Which sovereignty level do you actually need? Preparing for CADA's four assurance levels
Sweden has now had its say on the EU's proposed Cloud and AI Development Act (CADA). More than 70 consultation responses have come in, and Computer Sweden's editor-in-chief summed them up in one line: everyone wants sovereignty, few want to pay the price.
That is an honest description of where many organisations stand. But it also hides a more practical question, and one that can be answered long before the regulation is final: which assurance level does each of your workloads actually need?
Four levels, not one switch
CADA, proposed by the Commission on 3 June 2026, does not treat sovereignty as a yes-or-no property. It introduces four cumulative Union Assurance Levels:
- Level 1 – the provider is established in the EU, customer data (including metadata and telemetry) stays in the EU, and subcontractors are disclosed. Self-assessment is enough.
- Level 2 – infrastructure, personnel and technical support are in the EU, a software bill of materials is available, and data may not be used to train third-country AI systems. Providers controlled from outside the EU may qualify if they can show effective separation.
- Level 3 – neither the provider nor its subcontractors may be controlled by a third country, and staff must be EU citizens, unless the Commission grants an exception for a specific country.
- Level 4 – adds high-assurance certification and evidence that no third country has effective control over how the software is developed and maintained.
Level 1 can be self-assessed. Levels 2–4 require an independent audit and recognition by a national authority, and recognised services are listed in a central EU register.
Under the proposal, public contracting authorities must buy at least Level 1. Activities that serve public order in NIS2 sectors – which include healthcare – and areas such as defence, justice and internal security would be limited to Levels 2–4. Through Article 31, the Commission could also, by delegated act, require operators in highly critical sectors to carry out similar assessments.
What the Swedish responses tell us
Reading across the consultation, the positions are predictable but useful:
- Municipalities worry about forced system changes, pointing to a 12-month window to migrate once a risk assessment requires it, and to a shortage of realistic European alternatives.
- Government agencies ask who decides the classification, and who pays for migrations.
- Security agencies want exemptions; FRA questions whether European providers can deliver equivalent capacity in the near term.
- Industry, represented by the Confederation of Swedish Enterprise, asks for risk-based thresholds so that public bodies do not default to higher levels than their data and activities require.
Interestingly, these concerns point in the same direction. Nobody wants to pay for Level 4 where Level 1 would do. And nobody wants to discover, with twelve months to go, that a critical system cannot move at all.
Classification is the cheap part – do it now
The regulation is still a proposal. The Commission's own impact assessment expects negotiations to run to the end of 2027 and the rules to apply around 2029. Levels, deadlines and exemptions may change. But the work that makes any outcome manageable does not depend on the final text:
- Inventory your workloads and data flows. Include metadata, logs, telemetry, backups and support access – they count under Level 1 already.
- Assign a provisional level per workload, based on risk. A public website, a booking system and a patient record integration do not need the same answer. Document why.
- Map the supply chain behind each service – the whole stack, not just the hosting. Identity provider, monitoring, CI/CD, backups and SaaS dependencies all count. A Swedish reseller on top of a non-EU hyperscaler is a different case from a European-owned platform. Know which one you have.
- Identify the systems you could not move in twelve months. These are usually the ones with proprietary managed services, hard-wired identity or integrations nobody has documented.
- Start producing software bills of materials (SBOMs). Level 2 and above expect one, and generating them in the build pipeline is far cheaper than reconstructing them for an audit.
- Make portability a design requirement for everything new. Containers and Kubernetes as a common runtime, infrastructure as code, and open standards for identity and messaging keep your options open whatever level ends up applying.
Sovereignty as a decision, not a debate
The Computer Sweden column ends with a fair challenge: are we serious about digital sovereignty, or do we only want it as long as nothing has to change?
We think the answer lies in being specific. A classified workload with a documented level and a tested exit path is a decision. "We should probably look at sovereignty" is a debate. Organisations that do the classification now will be able to spend money where the risk is – and avoid spending it where it is not.
If you want a second pair of eyes on how your workloads map to the four levels, we are happy to talk.