The Cloud and AI Development Act landed May 27, and the sovereign cloud definition has the teeth the draft promised. US hyperscalers cannot qualify for the Sovereign certification tier, regardless of where their servers sit, because CLOUD Act obligations follow US corporate incorporation. CADA is not yet law, but the risks it formalises are already live under the AI Act.
Policy & Regulation
CADA: the sovereign cloud definition has teeth
The Tech Sovereignty Package arrived on schedule May 27. CADA requires EU-incorporated infrastructure for AI Act Annex III high-risk systems, sets a target to triple EU datacenter capacity by 2030, and creates a Sovereign certification tier under ENISA's cloud security scheme.
The Sovereign tier requires EU incorporation of the cloud provider and all direct subprocessors, no parent company subject to non-EU government orders, and annual notified-body certification. US hyperscalers operating EU data centres do not qualify. CLOUD Act obligations follow corporate incorporation, not the physical location of servers.
CADA goes through ordinary legislative procedure; Q4 2027 is the earliest it binds anyone.
The migration logic doesn't wait for that. AI Act Article 9 already treats CLOUD Act exposure as a foreseeable legal risk for Annex III systems; CADA would harden that from a compliance recommendation into a conformity assessment failure. (European Parliament Legislative Train) (sota.io)
AI-generated content watermarking: final code due this week
The Commission published the second draft Code of Practice on marking and labelling AI-generated content in late May. Finalisation targets early June, ten weeks before Article 50 transparency rules become enforceable on August 2.
The mandatory baseline is digitally signed metadata identifying AI-generated or AI-manipulated content. A second layer of imperceptible watermarking is required for image, audio, and video outputs.
Providers deploying generative AI for image or video production need to be compliant by August 2. The code, finalising this week, is where to find the specifics. (European Commission)
GPAI enforcement powers: 60 days
August 2 is also when the Commission's enforcement powers over general-purpose AI model providers come into effect. The AI Office can then request documentation, conduct evaluations, impose fines up to 3% of global annual turnover, and require model withdrawal from the EU market.
Providers who placed GPAI models on the market before August 2025 have an adjustment period until August 2027. Anything deployed after that date must comply now. (EU AI Act) (European Commission)
Germany advances Platform Work Directive transposition
Germany's Federal Ministry of Labour and Social Affairs has joined the European Commission's expert group on Platform Work Directive implementation. It is examining whether the employment presumption should extend to subcontractors of digital labour platforms, which would significantly expand the directive's reach beyond delivery drivers and ride-hailing.
No formal draft has been tabled yet. Six months remain before the December 2 deadline.
The expert group engagement is substantive, not performative. Germany tends to transpose late but correctly; that pattern suggests a tight finish before December. (DLA Piper GENIE)
Capital & Investment
Czech Republic and Poland combine AI Gigafactory bids
Prague and Warsaw are merging their EuroHPC JU applications into a joint AI Gigafactory bid to serve Central and Eastern Europe. The Czech component alone carries a budget exceeding 90 billion Czech crowns (roughly €3.6 billion), with approximately one third covered by EU and state subsidies.
Both countries have established joint working teams; final submission targets this month. If approved, it would be the first AI Gigafactory spanning two EU member states and the largest public AI infrastructure project in the CEE region. (MPO Czech Republic) (Telecompaper)
EUDIS Cohort 2 closes, autumn programme begins September
Applications for Cohort 2 of the EUDIS Business Accelerator closed May 30. Twenty startups will be selected for an eight-month programme starting September 2026, each receiving a €120,000 seed funding voucher with €50,000 available to the top three teams.
The 2026 EUDIS Work Programme allocates €231 million across tracks, including the €115 million AGILE instrument for disruptive dual-use technologies. EDF research funding, SAFE procurement loans, and EUDIS acceleration now run in parallel. Three years ago, none of this infrastructure existed. (EU Defence Innovation Scheme) (European Commission)
EIC deploys STEP Scale Up equity into eight companies
The European Innovation Council confirmed eight deeptech companies have received direct equity investments under the STEP Scale Up scheme, with tickets from €10 to €30 million. The 2026 STEP programme carries a €300 million budget targeting the mid-stage gap that European deeptech companies routinely can't fill at home.
STEP Scale Up is a direct equity instrument, not a grant. The EIC is now taking equity stakes at Series B ticket sizes. That's new. (EIC)
Work & Society
Finland operationalises first Nordic AI supervisory authority
Finland became the first Nordic country to activate its national AI Act supervisory authority on January 1, 2026. Traficom leads most AI Act supervision; the Data Protection Ombudsman handles AI in law enforcement and judicial contexts.
Finnish businesses deploying high-risk AI systems can now seek formal supervisory guidance ahead of the August 2 enforcement date. No other Nordic state is there yet. For companies operating across borders, the gap in available guidance is already real. (Finnish Government)
One to Watch
August 2: two deadlines, one date
Two enforcement events land on August 2. GPAI enforcement powers activate, enabling the AI Office to fine model providers up to 3% of global turnover. Separately, Article 50 watermarking and transparency obligations for AI-generated content become enforceable for providers and deployers of generative AI producing image, audio, or video at scale.
These are not the same obligation or the same regulated entity, but many companies straddle both; ten weeks remain. The watermarking Code of Practice, finalising this week, is the near-term document to read first. (AI Act Implementation Timeline) (European Commission)