Cloudy, with a chance of AI

In June 2026, the EU began tightening the requirements for engaging foreign cloud service providers to operate government AI systems.

For example, a court might use AI developed in the EU but running on a foreign provider’s cloud infrastructure. As a result, court data could be stored abroad or accessible to the foreign provider, creating risks of data leaks, loss of access to the service, and so on.

Consequently, the EU has presented a draft Cloud and AI Development Act (CADA). More than 70% of the EU cloud market is controlled by just 3 companies, all of which are foreign—Amazon, Microsoft, and Alphabet. Government AI infrastructure is becoming dependent on foreign cloud services.

To assess whether foreign providers should be allowed to participate in procurement, CADA introduces 4 “trust levels”: the higher a provider’s level, the more significant the functions for which it provides cloud services are to the state and society:

Level 1—for non-critical functions (AI does not use sensitive data, and a service outage does not pose a threat to society). Example: AI systems for document management. The provider and cloud infrastructure must be located in the EU.

Level 2—for functions posing a risk to public order (if sensitive data is involved or the service is critical to the operations of a government agency). Example: medical data management services in public hospitals. The provider’s staff, facilities, and equipment must be located in the EU. A foreign parent company must not be able to order its EU-based “subsidiary” to shut down the service.

Level 3 – for more critical functions (law enforcement, judicial activities, where data constitutes a state secret). Staff must be EU citizens. Companies controlled by foreign entities cannot be assigned Level 3 or higher.

Level 4—for the most critical functions (defense, national security, etc.). The provider must not be controlled by foreign entities, and all service support and data access must be provided exclusively within the EU.

Despite the stricter requirements, Amazon, Microsoft, Alphabet, and other foreign cloud providers can participate in Level 1–2 procurements through their European subsidiaries—Amazon Web Services and Google Cloud both have them.

In Russia, in June 2026, a draft federal law on supporting the development of AI was submitted to the State Duma (and adopted in July), in which the approach differs from that of the EU: data from state AI systems must be stored in data analysis centers owned by Russian legal entities. However, the Russian bill does not classify government systems by criticality, which would require different “trust levels” as in the EU.

The definitions of control also differ. In Russia, foreigners are not permitted to own more than 50% of a company. In the EU, control is defined as the ability to exert a “decisive influence” on a company’s operations, including through key contracts or foreign top managers. This approach is broader than in Russia.

From the monitoring issue No. 6 (30), June 2026. Download the full issue (PDF) · issue page at the Gaidar Institute