For years, "sovereign AI" has meant whatever the seller wanted it to mean. That is about to change.
On 3 June 2026 the European Commission published its proposal for the Cloud and AI Development Act (CADA). Most of the news was about its plan to build far more data centres in Europe. But a smaller part matters more if you buy AI: CADA sets out one shared way to measure how sovereign a cloud or AI service really is. It uses four levels, L1 to L4.
This post explains what each level means, why they are ordered the way they are, and what to do about it now.
It is a proposal, not a law yet
CADA is still a proposal. It has to pass through the European Parliament and the Council first. A final law probably will not arrive before late 2027, and the details can still change.
So one warning, and it applies to us too: no one is "CADA-certified" today. There is no certificate to hold yet. Be careful with any vendor who suggests otherwise. Every level below — including ours — is our reading of the draft, not an official stamp.
You can read the full proposal on the Commission's CADA page.
The four levels
The key idea is simple: what matters most is who controls the service, not where the data sits. Location counts at the bottom of the ladder. Control counts at the top.
L1 — In the EU. Your data and the servers are in the EU, and a foreign-owned provider cannot be forced to hide security flaws. This is the basic level: a promise about location.
L2 — Independent of other countries. Everything in L1, plus the staff running the service are in the EU, the provider is certified under the EU cloud scheme (EUCS), and the software is transparent — a full parts list, with any foreign code checked.
L3 — Owned and run from the EU. Everything in L2, plus the company itself is owned and controlled from the EU — not just the building it rents. A non-EU company can only reach this level with special permission from the Commission.
L4 — Full control, no outside reach. The top level. EU ownership and control with no exceptions, a "high" EU security certificate, and proof that the provider fully controls its own software — with no foreign party able to reach in.
A public body would pick the level that fits how sensitive the work is. A provider only earns a level after a national audit.
Why the order matters
The ladder fixes a problem that a simple "is it in the EU?" test cannot.
Take the most common claim you will hear: a US cloud giant offering an "EU region." Under CADA that reaches L1, and stops there — because the company is still American and still bound by the US CLOUD Act, whichever region you pick. The higher levels ask a different question: not where is the data? but who controls the company and the software, and can a foreign government force their hand? A region setting cannot answer that.
CADA works alongside the EU AI Act and GDPR, not instead of them. The AI Act covers how AI behaves; CADA covers how sovereign the infrastructure under it is. It also nudges public buyers to reward "European value" when they buy, and there is an open debate about whether the rules will also cover critical private sectors such as banking and energy.
What to do if you are buying AI now
You cannot get a CADA level today. But you can get ready, and it is just good buying practice:
Ask each provider which level they would reach — and to prove it. Where does the work actually run? Who owns and controls the company? What certificates do they really hold, with a link for each? A logo on a slide is not proof.
Trust control over labels. If the "sovereign" story rests on a setting rather than on who owns the stack, treat it as L1.
Keep the records. The national audit CADA describes runs on evidence — a log of which model and provider handled each request, under which country's law. Start keeping it now. It is the same evidence your data-protection lead already needs for the AI Act and DORA.
Where Stav sits
We built Stav for the top of this ladder before the ladder existed. Stav is an EU company that runs its own AI stack and serves open-weight models with no foreign off-switch — exactly what L3 and L4 ask for. On our reading of the draft, that is an L3/L4 position, while a US-hosted service reaches about L1.
And to hold ourselves to the test we just set: that is our reading of a proposal, not an official stamp — and we label it that way. Across our catalogue, every provider we use shows an indicative CADA level with the evidence behind it, so you can check the reasoning yourself.
Sovereignty is being defined. It is coming. When it arrives, the aim is simple: you should already have the answer, and the records to prove it.
Read the sovereignty argument at /sovereignty, or see how the controls work at /compliance.
This article is general information about a proposed law, not legal advice. CADA is a European Commission proposal published 3 June 2026 and may change as it moves through the EU process. The levels described reflect the proposal as drafted. Check any compliance decision with your own advisers.