Commission should assess third countries in parallel with the legislative procedure, so that an implementing act can be adopted by the date of application.

  • Data localisation should cease to be the general rule at levels 1 and 2 and become an exception.

    Localisation should cease to be the general rule at levels 1 and 2 and become an exception: at level 1 where the public sector body explicitly requires it, and at level 2 for data identified as sensitive in the Article 29 risk assessment.

  • Residency should suffice under criterion (d) instead of Union citizenship for personnel.

    Residency, already accepted under (h) for staff with direct access, should suffice under (d) instead of Union citizenship.

• Micro company, PRT Company, PRT model reads as: wants changes source
  • Complement cloud and provider-level sovereignty with procurement-ready requirements for AI agent runtimes, hardware-backed trust, and deployment-level conformance tiers.

    We recommend complementing this with procurement-ready requirements for AI agent runtimes, hardware-backed trust, and deployment-level conformance tiers.

  • Encourage the development of reference procurement clauses for AI agent runtimes covering operating-system integrity, sandboxing, capability-based access control, and auditability.

    We recommend that CADA encourage the development of reference procurement clauses for AI agent runtimes, covering operating-system integrity, sandboxing, capability-based access control, and auditability.

  • Encourage reference procurement clauses for hardware-backed AI runtime assurance, including hardware root of trust, remote attestation, key custody, memory and I/O isolation.

    We recommend that CADA encourage reference procurement clauses for hardware-backed AI runtime assurance, including hardware root of trust, remote attestation, key custody, memory and I/O isolation,

• Danish Industry Business association, DNK; register: Trade and business associations model reads as: wants changes source
  • Ensure requirements for cloud services are risk-based and grounded in concrete security and resilience considerations.

    Requirements for cloud services should be risk-based and grounded in concrete security and resilience considerations.

  • Provide a clear and narrow definition of the concept of public order to avoid fragmentation and disproportionate requirements.

    In particular, DI calls for a clear and narrow definition of the concept of public order to avoid fragmentation and disproportionate requirements.

  • Align existing EU legislation closely with CADA to prevent overlapping obligations and unnecessary barriers.

    Finally, existing EU legislation should be closely aligned with CADA to ensure that businesses are not faced with overlapping obligations, increased complexity, or unnecessary barriers to innovation, investment and access to technology.

• Micro company, GBR Company, GBR model reads as: wants changes source
  • Include hardware within the scope of the annex rather than excluding the hardware substrate from criteria.

    Excluding the hardware substrate from criteria builds an "AI Continent" on unpoliced silicon.

  • Embed Veritas Core PCIe hardware interposers into Level 3 and 4 cloud server architectures to establish a gatekeeper beneath OS and hypervisor layers.

    By embedding Veritas Core PCIe hardware interposers into Level 3 and 4 cloud server architectures, the EU establishes a gatekeeper beneath OS and hypervisor layers.

  • Implement substrate-level cryptographic gating and mutual hardware authentication on the federation's sharing platforms.

    By implementing substrate-level cryptographic gating and mutual hardware authentication on the federation's sharing platforms, Veritas Core ensures workloads are segregated at the bare-metal level, guaranteeing data confidentiality across the compute continuum.

• Micro company, DEU Business association, DEU model reads as: wants changes source
  • Require any product storing user data to ship a complete, royalty-free format specification with a reference implementation.

    Any product storing user data must ship a complete, royalty-free format specification with a reference implementation.

  • Ensure trust-critical storage and code in the data path are auditable and buildable from open specs by EU manufacturers.

    Trust-critical storage must be buildable from open specs by EU manufacturers the procurement norm that once forced Intel to license the 8086.

• Micro company, EST Academic or research institution, EST model reads as: wants changes source
  • Require attestable runtime identity for AI workloads on supported infrastructure.

    1. Require attestable runtime identity for AI workloads on supported infrastructure.

  • Make delegated authority expressible and checkable through existing Union rails.

    2. Make delegated authority expressible and checkable through existing Union rails.

  • Require portability of action-evidence, not only of data and services.

