Why proposed EU cloud rules must account for NATO compatibility

Defence cloud procurement must connect sovereignty with operational requirements

A defence cloud can meet stricter European sovereignty requirements and still leave questions about its ability to support a coalition operation. European defence officials from several EU countries, including eastern and Nordic member states, are challenging parts of the proposed Cloud and AI Development Act, according to the Financial Times. They worry that restrictions affecting Amazon, Microsoft, and Google could limit access to cloud and AI capabilities or complicate interoperability, the ability of systems to work together, with NATO systems.

These objections bring several security requirements into the same purchasing decision: control over data and services, continuity of access, and operation across allied systems. The proposal remains under consideration by member states and EU institutions and has not entered into force, so the officials are raising risks to future operations. Procurement teams must establish which services can meet these requirements together. To do that, they must examine each service’s legal, operational, and technical arrangements without assuming that US suppliers are indispensable or that European sovereignty and NATO compatibility are incompatible.

CADA would link public-sector activities to cloud assurance levels

The proposed rules would formalise part of that assessment. The European Commission proposed the Cloud and AI Development Act, or CADA, in June to address data-centre capacity, public-sector cloud purchasing, and dependence on non-European cloud and AI suppliers. Its procurement provisions would introduce a four-level framework for assessing cloud sovereignty across EU institutions and public-sector organisations, with higher assurance levels imposing stricter requirements on a service.

The requirements would examine several ways an organisation or government could control or influence a cloud service. Infrastructure location would be assessed alongside operational control, ownership, software supply chains, and exposure to third-country jurisdictions. Buyers would therefore need to establish who can operate or influence the service and which legal systems can affect it. Hosting infrastructure within the EU would satisfy one part of that examination.

To determine where heightened requirements apply, Article 29 would require member states and EU entities to assess cloud-using public-sector activities that contribute to preserving public order. These include national security, defence, internal security, border management, justice, and law enforcement. The assessment would connect the public function served by a workload, the applications and data running on a cloud service, to the procurement requirements governing it.

For activities identified through that process, Article 30 would establish how the required cloud assurance levels are recognised. These activities would have to use services recognised at Levels 2, 3, or 4. Procurement would therefore involve two linked judgments: identifying the activity’s risk and selecting a service with the required recognition. A supplier’s general description of its cloud as sovereign would remain distinct from recognition under this system.

CADA would also permit exceptions where compliant services are unavailable, a procurement process produces no suitable offers, or other conditions specified in the regulation apply. These provisions make its effect more conditional than a blanket prohibition on US providers. An exception could permit a purchase, but buyers would still need to establish whether the service can support the intended defence activity.

The Commission is addressing legal exposure and supplier dependence

The Commission’s case for these controls begins with a concentrated supplier market. Its CADA impact assessment estimates that AWS, Microsoft, and Google together account for around 70% of Europe’s cloud infrastructure services market. European providers’ combined share fell from 29% in 2017 to 15% in 2022 and has remained around that level, according to the assessment. The figures describe dependence across the broader European cloud market.

The Commission links that dependence to the risk that decisions outside European control could affect public services. Its assessment identifies reliance on non-European suppliers, exposure to third-country laws, and possible service disruption as problems CADA is intended to address. For sensitive activities, continued access to computing and control over data are security requirements, so technical capability must be assessed alongside the legal and organisational conditions under which a service operates.

These conditions also explain the Commission’s warning that sovereignty-branded offerings from non-European providers may remain exposed to third-country laws governing data access or policies affecting service continuity. Infrastructure location cannot resolve every question about who can compel access or affect operations. While the market-share figures establish the wider dependence problem, the requirements of a particular military workload depend on the operations it must support.

NATO requires cloud services to work across allied systems

For military operations, a workload may depend on systems run by several countries and organisations. NATO’s January 2026 Alliance Digital Strategy calls for a federated cloud model, in which participating networks share services and resources across organisational boundaries. The European Defence Fund’s 2026 programme also includes NATO interoperability requirements alongside European sovereignty objectives. Both policies make cross-system cooperation part of defence procurement, although they set different requirements.

NATO’s model combines several technical conditions. It must support multiple security classifications, expand as demand changes, use a hybrid architecture combining cloud and other computing environments, and integrate tactical edge computing, which processes data close to operational users and equipment. Buyers therefore need to examine how a service will work within this wider arrangement. Approval for use in one environment establishes only part of its operational suitability.

Participation also carries formal obligations. The Alliance Digital Strategy makes its interoperability framework mandatory for countries joining the federated networks used for NATO-led operations. NATO’s infrastructure objectives call for international standards and NATO-agreed reference architectures, which provide common designs for participating systems. Compatibility can therefore determine whether a national cloud-based capability can join the shared operational environment.

Connections within that environment must support demanding operating conditions. NATO calls for resilience, high bandwidth, and low latency: connections must withstand disruption, carry substantial volumes of data, and respond with little delay. These requirements apply to mission-critical operations, including degraded, contested, and denied environments where connectivity may be impaired or unavailable. Procurement must therefore examine how the service behaves as communications deteriorate.

That examination extends to what organisations can share through the network. NATO specifies data, digital services, and computing resources, making interoperability a question of shared capabilities as well as information exchange. Its Digital Transformation Implementation Strategy describes the wider Digital Backbone as a federation of networks and systems delivering cloud and edge services across organisational, national, operational, and security boundaries. A purchase within one organisation must consequently account for services and connections beyond it.

Defence systems must recover while preserving usable data

The European Defence Fund, or EDF, gives these operational concerns a separate European policy basis. Its 2026 programme allocated an indicative €40 million to military multi-domain operations cloud services covering land, air, maritime, cyber, and space operations. Supporting these domains places cloud services within a broad operational system. The programme’s technical requirements address how that system should organise itself and keep functioning as conditions change.

