The Criteria enabling Cloud Computing Autonomy (C3A) published by the BSI in April 2026 and the draft “Cloud and AI Development Act” (CADA) of the EU Commission aim to increase digital sovereignty in the European single market. The implementation of the CADA is not expected before 2028. However, the signal is already clear: Some public clouds, the use of which is contrary to Europe’s digital sovereignty, will no longer be used in key areas of the EU single market when taking a risk-based approach to key workloads.
Until the full CADA implementation, the C3A of the BSI create transparency and orientation in the selection of cloud services. The criteria are based on a cloud threat landscape formulated by the BSI and have been poured into the structure of the EU Cloud Sovereignty Framework (EU CSF). They enable the assessment of whether cloud offerings can be used in a self-determined manner in the respective risk context.
This session will highlight the challenge of digital sovereignty when using cloud services and explains how the C3A can contribute to an European solution.