    3. Require portability of action-evidence, not only of data and services.

• German Banking Industry Committee (GBIC) Business association, DEU; register: Non-governmental organisations, platforms and networks and similar model reads as: wants changes source
  • Ensure the regulation is technology-open, risk-based, and coherent with existing financial sector regulation.

    For the banking sector, it is essential that CADA be designed in a technology-open, risk-based manner and remain coherent with existing financial sector regulation.

  • Include an explicit precedence rule in favour of the DORA framework to avoid a parallel compliance layer.

    An explicit precedence rule in favour of the DORA framework is required.

  • Exclude banks from the scope of the sovereignty framework provisions under Title IV to prevent restricting technology and provider choice.

    Including banks within the scope of such provisions would restrict technology and provider choice, increase costs and weaken innovation without necessarily creating a corresponding or meaningful resilience benefit.

• GDV- the German Insurance Association Business association, DEU; register: Trade and business associations model reads as: wants changes source
  • Clarify that CADA is without prejudice to DORA and creates no additional ICT risk or outsourcing obligations for insurers.

    CADA is without prejudice to DORA and does not create additional ICT risk management, outsourcing, contractual, reporting, testing or supervisory obli gations for insurance and reinsurance undertakings.

  • Ensure Article 31 remains voluntary for all private entities and does not apply to financial entities subject to DORA.

    Article 31 should remain voluntary for all private entities and should not apply to financial entities subject to DORA unless expressly chosen by the entity for internal risk management purposes.

  • Prevent CADA from resulting in forced migration or mandatory EU-only cloud use where insurers comply with DORA.

    CADA should not result in forced migration, mandatory EU-only cloud use or de facto restrictions on the use of global cloud providers where insurers can demonstrate compliance with DORA.

• Micro company, AUT Academic or research institution, AUT model reads as: wants changes source
  • Distinguish between physical data-centre capacity located in Europe and the actual AI capabilities that European entities can access and use.

    However, it should distinguish between data-centre capacity located in Europe and AI capabilities that European governments, firms and researchers can reliably access and use.

  • Monitor ordinary data-centre capacity, accelerator-dense AI infrastructure, and advanced compute contractually accessible to European users separately from one another.

    CADA should separately monitor ordinary data-centre capacity, accelerator-dense AI infrastructure and, where feasible, advanced compute contractually accessible to European users.

  • Ensure that projects receiving public support provide tangible European benefits such as guaranteed capacity for European customers during scarcity.

    Projects receiving public financing, accelerated procedures or exceptional infrastructure support should provide tangible European benefits where appropriate, including guaranteed capacity for European customers, access during scarcity, support for critical public functions and research, interoperability, and transparency about outages and capacity allocation.

• Tenstorrent Business association, USA model reads as: wants changes source
  • Ensure that implementing rules explicitly state that fabless engineering, EDA licenses, IP, software, verification, and tape-outs are eligible for funding.

    For the Act's recognition of design to carry through into funding, the implementing rules should state explicitly that this kind of spending is eligible, across the Design Platform, the Chips Fund, Grand Challenges and Strategic Projects, and projects should be assessed on the capability they create in Europe rather than on physical assets.

  • Support RISC-V and other open, interoperable architectures through the Design Platform and future Chips JU calls.

    Support RISC-V and other open, interoperable architectures through the Design Platform and future Chips JU calls.

  • Expand demand-side measures in Articles 8 to 10 to cover systems and include fabless companies, IP providers, and software companies in co-design.

    Articles 8 to 10 should cover systems, not only chips, and should bring fabless companies, IP providers and software companies into co-design alongside manufacturers.

• Cassandra Foundation Company, GBR model reads as: wants changes source
  • Clarify the scope of recognition and ensure public repository entries clearly identify the precise service, configuration, and assurance level covered.

    1. Make the scope of recognition unambiguous. Articles 2022 provide for audits, evidence and a public repository. Each repository entry should identify the precise service and configuration covered, assurance level, assessment date, relevant exclusions and current status.

  • Operationalise material-change notification with clear guidance on examples, recipients, and risk-sensitive response times.

