CADA introduces legal assurance levels: Beltug sounding board

In April 2026, Beltug and its sister associations Cigref (France), CIO Platform (Netherlands) and VOICE (Germany) published a joint position on the Cloud and AI Development Act (CADA), followed in June by a reply to the European Commission identifying the core cloud services. The Commission has published the legislative proposal on 3 June 2026; we want to gather members’ views and define our talking points for engaging with different EC stakeholders, particularly regarding CADA’s four EU-wide (‘Union’) assurance levels.

In the proposal, public procurement of cloud services is linked to four Union Assurance Levels. These are sovereignty and security levels that contracting authorities must require depending on the sensitivity of the workload. The assurance level indicates the degree of protection a cloud service offers against non-European legislation with extraterritorial reach. Providers seeking the higher assurance levels would be required to undergo independent third-party audits rather than relying solely on self-declarations.

Some of the possible areas for concern include:

• Harmonisation: Companies and public bodies need a harmonised approach for all Member States
• Alignment with CSA 2: The Cloud Security Act 2 introduces three technical protection levels, while CADA establishes four legal assurance levels. Organisations should not have to navigate separate technical and legal certification schemes. The two frameworks should complement each other, allowing organisations to combine the level of technical cyber security protection and legal sovereignty that best matches their own risk assessments

The Beltug users-only sounding board will give us the opportunity to listen to our members’ questions, concerns and insights, so that we can work to ensure the voice of the business user is heard at all levels. Interested in participating in the 6 August kick-off? Send us an email here.