Walking the halls at MSP GLOBAL 2026 and one topic kept coming back, whether over coffee between sessions or over drinks once the agenda wrapped: data sovereignty. For European managed service providers, the talk rarely stayed abstract. Clients are asking where their data lives and who can reach it. Public sector tenders are tightening. And a new piece of EU legislation, the Cloud and AI Development Act (CADA), is about to define in measurable terms what “sovereign” actually means.
The mood was mixed. Some MSPs see a rare chance to win business from organisations rethinking their reliance on US hyperscalers. Others see another compliance layer arriving just as NIS2 beds in. Both have a point.
CADA in brief
CADA is the cloud strand of the European Commission’s EU Tech Sovereignty Package, alongside measures on chips, open source and energy. It has three aims: stimulate European cloud and AI innovation, expand data centre capacity (the Commission wants it at least tripled within five to seven years), and set a single EU-wide definition of cloud sovereignty.
That last aim matters most commercially. Three non-EU providers currently hold more than 70% of the European cloud market, which leaves a large share of European data subject to foreign access and transfer laws. CADA responds by making sovereignty a formal criterion whenever public bodies buy cloud services. The Act was adopted in June 2026 and is expected to enter into force by 2029.
Four levels of assurance, in plain terms
Rather than a simple pass or fail, CADA sets out four tiers. Each member state assesses the risk profile of its public sector bodies, and that assessment determines which tier a given buyer must demand.
| Assurance level | What a provider must show |
| Level 1: EU location | Data is stored and processed on infrastructure inside the EU. |
| Level 2: Independence | Independence from non-EU jurisdictions, plus visibility of the software supply chain. |
| Level 3: EU control | EU ownership and control of the provider, including requirements on staff citizenship. |
| Level 4: Full sovereignty | Complete control of and transparency over the software supply chain, with no third-country interference. |
From Level 2 upwards, providers must submit audit documentation to their national competent authority, and the Commission will keep a register of recognised providers and their tiers. CADA also brings the NIS2 Directive and the Cybersecurity Act directly into procurement decisions.
Why this lands on the MSP’s desk
CADA is aimed at cloud service providers, but MSPs sit squarely in the supply chain it scrutinises. If you host, manage or resell cloud services for public sector organisations, the rules shape what you can offer.
At every level, providers must be established in the EU and keep data in the EU. Above Level 1, European operations need legal, technical and organisational separation from any non-EU parent or subsidiary. At the higher tiers, subcontractors must be EU-established too. That brings MSPs into scope as links in a provider’s chain, and it means your own tooling (RMM, PSA, backup, security) could face the same questions about jurisdiction.
NIS2 already treats MSPs as a critical sector, so the security groundwork often exists. CADA adds a further question: who ultimately controls the stack?
The CADA opportunity for MSPs
Conversations at MSP GLOBAL kept circling back to demand. Customers who once defaulted to a hyperscaler now want options, and they need a trusted adviser to help them weigh those options. The openings include:
- Sovereignty assessments: mapping where client data sits, which jurisdictions can reach it and which CADA tier each workload is likely to need.
- Migration and hybrid design: moving sensitive workloads to European cloud providers while leaving less sensitive services where they are.
- Compliance services: assembling the documentation, supply chain evidence and audit packs that the higher tiers require.
- New partnerships: European cloud providers need channel reach and specialist skills, which is exactly what MSPs bring.
The Commission has explicitly designed CADA to widen the market to a more diverse range of providers, and self-certification at Level 1 lowers the barrier for smaller European firms.
The hurdles
Not everyone left the bar optimistic. Levels 3 and 4, with their demands for exclusive EU ownership, security-cleared staff holding EU citizenship and full supply chain control, may be beyond many non-EU providers and most EU SMEs. It could be the largest and best-resourced providers, particularly European ones, that stand to gain most.
For MSPs, the worries are familiar: the cost of evidencing compliance, skills shortages, uncertainty over how strictly each member state will classify risk, and margin pressure if sovereign infrastructure costs more. Few can or should abandon hyperscaler partnerships; the skill lies in offering both.
How MSPs can prepare for CADA
CADA is not expected to apply in full until 2029, but procurement teams tend to move before the law requires them to. Four practical steps:
- Audit your own stack for non-EU dependencies, including the tools you use to manage clients.
- Identify public sector clients, and the businesses that supply them, and estimate the tier each is likely to need.
- Open conversations with European cloud providers about partnership models.
- Build sovereignty into your sales story now, while competitors are still debating it at events.
CADA FAQ for MSPs
What is CADA?
An EU regulation within the Tech Sovereignty Package that aims to grow European cloud and AI capacity and introduces a four-tier sovereignty framework for cloud services bought by the public sector.
Does CADA apply to MSPs?
It targets cloud service providers, but MSPs that host, manage or resell cloud services for public sector customers, or act as subcontractors, will feel its effects, particularly at Level 2 and above.
Will CADA shut out US hyperscalers?
No. Non-EU providers can still take part, but reaching the top tiers would require substantial restructuring.
Keep the sovereignty conversation going with the MSP GLOBAL community.
Sign up for the newsletter or register now for MSP GLOBAL 2027.