    2. Operationalise material-change notification. Article 23 already requires notification and reassessment where information or changed circumstances may affect recognition. Guidance should define examples, responsible recipients and risk-sensitive response times.

  • Require proportionate evidence of recoverability and exit testing for business continuity and migration.

    3. Test continuity before migration becomes urgent. Article 29 addresses disruption, migration and consideration of multi-cloud strategies. Its methodology should require proportionate evidence of recoverability and exit: representative restoration and export tests, dependencies, responsible owners, acceptance criteria and fallback arrangements.

• Arq Foundation NGO, BEL; register: Think tanks and research institutions model reads as: wants changes source
  • Ensure Acceleration Zones deliver fast power access alongside fast permits, including grid connections and on-site generation.

    Make Acceleration Zones deliver fast power in addition to fast permits.

  • Incorporate AI model capability as a criterion in the sovereignty framework risk assessments and exceptions.

    We suggest that capability should be added as a criterion in the risk assessments, as well as an exception from the assurance levels for mission-critical activities when choosing providers.

  • Streamline sovereignty audits by allowing a Union-wide validity based on a single evaluation to avoid multi-state reviews.

    We suggest giving the home member state the option to delegate audit evaluation to a dedicated Commission unit whose decision would carry Union-wide validity, removing the 26-state review round and saving administrative capacities of member states.

• Micro company, IRL NGO, IRL model reads as: wants changes source
  • Provide practical assistance for smaller organisations and SMEs regarding project development, computing access, data integration, testing, skills and partnerships.

    Centres for AI should therefore provide practical assistance with: * project development; * access to computing resources; * data integration; * AI testing and experimentation; * technical partnerships; * skills and training; * and access to European research and technology providers.

• Deutsche Sozialversicherung Europavertretung NGO, DEU; register: Other organisations, public or mixed entities model reads as: wants changes source
  • Ensure that cloud sovereignty requirements are risk-based, practical, and preserve market competition.

    The envisaged cloud sovereignty requirements should be risk-based and practical. Particularly for critical infrastructure and sensitive data, high security, control and data location requirements are understandable. At the same time, competition, market availability and the possibility of multi-provider strategies should be preserved.

    machine translation by the Commission, original in DE
  • Provide appropriate transitional periods and grandfathering arrangements for existing IT structures, including in-house data centres.

    Appropriate transitional periods and grandfathering arrangements should be provided for existing IT structures. This applies in particular to secure and functioning in-house data centres, which should not be excluded by new requirements.

    machine translation by the Commission, original in DE
  • Ensure close alignment with existing legal acts such as the AI Act, Data Act, GDPR, and NIS2 to avoid double regulation.

    In addition, CADA should be closely linked to existing legal acts such as AI Act, Data Act, GDPR and NIS2 to avoid double regulation and conflicting requirements.

    machine translation by the Commission, original in DE
• Micro company, ITA Business association, ITA model reads as: wants changes source
  • Explicitly recognise micro, small and medium-sized publishing enterprises among the entities that can access European cloud and AI infrastructures under effective conditions.

    The USPI therefore considers it necessary for future European legislation to explicitly recognise publishing and information companies, with a particular focus on micro, small and medium-sized enterprises, among the entities that must be able to access European cloud and artificial intelligence infrastructures under effective and sustainable conditions.

    machine translation by the Commission, original in IT
  • Provide facilitated access to computing infrastructure, AI Factories and cloud services supported by European programmes, including dedicated SME instruments.

    In particular, USPI calls for forms of facilitated access to computing infrastructure, AI Factories and cloud services supported by European programmes, including through instruments dedicated to SMEs

    machine translation by the Commission, original in IT
  • Ensure interoperability, data portability and provider switching to avoid vendor lock-in phenomena.

    interoperability, data portability and the effective possibility of switching providers should be ensured, avoiding vendor lock-in phenomena that are particularly detrimental to smaller companies.

    machine translation by the Commission, original in IT
• Micro company, SGP Business association, SGP model reads as: wants changes source
  • Mandate architectural decoupling by separating semantic generation from an independent, deterministic causal audit engine acting as a security sidecar.

