Everyone wants digital sovereignty but no one wants to pay the price
This is a Swedish opinion column about the EU Commission's proposed Cloud and AI Development Act, known as CADA, and about how Swedish stakeholders have responded to it. The law is meant to strengthen Europe's sovereignty and reduce dependence on non-European cloud and AI services. A central element is common EU requirements on cloud sovereignty, set on a four-level scale, where European ownership could become decisive in public procurement. The proposal was presented in the summer and is now out for consultation in member states. Swedish responses from authorities and other stakeholders arrived in early October.
The column's reading of the more than 70 responses is that everyone supports digital sovereignty "but". The big US cloud providers say they welcome it, but define it as "sovereign cloud" solutions with local legal entities following local rules, so that technical boundaries matter more than country of origin. Business representatives want less dependence on the US but not higher costs, worse services or weaker competitiveness, and they ask for technology neutrality. Large authorities question who decides the classification and want control over their own affairs, without unfunded migrations. Municipalities, heavily reliant on foreign cloud services, fear costly system changes, and see the EU's 12-month deadline after a risk assessment requiring migration as unreasonably short. Several respondents note that real European alternatives do not currently exist.
Even the security-focused bodies, the Armed Forces, Säpo and FRA, want exemptions. FRA says the proposal assumes European alternatives that may not deliver comparable capacity, scalability and security soon, and that the rules would make some existing and planned intelligence activities, including certain international cooperation, impossible. The column sees a paradox: Sweden is so dependent on foreign technology that trying to reduce the dependence for security reasons could weaken security.
The author, editor-in-chief Marcus Jerräng, argues that the objections may all be reasonable, but if all are accepted little remains of the policy. He takes no side on the EU's specific design. His view is that if digital sovereignty is truly a strategic goal, tough political decisions are needed, and costs, disruption and degradation must be accepted. The question he poses is whether Europe is serious about sovereignty or wants it only as long as nothing has to change.