To sustain that system, the EDF requires military cloud infrastructure and associated networks to self-form and self-heal: they must establish working connections and recover from faults. They must also degrade gracefully, retaining useful operation as capabilities are reduced. Redundancy must provide alternative components or connections so operations can continue when one fails. Procurement must therefore assess how the design behaves during failure.

Recovery must also preserve consistent data across participating operations. A restored service containing conflicting data could undermine the work it supports, so the EDF requires recovery mechanisms that maintain data consistency. It also requires failover capabilities, which move affected operations to an alternative when communications are disrupted. Buyers therefore need assurance about the recovered system’s data and usable capabilities as well as its availability.

To connect those capabilities across organisations, the programme identifies specific interoperability arrangements for designers to consider. They include NATO-agreed interfaces and processes; NATO Architecture Framework requirements for describing systems; Standardization Agreements, known as STANAGs; and Federated Mission Networking specifications for participating mission networks. These give engineers and procurement teams concrete rules against which to examine a service. They also give the officials’ concern about NATO compatibility a technical basis beyond familiarity with an existing supplier.

The EDF places these requirements alongside objectives for European military and technological sovereignty. It also supports EU contributions to NATO initiatives covering technical and procedural interoperability, so European defence policy explicitly seeks sovereignty and coalition compatibility together. Procurement must determine which services and arrangements can deliver both under the expected operating conditions.

NATO is putting a shared cloud operating model into practice

NATO’s deployment activity shows the scale at which it is pursuing this shared model. In July, the NATO Communications and Information Agency, or NCIA, awarded Accenture an approximately €200 million contract for the Protected Business Network programme. NCIA says the programme will establish a common cloud operating model for classified digital operations across NATO. The contract turns that architectural objective into a substantial delivery commitment.

Under the contract, Accenture is scheduled to design the core platform, implement it, and then operate it within a multi-cloud environment, one using multiple cloud services, supplied by NCIA. The programme is intended to support about 29,000 users between 2026 and 2033. It is a concrete example of classified operations being organised around a shared cloud environment, showing the operational setting in which future procurement rules would apply.

European cloud offerings provide different forms of control

Suppliers are responding to demand for European control with offerings that buyers must examine against these legal and operational requirements. AWS, Microsoft, and Google Cloud sell such services and benefit commercially when buyers accept their approaches as suitable. Their descriptions explain the controls each company offers; recognition at a proposed CADA assurance level would be a separate determination.

AWS made its European Sovereign Cloud generally available in January 2026, with its first region in Brandenburg, Germany. AWS says the environment is physically and logically separate from its existing regions, uses infrastructure inside the EU, and is designed to keep operating if connectivity to infrastructure outside the bloc is interrupted. The design addresses a specific continuity scenario for buyers concerned about external connectivity.

Other suppliers describe controls focused on different parts of service delivery. Microsoft’s Sovereign Public Cloud includes Data Guardian oversight for remote administrative access, according to Microsoft. Google Cloud offers sovereign configurations through European partners, including S3NS in France and T-Systems in Germany. Buyers need to examine these controls over administration and operations alongside the ownership and jurisdictional conditions that CADA would also assess.

These product descriptions and the Commission’s concerns address different aspects of the same purchase. AWS describes infrastructure location, separation, and continuity design, while the Commission warns about laws and policies that may affect data access or continued service. A buyer must examine how both apply to the proposed arrangement. Operational separation can address a continuity risk while leaving a separate legal question to assess.

The Commission’s procurement uses mixed supplier arrangements

The Commission’s own purchasing shows how those arrangements can combine several suppliers. In April, it awarded framework contracts allowing EU institutions and agencies to purchase up to €180 million in sovereign cloud services over six years. The frameworks apply sovereignty criteria outside CADA, demonstrating an existing procurement approach with a different assessment system from the proposed legislation.

The awards went to Post Telecom with CleverCloud and OVHcloud; STACKIT; Scaleway; and Proximus with partners including S3NS, Clarence, and Mistral. Because the awards include both individual providers and multi-company arrangements, buyers need to understand how responsibility is divided within each service. The organisations delivering infrastructure, administration, and other capabilities can each affect the resulting control.

To assess that control, the Commission used its Cloud Sovereignty Framework. Its categories cover strategic, legal, operational, supply-chain, technological, security, environmental, and EU-law requirements. This framework is separate from CADA’s proposed four-level system, so participation in the awarded contracts carries a specific procurement meaning. Recognition under the proposed legislation would require its own determination.

S3NS illustrates why the structure of the supplied service matters. It is a joint venture between Thales and Google Cloud and participates in the Proximus consortium, bringing a US cloud company into a sovereignty-focused procurement through a European venture. Assessing that arrangement requires examining the resulting legal, operational, and technical controls. Those controls depend on the responsibilities and powers of the participating organisations, which a nationality label alone cannot describe.

The bottom line

Defence cloud procurement must establish both who controls a service and whether it can support the operations that depend on it. European sovereignty requirements address legal exposure and supplier dependence. NATO interoperability requirements address participation in shared operational systems. Neither assessment can substitute for the other.

For decision-makers, this means setting requirements before selecting suppliers. Procurement teams need evidence of operational control, jurisdictional exposure, recovery capabilities, and compatibility with allied systems. Where several companies deliver a service, contracts must make their responsibilities clear, including who can administer the infrastructure and how operations continue during disruption.

CADA remains under consideration, but these questions already affect purchasing decisions. Leaders should bring legal, security, procurement, and operational teams into the same assessment. The objective is a service whose controls can be verified and whose capabilities remain usable when communications fail or coalition operations place new demands on it.