    Architectural Decoupling Mandate the strict separation of semantic generation (front-end model) and cognitive auditing (back-end core).

  • Implement a native Responsibility Anchor system within cloud AI infrastructures requiring unalterable cryptographic tags for high-risk state updates.

    Minimal Decision Accountability Implement a native Responsibility Anchor system within cloud AI infrastructures.

  • Map compliance logic directly onto sovereign cloud hardware using Processing-In-Memory architectures to solidify audit rules into immutable hardware execution cycles.

    Physical Substrate Compliance Map compliance logic directly onto sovereign cloud hardware via Processing-In-Memory (PIM) architectures.

• DigitalTrade4.EU Other, EST; register: Other organisations, public or mixed entities model reads as: wants changes source
  • Support cross-border demonstrators connecting existing systems through brownfield interoperability instead of requiring wholesale data or infrastructure migration.

    We recommend that the Cloud and AI Leadership Initiatives support cross-border demonstrators connecting existing systems through brownfield interoperability rather than requiring wholesale data or infrastructure migration.

  • Ensure AI outputs act as derived analytical evidence rather than replacing authoritative records or regulated decisions.

    AI outputs should remain derived analytical evidence rather than replacing authoritative records or regulated decisions.

  • Expand funding instruments like Horizon Europe and the Digital Europe Programme to support these demonstrators and their progression toward scalable deployment.

    Horizon Europe, the Digital Europe Programme and subsequent EU funding instruments should support these demonstrators and their progression towards scalable deployment.

• House of the Dutch Provinces Public authority, NLD model reads as: wants changes source
  • Strengthen European digital autonomy and sovereignty.

    Dutch local and regional authorities are strong advocates of the introduction of new European legislation that would significantly strengthen the digital autonomy and sovereignty of the European Union and its entities.

  • Address concerns regarding specific elements in the current proposal.

    Dutch municipalities and provinces welcome several aspects of the proposed Cloud and AI Development Act (CADA), but also have concerns regarding a number of elements in the current proposal

• Information Technology Industry Council (ITI) Business association, USA; register: Trade and business associations model reads as: wants changes source
  • Ensure that trust is assessed through objective, risk-based criteria rather than ownership structure or headquarters location.

    Trust should be assessed through objective, risk-based criteria rather than reduced to a providers ownership structure or headquarters location.

  • Apply trusted-vendor principles based on governance and risk management across the ICT supply chain.

    Applying these trusted-vendor principles across the ICT supply chain would support secure technology ecosystems while strengthening supplier due diligence and the proportionate management of subcontractor risks.

• Micro company, SGP Company, SGP model reads as: wants changes source
  • Recognise that sovereign verification and session continuity can be decoupled architecturally in relation to AI 1.5.

    AI 1.5: Recognise that sovereign verification and session continuity can be decoupled architecturally; regulatory outcomes should not penalise compliant operators.

  • Ensure the regulatory framework leaves room for decentralised federation-based interworking protocols for AI 1.13.

    AI 1.13: Leave room for decentralised federation-based interworking protocols.

  • Commission or encourage a CEPT study on voluntary, cryptographically verifiable interference attribution.

    Interference: Commission or encourage a CEPT study on voluntary, cryptographically verifiable interference attribution, referencing open-source implementations such as GFSIP/1.0.

• NOHN AI technology PTE LTD Company, SGP model reads as: wants changes source
  • Recognise that sovereign verification and session continuity can be decoupled architecturally in relation to AI 1.5.

    1. AI 1.5: Recognise that sovereign verification and session continuity can be decoupled architecturally; regulatory outcomes should not penalise compliant operators.

  • Leave room for decentralised federation-based interworking protocols in relation to AI 1.13.

    2. AI 1.13: Leave room for decentralised federation-based interworking protocols.

  • Commission or encourage a CEPT study on voluntary, cryptographically verifiable interference attribution.

    3. Interference: Commission or encourage a CEPT study on voluntary, cryptographically verifiable interference attribution, referencing open-source implementations such as GFSIP/1.0.

• Adigital (Asociación Española de la Economía Digital) Business association, ESP; register: Trade and business associations model reads as: supports source