In June, Brussels put four levels of sovereignty on the table for European public procurement. We wrote about it here. Since then, the proposed Cloud and AI Development Act (CADA) has entered the legislative machine, and the machine has started returning opinions.
The first institutional opinion of real weight arrived on 23 September. The European Economic and Social Committee (EESC), the advisory body that brings together employers, trade unions and civil society, adopted an opinion on the CADA in plenary, by 212 votes in favour, none against and 3 abstentions. It is not binding. But it says, with numbers, what many people in the sector had been saying quietly: as it stands, the Commission's proposal is not enough to change who wins cloud tenders in Europe.
Two numbers sum up the opinion. Fifteen and forty. And twenty-five per cent: aspiration or obligation.
Fifteen points out of a hundred and twenty
The Commission's proposal does not force anyone to buy European. What it does is allow public bodies, when scoring bids, to award points for what it calls "Union added value": the supplier being European, operating from Europe, and not being subject to third-country laws that compel it to hand over data. Recital 67 of the proposal caps that weighting at 15 points out of 120. Just over 12% of the score.
Anyone who has bid in a public tender knows what that is worth. A supplier with a decade's head start in scale, catalogue and references makes up 15 points effortlessly in the remaining 105. The criterion exists, it appears in the tender specifications, and it decides nothing.
The EESC says exactly that. Amendment 3 of the opinion proposes raising the cap to 40 points out of 120, a third of the score, on the grounds that 15 points "cannot meaningfully influence procurement outcomes at the scale needed to reverse market dependency". At 40 points, sovereignty stops being a tie-breaker and becomes a criterion that a non-European supplier cannot make up in the rest.
The difference between the two numbers is the difference between a law that signals and a law that redistributes.
Twenty-five per cent: aspiration or obligation
The second number is the SME quota. The Commission's proposal says Member States should seek to have at least 25% of relevant cloud and AI procurement awarded to innovative SMEs. "Seek" is the word that empties the sentence. There is no sanction, no metric, no deadline.
In recommendation 1.9, the EESC asks for the target to become a "shared requirement", with concrete implementation incentives: splitting contracts into lots that a mid-sized company can serve, and simplified qualification conditions. It is the part of the opinion that matters most to anyone running cloud, hosting or email from Portugal, or any other Member State, without being a telecoms group.
The reason is arithmetic. A public tender for a 40,000-mailbox email platform can be won by a large operator and delivered by a small supplier, as happened with the Ordem dos Advogados, the Portuguese Bar Association. But a tender designed as a single lot, with a minimum turnover in the tens of millions, does not even let the SME past the first criterion. The 25% quota only works if it forces tenders to be designed differently. That is what the EESC is asking for.
The opinion adds three requests that carry no number but do carry weight. That cloud infrastructure be a protected priority in the next multiannual financial framework, with the European Investment Bank mobilising private capital. That data centre acceleration zones, where permitting will be faster, have mandatory social and environmental impact assessments and genuine public consultation. And that monitoring of the regulation measure whether public institutions have gained the capacity to run their systems independently, not just whether they have changed supplier.
Where the process stands
The EESC opinion decides nothing on its own. The decisions belong to the European Parliament and the Council, and both started work in September.
In Parliament, on 17 September, the file (procedure 2026/0138(COD)) was assigned jointly to the Industry (ITRE) and Internal Market (IMCO) committees, with Legal Affairs and Civil Liberties giving opinions. The rapporteurs are Diego Solier, of the ECR group, for ITRE, and Reinier van Lanschot, of the Greens, for IMCO. Van Lanschot has said publicly that he wants to close negotiations with the Council by the end of 2027.
In the Council, the Working Party on Telecommunications and Information Society met on the CADA on 3, 8, 10, 15 and 22 September. Five meetings in a month is the pace of a priority file.
What this means in practice: there will be no final text before 2027, application will not come before 2028, and the numbers in recital 67 and the 25% quota will be negotiated line by line. The EESC opinion is the first institutional position calling for them to go up. It will not be the last: Germany and France, which are already switching software in their public administrations, have an interest in tougher criteria, and the countries where hyperscalers invest most in data centres have an interest in the opposite.
What this means for Portuguese public bodies
By a coincidence of timing, Portugal is in a curious position. On 1 October the biggest revision of the Public Contracts Code since 2017, Decree-Law 177/2026, came into force. The threshold for direct award of goods and services rose to €75,000, prior consultation to €130,000, a new "special prior consultation" was created for digital transformation projects, and the new Article 54-A allows contracts to be reserved for certified SMEs and startups.
In other words, Portuguese law already has the tool the EESC is asking for to make the 25% quota work: reserving contracts for SMEs. What it lacks is any criterion of European preference or sovereignty. Decree-Law 177/2026 does not use the word once. The "Union added value" weighting, whether 15 or 40 points, will only reach Portuguese tender specifications once the CADA is adopted and applied.
Until then, there is the National Sovereign Cloud Plan, approved in May, which classifies public administration processes into four levels (neutral, standard, critical and strategic) and requires each body to classify its own by 30 June 2027. The logic is the same as the CADA's: the more sensitive the process, the stricter the sovereignty requirement. The difference is that the Portuguese plan has not yet turned those levels into bid-scoring criteria, and that is where the 15 or 40 points will end up landing.
For a municipality, a school or a public institute launching an email, hosting or collaboration tender in the next eighteen months, the practical question is simple. Will the contract outlast the CADA's legislative process? If so, the tender specifications should already ask the supplier where the data is, which jurisdiction it answers to, who owns its capital and whether the service keeps running if a foreign government decides it should not. These are the questions Europe is about to start scoring. Asking them now costs nothing.
Critical voices
The opinion has limits worth stating. The EESC is advisory; Parliament and the Council can ignore it entirely, and often do. The US industry, through the CCIA, has already called the CADA "discriminatory" and warned of market fragmentation; raising the weighting from 15 to 40 points will intensify that pressure, and it is not certain that the Member States with the most hyperscaler investment will accept it. There is also a European critique: points do not create capacity. A sovereignty criterion worth a third of the score only helps if there are European suppliers with the scale to win, and in many segments there are not yet. The EESC itself acknowledges this when it asks for protected funding in the next multiannual budget.
What remains
In June, the Commission said digital sovereignty would start to count in public procurement. In September, the EESC said how much it had to count to make a difference. Somewhere between 15 and 40 points, over the course of 2027, it will be decided whether Europe buys cloud differently or just writes tender specifications differently.
The 15 points are an intention. The 40 would be a policy.
Sources
- EESC opinion on the Cloud and AI Development Act, Council document ST 13682/2026, 28 September 2026
- Procedure file 2026/0138(COD), European Parliament
- Agence Europe: Reinier van Lanschot appointed rapporteur in IMCO
- Council of the EU: Working Party on Telecommunications and Information Society, 8 September 2026
- Commission proposal COM(2026) 502, Cloud and AI Development Act, 3 June 2026
- WSGR: summary of the CADA proposal
- CCIA: position on the CADA, June 2026
- RNC Advogados: public procurement, what changes on 1 October (Decree-Law 177/2026, in Portuguese)
- APDC: the State's sovereign cloud starts in 2027, levels and deadlines of the PNNS (in Portuguese)
- Sooma: Brussels proposes four levels of digital sovereignty in public procurement