Sovereignty matters to Oracle. For almost 50 years, we have worked with governments and public-sector organizations across Europe to run their critical workloads and deliver essential services. Helping these customers realize the benefits of cloud and AI is central to our business: strengthening public services, supporting the people who deliver them, and improving citizens’ lives. We fully recognize our responsibility to help public authorities remain in control of their data and the services they depend on. Our role is to provide the capabilities and safeguards to exercise that control, supported by clear, practical evidence they can use to assess sovereignty.
CADA is an opportunity to harmonize sovereignty requirements across the EU
All of us here at Oracle welcome the European Commission’s proposed Cloud and AI Development Act (CADA). It is an important milestone in strengthening Europe’s digital resilience and harmonizing sovereignty requirements across the European Union (EU) through a common framework that reinforces EU control while preserving access to innovation and customer choice.
A workable sovereignty framework must support continued investment in cloud and AI capacity across Europe and enable public authorities to adopt these technologies securely and at scale. CADA should give public authorities in the EU confidence to move forward and create a more consistent and predictable environment for cloud providers operating and investing in Europe.
Building on what we deliver today
Sovereignty depends on legal, technical, and operational controls, including where data is stored and processed and how services are governed. Customers need to understand who can access their data, who makes operational decisions, and how the services they depend on are protected. These considerations shape Oracle’s approach to sovereign cloud and have been a foundation of our strategy.
Launched in 2023, Oracle EU Sovereign Cloud made Oracle the first hyperscaler to offer customers a sovereign public cloud dedicated to the EU. It serves both public- and private-sector organizations. Its data centers in Frankfurt and Madrid are physically and logically separate from Oracle’s commercial cloud regions, enabling customers to design disaster recovery arrangements that keep their data within the EU. EU Sovereign Cloud also comes with additional legal safeguards. The infrastructure is owned and services are operated by dedicated Oracle EU Sovereign Cloud legal entities incorporated in the EU, and cloud operations and support are delivered by EU residents located within the EU. These arrangements give customers a clear view of who operates their cloud, where support is delivered, and how access is governed.
For public authorities and regulated customers, sovereignty also extends to the business applications they rely on to manage essential public services. EU Sovereign Cloud already supports Oracle Fusion Cloud Applications, including those used for finance, public procurement, and workforce management, alongside sovereign AI workloads. This extends our sovereign cloud approach beyond infrastructure to the applications and data supporting the operations of public-sector and regulated customers.
Our private-label cloud platform provides another established foundation. Oracle Alloy enables trusted European partners to become cloud providers, delivering Oracle cloud services under their own brand from data centers they operate. Partners manage customer relationships, provide customer-facing support, and exercise control over service delivery, supported by Oracle’s technology and expertise. For European customers, this creates a path to combine European operational responsibility and accountability with access to advanced cloud and AI capabilities.
Our ambition for UAL-2 and UAL-3
CADA’s objectives align with our goal of giving European customers stronger EU control and independently assessed safeguards, alongside continued access to advanced cloud and AI capabilities.
The proposed CADA framework would introduce four Union Assurance Levels, from UAL-1 to UAL-4, to match cloud sovereignty requirements to the sensitivity and risks of public-sector workloads. Our ambition is to achieve UAL-2 through Oracle EU Sovereign Cloud and enable UAL-3 offerings through trusted EU partners using Oracle technology. These complementary paths would give EU public-sector customers deployment options suited to their workloads. This ambition also extends to Oracle SaaS applications supporting public-sector operations and essential services, with readiness assessed against the requirements applicable to each offering.
Achieving these ambitions will require further development, and we are committed to advancing that work for our customers. We are already assessing our governance structures and controls against CADA’s proposed assurance requirements. Our focus is on strengthening EU governance and operational control, safeguards for customer data, EU-based support, software assurance, and service continuity. Readiness will be assessed against CADA’s final requirements.
Making CADA practical and measurable
For CADA to find the right balance for public authorities while maintaining access to world-leading technology, we recommend a practical, outcome-based approach to the assurance levels.
- UAL-2 should establish operational sovereignty safeguards that strengthen customer control and service continuity while supporting broad public-sector adoption without unnecessarily prescriptive implementation rules. Overly rigid requirements risk restricting customer choice and delaying modernization without a corresponding improvement in sovereignty.
- UAL-3 should recognize demonstrably EU-controlled operating models, including trusted EU partners using international technology, where they deliver equivalent, auditable safeguards. Recognizing these models would give customers a wider choice of EU-controlled cloud and AI services and enable EU operators to invest, scale, and compete.
Public authorities need clear guidance on choosing the appropriate assurance level. Decisions should reflect the sensitivity and operational criticality of each workload and be supported by a transparent assessment of risk. This should help avoid unnecessary over-classification that restricts choice and delays modernization. The framework should account for the different responsibilities of infrastructure, platform, and application providers.
Mandatory sovereignty requirements should remain anchored in public procurement, while private organizations should retain the freedom to choose cloud operating models based on their risk assessments, legal obligations, and business needs.
Assessment and recognition should be rigorous, predictable, and consistent across the EU. Independent audit evidence should support recognition without duplicative national reassessments, with clear service boundaries and assessment timelines. Cloud and AI services develop quickly. Lengthy or overly prescriptive processes risk delaying adoption and leaving requirements outdated before they are widely implemented.
Enabling cloud and AI investments in Europe
By clarifying public procurement and digital sovereignty requirements, CADA can reduce uncertainty while unlocking investment across Europe. For public authorities, this should mean greater confidence to modernize essential services and a choice of qualified cloud and AI offerings suited to their workloads. Meaningful customer choice should be a measure of its success.
Oracle continues to invest in EU-operated sovereign cloud services and trusted European partner models. A proportionate, technically achievable framework is essential to turn that investment into greater capacity and choice for Europe’s public services. We look forward to working with European policymakers, customers, and partners to turn CADA’s ambitions into stronger EU control and better public services.