Position Paper: Why the Cloud and AI Development Act Needs Trust, Governance and Interoperability

Gaia-X Position Paper on the European Commission’s Cloud and AI Development Act The publication of the proposed Cloud and AI Development Act (CADA) represents an important step in strengthening Europe’s digital competitiveness, technological resilience and capacity to develop and deploy artificial intelligence at scale. Organisations must be able to discover data and services, verify the characteristics of digital assets, establish trust with partners, demonstrate compliance with applicable rules and exchange information securely while maintaining control over their assets. They determine whether a doctor in Warsaw can securely access relevant medical information from a hospital in Lyon, whether a small manufacturer in Bavaria can share production data with a logistics partner in Rotterdam without losing control of its intellectual property, or whether public administrations can collaborate across borders while respecting legal and regulatory requirements. One of the most significant aspects of the Cloud and AI Development Act is the introduction of a common European sovereignty framework for cloud services, with four assurance levels providing a harmonised approach to trusted cloud procurement and deployment. CISPE has committed to deliver up to 3,000 European cloud infrastructure services compliant with Gaia-X Trust Framework and Label specifications, demonstrating that the Label scheme is moving from framework design to market deployment. Across multiple sectors, Gaia-X principles are being applied in the Mobility Data Space for trusted cross-border mobility data exchange, in Health-X for healthcare data sharing across European health systems, in Agri-Gaia for AI-enabled agricultural data sharing, and through STRUCTURA-X, a consortium of European cloud and infrastructure providers building Gaia-X-compliant federated cloud services.