The TÜV Association welcomes the European Commission's proposal for a Cloud and AI Development Act (CADA). The proposal aims to strengthen Europe's digital sovereignty, reduce dependencies on non-European technology providers and promote the expansion of European cloud and AI infrastructure. Among other measures, data centres and computing capacity are to be expanded. The proposed legislation also provides for four EU-wide harmonised levels for assessing the digital sovereignty of cloud services, as well as independent audits.
In the TÜV Association's view, the planned harmonised European audit framework can help prevent so-called "sovereignty washing", meaning false or misleading claims by cloud providers about their independence from foreign control. The Association welcomes this approach but calls for the proposed requirements and audit procedures to be specified in greater detail.
Overview of the TÜV Association's recommendations:
- Involve independent auditing organisations
The proposed legislation provides for independent audits of cloud sovereignty. The TÜV Association calls for qualified independent testing and certification organisations, such as the TÜV organisations, to be explicitly allowed to participate in these audits. Prerequisites include demonstrated independence, technical expertise and relevant auditing experience.
- Establish clear criteria for digital sovereignty
The requirements for digital sovereignty must be precise and risk-based. What matters is not only where a provider is headquartered or who owns it, but also who exercises control over data and systems and what technical or legal dependencies exist. It must also be clear which cloud services were audited and under what conditions.
- Ensure harmonised audit procedures across Europe
Cloud services should be audited according to comparable criteria throughout the EU. This requires harmonised audit methods and requirements for the necessary evidence. Sensitive business and security information must be protected. To avoid duplicate audits, it should be possible to take previous audit results into account. Government oversight must be maintained.
- Test cloud provider switching and service recovery
Contracts for critical cloud services should contain verifiable requirements for switching providers, transferring data and applications, and restoring and maintaining operations. Corresponding contingency and switching plans should therefore be tested in practice and, where appropriate, independently audited.
- Take existing certifications into account
Existing audits and certifications, such as those based on ISO 27001 or the BSI C5 criteria catalogue, should be taken into account in the assessment where their results are relevant. However, they must not automatically replace an independent audit of digital sovereignty. The requirements of other European digital legislation should also be taken into account to avoid overlaps.
